diff --git a/src/core/lib/iomgr/buffer_pool.c b/src/core/lib/iomgr/buffer_pool.c
index 98b3289af9c..26578e83cc8 100644
--- a/src/core/lib/iomgr/buffer_pool.c
+++ b/src/core/lib/iomgr/buffer_pool.c
@@ -193,7 +193,7 @@ static bool bpscavenge(grpc_exec_ctx *exec_ctx, grpc_buffer_pool *buffer_pool) {
   while ((buffer_user =
               bulist_pop(buffer_pool, GRPC_BULIST_NON_EMPTY_FREE_POOL))) {
     gpr_mu_lock(&buffer_user->mu);
-    if (buffer_pool->free_pool > 0) {
+    if (buffer_user->free_pool > 0) {
       buffer_pool->free_pool += buffer_user->free_pool;
       buffer_user->free_pool = 0;
       gpr_mu_unlock(&buffer_user->mu);
@@ -240,7 +240,7 @@ static void bu_add_to_free_pool(grpc_exec_ctx *exec_ctx, void *bu,
       bulist_empty(buffer_user->buffer_pool, GRPC_BULIST_NON_EMPTY_FREE_POOL)) {
     bpstep_sched(exec_ctx, buffer_user->buffer_pool);
   }
-  bulist_add_tail(buffer_user, GRPC_BULIST_AWAITING_ALLOCATION);
+  bulist_add_tail(buffer_user, GRPC_BULIST_NON_EMPTY_FREE_POOL);
 }
 
 static void bu_post_benign_reclaimer(grpc_exec_ctx *exec_ctx, void *bu,
diff --git a/test/core/iomgr/buffer_pool_test.c b/test/core/iomgr/buffer_pool_test.c
index 5ec15cca806..aec3869a94e 100644
--- a/test/core/iomgr/buffer_pool_test.c
+++ b/test/core/iomgr/buffer_pool_test.c
@@ -153,6 +153,43 @@ static void test_async_alloc_blocked_by_size(void) {
   destroy_user(&usr);
 }
 
+static void test_scavenge(void) {
+  gpr_log(GPR_INFO, "** test_scavenge **");
+  grpc_buffer_pool *p = grpc_buffer_pool_create();
+  grpc_buffer_pool_resize(p, 1024);
+  grpc_buffer_user usr1;
+  grpc_buffer_user usr2;
+  grpc_buffer_user_init(&usr1, p);
+  grpc_buffer_user_init(&usr2, p);
+  {
+    bool done = false;
+    grpc_exec_ctx exec_ctx = GRPC_EXEC_CTX_INIT;
+    grpc_buffer_user_alloc(&exec_ctx, &usr1, 1024, set_bool(&done));
+    grpc_exec_ctx_finish(&exec_ctx);
+    GPR_ASSERT(done);
+  }
+  {
+    grpc_exec_ctx exec_ctx = GRPC_EXEC_CTX_INIT;
+    grpc_buffer_user_free(&exec_ctx, &usr1, 1024);
+    grpc_exec_ctx_finish(&exec_ctx);
+  }
+  {
+    bool done = false;
+    grpc_exec_ctx exec_ctx = GRPC_EXEC_CTX_INIT;
+    grpc_buffer_user_alloc(&exec_ctx, &usr2, 1024, set_bool(&done));
+    grpc_exec_ctx_finish(&exec_ctx);
+    GPR_ASSERT(done);
+  }
+  {
+    grpc_exec_ctx exec_ctx = GRPC_EXEC_CTX_INIT;
+    grpc_buffer_user_free(&exec_ctx, &usr2, 1024);
+    grpc_exec_ctx_finish(&exec_ctx);
+  }
+  grpc_buffer_pool_unref(p);
+  destroy_user(&usr1);
+  destroy_user(&usr2);
+}
+
 int main(int argc, char **argv) {
   grpc_test_init(argc, argv);
   grpc_init();
@@ -163,6 +200,7 @@ int main(int argc, char **argv) {
   test_instant_alloc_free_pair();
   test_simple_async_alloc();
   test_async_alloc_blocked_by_size();
+  test_scavenge();
   grpc_shutdown();
   return 0;
 }