diff --git a/dlls/rpcrt4/cstub.c b/dlls/rpcrt4/cstub.c
index 2deb2b11878..b33363b6511 100644
--- a/dlls/rpcrt4/cstub.c
+++ b/dlls/rpcrt4/cstub.c
@@ -121,9 +121,11 @@ ULONG WINAPI NdrCStdStubBuffer_Release(LPRPCSTUBBUFFER iface,
   refs = InterlockedDecrement(&This->RefCount);
   if (!refs)
   {
+    /* test_Release shows that native doesn't call Disconnect here.
+       We'll leave it in for the time being. */
     IRpcStubBuffer_Disconnect(iface);
-    if(This->pPSFactory)
-        IPSFactoryBuffer_Release(This->pPSFactory);
+
+    IPSFactoryBuffer_Release(pPSF);
     HeapFree(GetProcessHeap(),0,This);
   }
   return refs;
diff --git a/dlls/rpcrt4/tests/cstub.c b/dlls/rpcrt4/tests/cstub.c
index 733acc4f560..70399437f3d 100644
--- a/dlls/rpcrt4/tests/cstub.c
+++ b/dlls/rpcrt4/tests/cstub.c
@@ -765,6 +765,51 @@ static void test_Disconnect(IPSFactoryBuffer *ppsf)
     ok(cstd_stub->pvServerObject == NULL, "pvServerObject %p\n", cstd_stub->pvServerObject);
 }
 
+
+static int release_test_psfacbuf_release_called;
+static ULONG WINAPI release_test_pretend_psfacbuf_release(IUnknown *pUnk)
+{
+    release_test_psfacbuf_release_called++;
+    return 1;
+}
+
+static IUnknownVtbl release_test_pretend_psfacbuf_vtbl =
+{
+    NULL,
+    NULL,
+    release_test_pretend_psfacbuf_release
+};
+
+static void test_Release(IPSFactoryBuffer *ppsf)
+{
+    LONG facbuf_refs;
+    IUnknownVtbl *orig_vtbl = &connect_test_orig_vtbl;
+    IUnknown *obj = (IUnknown*)&orig_vtbl;
+    IUnknownVtbl *pretend_psfacbuf_vtbl = &release_test_pretend_psfacbuf_vtbl;
+    IUnknown *pretend_psfacbuf = (IUnknown *)&pretend_psfacbuf_vtbl;
+    IRpcStubBuffer *pstub = create_stub(ppsf, &IID_if1, obj, S_OK);
+    CStdStubBuffer *cstd_stub = (CStdStubBuffer*)pstub;
+
+    facbuf_refs = PSFactoryBuffer.RefCount;
+
+    /* This shows that NdrCStdStubBuffer_Release doesn't call Disconnect */
+    ok(cstd_stub->RefCount == 1, "ref count %ld\n", cstd_stub->RefCount);
+    connect_test_orig_release_called = 0;
+    IRpcStubBuffer_Release(pstub);
+todo_wine {
+    ok(connect_test_orig_release_called == 0, "release called %d\n", connect_test_orig_release_called);
+}
+    ok(PSFactoryBuffer.RefCount == facbuf_refs - 1, "factory buffer refs %ld orig %ld\n", PSFactoryBuffer.RefCount, facbuf_refs);
+
+    /* This shows that NdrCStdStubBuffer_Release calls Release on its 2nd arg, rather than on This->pPSFactory
+       (which are usually the same and indeed it's odd that _Release requires this 2nd arg). */
+    pstub = create_stub(ppsf, &IID_if1, obj, S_OK);
+    ok(PSFactoryBuffer.RefCount == facbuf_refs, "factory buffer refs %ld orig %ld\n", PSFactoryBuffer.RefCount, facbuf_refs);
+    NdrCStdStubBuffer_Release(pstub, (IPSFactoryBuffer*)pretend_psfacbuf);
+    ok(release_test_psfacbuf_release_called == 1, "pretend_psfacbuf_release called %d\n", release_test_psfacbuf_release_called);
+    ok(PSFactoryBuffer.RefCount == facbuf_refs, "factory buffer refs %ld orig %ld\n", PSFactoryBuffer.RefCount, facbuf_refs);
+}
+
 START_TEST( cstub )
 {
     IPSFactoryBuffer *ppsf;
@@ -776,6 +821,7 @@ START_TEST( cstub )
     test_CreateStub(ppsf);
     test_Connect(ppsf);
     test_Disconnect(ppsf);
+    test_Release(ppsf);
 
     OleUninitialize();
 }