diff --git a/CHANGELOG b/CHANGELOG
index 98a0840..1dc12e7 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,3 +1,7 @@
+2024-06-12
+    - 4.0.9
+    - Fix bpq_count (issue #504).
+
 2024-03-12
     - 4.0.8
     - Fix RETIRE_CONNECTION_ID frame abuse.
diff --git a/docs/conf.py b/docs/conf.py
index 4d50bfb..3b7c6f6 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -26,7 +26,7 @@ author = u'LiteSpeed Technologies'
 # The short X.Y version
 version = u'4.0'
 # The full version, including alpha/beta/rc tags
-release = u'4.0.8'
+release = u'4.0.9'
 
 
 # -- General configuration ---------------------------------------------------
diff --git a/include/lsquic.h b/include/lsquic.h
index e83d04b..7064da2 100644
--- a/include/lsquic.h
+++ b/include/lsquic.h
@@ -27,7 +27,7 @@ extern "C" {
 
 #define LSQUIC_MAJOR_VERSION 4
 #define LSQUIC_MINOR_VERSION 0
-#define LSQUIC_PATCH_VERSION 8
+#define LSQUIC_PATCH_VERSION 9
 
 /**
  * Engine flags:
diff --git a/src/liblsquic/lsquic_send_ctl.c b/src/liblsquic/lsquic_send_ctl.c
index 5baba01..aea005f 100644
--- a/src/liblsquic/lsquic_send_ctl.c
+++ b/src/liblsquic/lsquic_send_ctl.c
@@ -3169,7 +3169,7 @@ split_buffered_packet (lsquic_send_ctl_t *ctl,
 
     LSQ_DEBUG("drop oversized buffered packet #%"PRIu64, packet_out->po_packno);
     TAILQ_REMOVE(&packet_q->bpq_packets, packet_out, po_next);
-    ++packet_q->bpq_count;
+    --packet_q->bpq_count;
     assert(packet_out->po_loss_chain == packet_out);
     send_ctl_destroy_packet(ctl, packet_out);
     return 0;