diff --git a/CHANGES b/CHANGES
index 1659207b7f..0557a7aff2 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+2062.	[bug]		'dig +nssearch' was reusing a buffer before it had
+			been returned by the socket code. [RT #16307]
+
 2057.	[bug]		Make setting "ra" dependent on both allow-query and
 			allow-recursion. [RT #16290]
 
diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
index 8014dd476b..0b5a1d6794 100644
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dighost.c,v 1.221.2.19.2.33 2006/06/07 00:29:44 marka Exp $ */
+/* $Id: dighost.c,v 1.221.2.19.2.34 2006/08/01 00:54:20 marka Exp $ */
 
 /*
  * Notice to programmers:  Do not use this code as an example of how to
@@ -314,6 +314,9 @@ cancel_lookup(dig_lookup_t *lookup);
 static void
 recv_done(isc_task_t *task, isc_event_t *event);
 
+static void
+send_udp(dig_query_t *query);
+
 static void
 connect_timeout(isc_task_t *task, isc_event_t *event);
 
@@ -1867,6 +1870,8 @@ static void
 send_done(isc_task_t *_task, isc_event_t *event) {
 	isc_socketevent_t *sevent = (isc_socketevent_t *)event;
 	isc_buffer_t *b = NULL;
+	dig_query_t *query, *next;
+	dig_lookup_t *l;
 
 	REQUIRE(event->ev_type == ISC_SOCKEVENT_SENDDONE);
 
@@ -1874,17 +1879,28 @@ send_done(isc_task_t *_task, isc_event_t *event) {
 
 	LOCK_LOOKUP;
 
+	debug("send_done()");
+	sendcount--;
+	debug("sendcount=%d", sendcount);
+	INSIST(sendcount >= 0);
+
 	for  (b = ISC_LIST_HEAD(sevent->bufferlist);
 	      b != NULL;
 	      b = ISC_LIST_HEAD(sevent->bufferlist)) 
 		ISC_LIST_DEQUEUE(sevent->bufferlist, b, link);
 
+	query = event->ev_arg;
+	l = query->lookup;
+
+	if (l->ns_search_only && !l->trace_root) {
+		debug("sending next, since searching");
+		next = ISC_LIST_NEXT(query, link);
+		if (next != NULL)
+			send_udp(next);
+	}
+
 	isc_event_free(&event);
 
-	debug("send_done()");
-	sendcount--;
-	debug("sendcount=%d", sendcount);
-	INSIST(sendcount >= 0);
 	check_if_done();
 	UNLOCK_LOOKUP;
 }
@@ -2028,7 +2044,6 @@ send_tcp_connect(dig_query_t *query) {
 static void
 send_udp(dig_query_t *query) {
 	dig_lookup_t *l = NULL;
-	dig_query_t *next;
 	isc_result_t result;
 
 	debug("send_udp(%p)", query);
@@ -2081,16 +2096,6 @@ send_udp(dig_query_t *query) {
 				    &query->sockaddr, NULL);
 	check_result(result, "isc_socket_sendtov");
 	sendcount++;
-	/*
-	 * If we're at the endgame of a nameserver search, we need to
-	 * immediately bring up all the queries.  Do it here.
-	 */
-	if (l->ns_search_only && !l->trace_root) {
-		debug("sending next, since searching");
-		next = ISC_LIST_NEXT(query, link);
-		if (next != NULL)
-			send_udp(next);
-	}
 }
 
 /*