diff --git a/src/core/memp.c b/src/core/memp.c
index 14e123e1..0902b441 100644
--- a/src/core/memp.c
+++ b/src/core/memp.c
@@ -60,6 +60,7 @@
 #include "lwip/dns.h"
 #include "lwip/netdb.h"
 #include "netif/ppp/ppp.h"
+#include "netif/ppp/pppos.h"
 #include "netif/ppp/pppoe.h"
 #include "netif/ppp/pppol2tp.h"
 #include "lwip/nd6.h"
diff --git a/src/include/lwip/memp_std.h b/src/include/lwip/memp_std.h
index ce303da0..54d678ae 100644
--- a/src/include/lwip/memp_std.h
+++ b/src/include/lwip/memp_std.h
@@ -102,6 +102,9 @@ LWIP_MEMPOOL(LOCALHOSTLIST,  MEMP_NUM_LOCALHOSTLIST,   LOCALHOSTLIST_ELEM_SIZE,
 
 #if PPP_SUPPORT
 LWIP_MEMPOOL(PPP_PCB,       MEMP_NUM_PPP_PCB,              sizeof(ppp_pcb),             "PPP_PCB")
+#if PPPOS_SUPPORT
+LWIP_MEMPOOL(PPPOS_PCB,     MEMP_NUM_PPPOS_INTERFACES,     sizeof(pppos_pcb),           "PPPOS_PCB")
+#endif /* PPPOS_SUPPORT */
 #if PPPOE_SUPPORT
 LWIP_MEMPOOL(PPPOE_IF,      MEMP_NUM_PPPOE_INTERFACES,     sizeof(struct pppoe_softc),  "PPPOE_IF")
 #endif /* PPPOE_SUPPORT */
diff --git a/src/include/lwip/opt.h b/src/include/lwip/opt.h
index 121c0f26..ce8b7fbb 100644
--- a/src/include/lwip/opt.h
+++ b/src/include/lwip/opt.h
@@ -416,6 +416,14 @@
 #define MEMP_NUM_PPP_PCB       1
 #endif
 
+/**
+ * MEMP_NUM_PPPOS_INTERFACES: the number of concurrently active PPPoS
+ * interfaces (only used with PPPOS_SUPPORT==1)
+ */
+#ifndef MEMP_NUM_PPPOS_INTERFACES
+#define MEMP_NUM_PPPOS_INTERFACES       MEMP_NUM_PPP_PCB
+#endif
+
 /**
  * MEMP_NUM_PPPOE_INTERFACES: the number of concurrently active PPPoE
  * interfaces (only used with PPPOE_SUPPORT==1)
diff --git a/src/include/netif/ppp/pppos.h b/src/include/netif/ppp/pppos.h
index bd626584..93a72062 100644
--- a/src/include/netif/ppp/pppos.h
+++ b/src/include/netif/ppp/pppos.h
@@ -39,6 +39,14 @@
 
 #include "ppp.h"
 
+/*
+ * PPPoS interface control block.
+ */
+typedef struct pppos_pcb_s pppos_pcb;
+struct pppos_pcb_s {
+  ppp_pcb *ppp;                /* PPP PCB */
+};
+
 /* Create a new PPPoS session. */
 ppp_pcb *ppp_over_serial_create(struct netif *pppif, sio_fd_t fd,
              ppp_link_status_cb_fn link_status_cb, void *ctx_cb);
diff --git a/src/netif/ppp/pppos.c b/src/netif/ppp/pppos.c
index 3b78503f..4ebd2baf 100644
--- a/src/netif/ppp/pppos.c
+++ b/src/netif/ppp/pppos.c
@@ -54,9 +54,9 @@ static int pppos_link_write_callback(void *pcb, struct pbuf *p);
 static err_t pppos_link_netif_output_callback(void *pcb, struct pbuf *pb, u_short protocol);
 
 /* Prototypes for procedures local to this file. */
-static void pppos_connect(ppp_pcb *pcb);
-static void pppos_disconnect(ppp_pcb *pcb);
-static err_t pppos_destroy(ppp_pcb *sc);
+static void pppos_connect(pppos_pcb *pcb);
+static void pppos_disconnect(pppos_pcb *pcb);
+static err_t pppos_destroy(pppos_pcb *sc);
 #if PPP_INPROC_MULTITHREADED
 static void pppos_input_callback(void *arg);
 #endif /* PPP_INPROC_MULTITHREADED */
@@ -96,6 +96,7 @@ ppp_pcb *
 ppp_over_serial_create(struct netif *pppif, sio_fd_t fd,
              ppp_link_status_cb_fn link_status_cb, void *ctx_cb)
 {
+  pppos_pcb *sc;
   ppp_pcb *ppp;
 
   ppp = ppp_new(pppif, link_status_cb, ctx_cb);
@@ -103,8 +104,15 @@ ppp_over_serial_create(struct netif *pppif, sio_fd_t fd,
     return NULL;
   }
 
+  sc = (pppos_pcb *)memp_malloc(MEMP_PPPOS_PCB);
+  if (sc == NULL) {
+    ppp_free(ppp);
+    return NULL;
+  }
+
+  sc->ppp = ppp;
   ppp->fd = fd;
-  ppp_link_set_callbacks(ppp, pppos_link_command_callback, pppos_link_write_callback, pppos_link_netif_output_callback, ppp);
+  ppp_link_set_callbacks(ppp, pppos_link_command_callback, pppos_link_write_callback, pppos_link_netif_output_callback, sc);
   return ppp;
 }
 
@@ -112,19 +120,19 @@ ppp_over_serial_create(struct netif *pppif, sio_fd_t fd,
 static void
 pppos_link_command_callback(void *pcb, u8_t command)
 {
-  ppp_pcb *ppp = (ppp_pcb *)pcb;
+  pppos_pcb *sc = (pppos_pcb *)pcb;
 
   switch(command) {
   case PPP_LINK_COMMAND_CONNECT:
-    pppos_connect(ppp);
+    pppos_connect(sc);
     break;
 
   case PPP_LINK_COMMAND_DISCONNECT:
-    pppos_disconnect(ppp);
+    pppos_disconnect(sc);
     break;
 
   case PPP_LINK_COMMAND_FREE:
-    pppos_destroy(ppp);
+    pppos_destroy(sc);
     break;
 
   default: ;
@@ -135,7 +143,8 @@ pppos_link_command_callback(void *pcb, u8_t command)
 static int
 pppos_link_write_callback(void *pcb, struct pbuf *p)
 {
-  ppp_pcb *ppp = (ppp_pcb *)pcb;
+  pppos_pcb *sc = (pppos_pcb *)pcb;
+  ppp_pcb *ppp = sc->ppp;
   u_char *s = (u_char*)p->payload;
   int n = p->len;
   u_char c;
@@ -204,7 +213,8 @@ pppos_link_write_callback(void *pcb, struct pbuf *p)
 static err_t
 pppos_link_netif_output_callback(void *pcb, struct pbuf *pb, u_short protocol)
 {
-  ppp_pcb *ppp = (ppp_pcb *)pcb;
+  pppos_pcb *sc = (pppos_pcb *)pcb;
+  ppp_pcb *ppp = sc->ppp;
   u_int fcs_out = PPP_INITFCS;
   struct pbuf *head = NULL, *tail = NULL, *p;
   u_char c;
@@ -315,49 +325,56 @@ pppos_link_netif_output_callback(void *pcb, struct pbuf *pb, u_short protocol)
 }
 
 static void
-pppos_connect(ppp_pcb *pcb)
+pppos_connect(pppos_pcb *pcb)
 {
+  ppp_pcb *ppp = pcb->ppp;
 
   /* input pbuf left over from last session? */
-  pppos_free_current_input_packet(&pcb->rx);
+  pppos_free_current_input_packet(&ppp->rx);
 
-  ppp_clear(pcb);
+  ppp_clear(ppp);
 
-  pcb->rx.pcb = pcb;
-  pcb->rx.fd = pcb->fd;
+  ppp->rx.pcb = ppp;
+  ppp->rx.fd = ppp->fd;
 
 #if VJ_SUPPORT
-  vj_compress_init(&pcb->vj_comp);
+  vj_compress_init(&ppp->vj_comp);
 #endif /* VJ_SUPPORT */
 
   /*
    * Default the in and out accm so that escape and flag characters
    * are always escaped.
    */
-  pcb->rx.in_accm[15] = 0x60; /* no need to protect since RX is not running */
-  pcb->out_accm[15] = 0x60;
+  ppp->rx.in_accm[15] = 0x60; /* no need to protect since RX is not running */
+  ppp->out_accm[15] = 0x60;
 
   /*
    * Start the connection and handle incoming events (packet or timeout).
    */
-  PPPDEBUG(LOG_INFO, ("pppos_connect: unit %d: connecting\n", pcb->num));
-  ppp_start(pcb); /* notify upper layers */
+  PPPDEBUG(LOG_INFO, ("pppos_connect: unit %d: connecting\n", ppp->num));
+  ppp_start(ppp); /* notify upper layers */
 }
 
 static void
-pppos_disconnect(ppp_pcb *pcb)
+pppos_disconnect(pppos_pcb *pcb)
 {
+  ppp_pcb *ppp = pcb->ppp;
+
   /* We cannot call ppp_free_current_input_packet() here because
    * rx thread might still call pppos_input()
    */
-  ppp_link_end(pcb); /* notify upper layers */
+  ppp_link_end(ppp); /* notify upper layers */
 }
 
 static err_t
-pppos_destroy(ppp_pcb *pcb)
+pppos_destroy(pppos_pcb *sc)
 {
+  ppp_pcb *ppp = sc->ppp;
+
   /* input pbuf left ? */
-  pppos_free_current_input_packet(&pcb->rx);
+  pppos_free_current_input_packet(&ppp->rx);
+
+  memp_free(MEMP_PPPOS_PCB, sc);
   return ERR_OK;
 }