diff --git a/CHANGELOG b/CHANGELOG
index 0dcd903b..893eac16 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -43,6 +43,10 @@ HISTORY
 
   ++ Bugfixes:
 
+  2009-10-15: Simon Goldschmidt
+  * api_msg.c: Fixed bug #27709: conn->err race condition on netconn_recv()
+    timeout
+
   2009-10-15: Simon Goldschmidt
   * autoip.c: Fixed bug #27704: autoip starts with wrong address
     LWIP_AUTOIP_CREATE_SEED_ADDR() returned address in host byte order instead
diff --git a/src/api/api_lib.c b/src/api/api_lib.c
index 86df911e..195a9a52 100644
--- a/src/api/api_lib.c
+++ b/src/api/api_lib.c
@@ -327,8 +327,9 @@ netconn_recv(struct netconn *conn)
 
 #if LWIP_SO_RCVTIMEO
     if (sys_arch_mbox_fetch(conn->recvmbox, (void *)&p, conn->recv_timeout)==SYS_ARCH_TIMEOUT) {
+      memp_free(MEMP_NETBUF, buf);
       conn->err = ERR_TIMEOUT;
-      p = NULL;
+      return NULL;
     }
 #else
     sys_arch_mbox_fetch(conn->recvmbox, (void *)&p, 0);