diff --git a/ssh.c b/ssh.c
index 89041f48..aa9fd5dd 100644
--- a/ssh.c
+++ b/ssh.c
@@ -8105,6 +8105,8 @@ static void ssh2_msg_channel_response(Ssh ssh, struct Packet *pktin)
 	return;
     }
     ocr->handler(c, pktin, ocr->ctx);
+    if (ssh->state == SSH_STATE_CLOSED)
+        return; /* in case the handler called bomb_out(), which some can */
     c->v.v2.chanreq_head = ocr->next;
     sfree(ocr);
     /*