diff --git a/dom/bluetooth/bluedroid/BluetoothDaemonInterface.cpp b/dom/bluetooth/bluedroid/BluetoothDaemonInterface.cpp
index 80664b43bc8a..2ce93da8404a 100644
--- a/dom/bluetooth/bluedroid/BluetoothDaemonInterface.cpp
+++ b/dom/bluetooth/bluedroid/BluetoothDaemonInterface.cpp
@@ -1507,6 +1507,7 @@ BluetoothDaemonProtocol::Send(BluetoothDaemonPDU* aPDU, void* aUserData)
   MOZ_ASSERT(mConnection);
   MOZ_ASSERT(aPDU);
 
+  aPDU->SetConsumer(this);
   aPDU->SetUserData(aUserData);
   aPDU->UpdateHeader();
   return mConnection->Send(aPDU); // Forward PDU to command channel
diff --git a/ipc/bluetooth/BluetoothDaemonConnection.cpp b/ipc/bluetooth/BluetoothDaemonConnection.cpp
index 8f6068f74b8a..e474fd48a1d2 100644
--- a/ipc/bluetooth/BluetoothDaemonConnection.cpp
+++ b/ipc/bluetooth/BluetoothDaemonConnection.cpp
@@ -42,8 +42,9 @@ static const char sBluetoothdSocketName[] = "bluez_hal_socket";
 
 BluetoothDaemonPDU::BluetoothDaemonPDU(uint8_t aService, uint8_t aOpcode,
                                        uint16_t aPayloadSize)
-: UnixSocketIOBuffer(HEADER_SIZE + aPayloadSize)
-, mUserData(nullptr)
+  : UnixSocketIOBuffer(HEADER_SIZE + aPayloadSize)
+  , mConsumer(nullptr)
+  , mUserData(nullptr)
 {
   uint8_t* data = Append(HEADER_SIZE);
   MOZ_ASSERT(data);
@@ -55,8 +56,9 @@ BluetoothDaemonPDU::BluetoothDaemonPDU(uint8_t aService, uint8_t aOpcode,
 }
 
 BluetoothDaemonPDU::BluetoothDaemonPDU(size_t aPayloadSize)
-: UnixSocketIOBuffer(HEADER_SIZE + aPayloadSize)
-, mUserData(nullptr)
+  : UnixSocketIOBuffer(HEADER_SIZE + aPayloadSize)
+  , mConsumer(nullptr)
+  , mUserData(nullptr)
 { }
 
 void
@@ -92,6 +94,12 @@ BluetoothDaemonPDU::Send(int aFd)
 
   Consume(res);
 
+  if (mConsumer) {
+    // We successfully sent a PDU, now store the
+    // result runnable in the consumer.
+    mConsumer->StoreUserData(*this);
+  }
+
   return res;
 }
 
@@ -376,7 +384,6 @@ BluetoothDaemonConnectionIO::Send(BluetoothDaemonPDU* aPDU)
   MOZ_ASSERT(mConsumer);
   MOZ_ASSERT(aPDU);
 
-  mConsumer->StoreUserData(*aPDU); // Store user data for reply
   EnqueueData(aPDU);
   AddWatchers(WRITE_WATCHER, false);
 }
diff --git a/ipc/bluetooth/BluetoothDaemonConnection.h b/ipc/bluetooth/BluetoothDaemonConnection.h
index 007c9acd69a1..285e3234cb35 100644
--- a/ipc/bluetooth/BluetoothDaemonConnection.h
+++ b/ipc/bluetooth/BluetoothDaemonConnection.h
@@ -18,6 +18,7 @@ namespace mozilla {
 namespace ipc {
 
 class BluetoothDaemonConnectionIO;
+class BluetoothDaemonPDUConsumer;
 
 /*
  * |BlutoothDaemonPDU| represents a single PDU that is transfered from or to
@@ -55,6 +56,11 @@ public:
                      uint16_t aPayloadSize);
   BluetoothDaemonPDU(size_t aPayloadSize);
 
+  void SetConsumer(BluetoothDaemonPDUConsumer* aConsumer)
+  {
+    mConsumer = aConsumer;
+  }
+
   void SetUserData(void* aUserData)
   {
     mUserData = aUserData;
@@ -79,6 +85,7 @@ private:
   size_t GetPayloadSize() const;
   void OnError(const char* aFunction, int aErrno);
 
+  BluetoothDaemonPDUConsumer* mConsumer;
   void* mUserData;
   ScopedClose mReceivedFd;
 };