diff --git a/src/http/ngx_http_spdy.c b/src/http/ngx_http_spdy.c
index a040a38..b5aa993 100644
--- a/src/http/ngx_http_spdy.c
+++ b/src/http/ngx_http_spdy.c
@@ -527,7 +527,9 @@
         }
     }
 
-    for ( /* void */ ; out; out = out->next) {
+    for ( /* void */ ; out; out = fn) {
+        fn = out->next;
+
         if (out->handler(sc, out) != NGX_OK) {
             out->blocked = 1;
             out->priority = NGX_SPDY_HIGHEST_PRIORITY;
@@ -1644,7 +1646,7 @@
     frame = sc->free_ctl_frames;
 
     if (frame) {
-        sc->free_ctl_frames = frame->free;
+        sc->free_ctl_frames = frame->next;
 
         cl = frame->first;
         cl->buf->pos = cl->buf->start;
@@ -1674,8 +1676,6 @@
         frame->stream = NULL;
     }
 
-    frame->free = NULL;
-
 #if (NGX_DEBUG)
     if (size > NGX_SPDY_CTL_FRAME_BUFFER_SIZE - NGX_SPDY_FRAME_HEADER_SIZE) {
         ngx_log_error(NGX_LOG_ALERT, sc->pool->log, 0,
@@ -1705,7 +1705,7 @@
         return NGX_AGAIN;
     }
 
-    frame->free = sc->free_ctl_frames;
+    frame->next = sc->free_ctl_frames;
     sc->free_ctl_frames = frame;
 
     return NGX_OK;