diff --git a/wolfcrypt/src/port/intel/quickassist.c b/wolfcrypt/src/port/intel/quickassist.c
index bd3c84b81c..275851c807 100644
--- a/wolfcrypt/src/port/intel/quickassist.c
+++ b/wolfcrypt/src/port/intel/quickassist.c
@@ -323,6 +323,13 @@ void IntelQaHardwareStop(void)
     printf("IntelQA: Stop\n");
 }
 
+/* Returns nonzero when the QAT crypto service is running. Lets the memory
+ * layer fall back to regular memory when the service is not started. */
+WOLFSSL_LOCAL int IntelQaIsStarted(void)
+{
+    return (g_cyServiceStarted == CPA_TRUE) ? 1 : 0;
+}
+
 int IntelQaHardwareStart(const char* process_name, int limitDevAccess)
 {
     int ret = 0, i;
diff --git a/wolfcrypt/src/port/intel/quickassist_mem.c b/wolfcrypt/src/port/intel/quickassist_mem.c
index 7d44572a93..f58f6d3fa5 100644
--- a/wolfcrypt/src/port/intel/quickassist_mem.c
+++ b/wolfcrypt/src/port/intel/quickassist_mem.c
@@ -410,6 +410,14 @@ static void* _qaeMemAlloc(size_t size, void* heap, int type
         ptr = qaeMemAllocNUMA((Cpa32U)(size + sizeof(qaeMemHeader)), 0,
             alignment, &page_offset);
     #endif
+        /* Service not up (e.g. "Running without async"): fall back to regular
+         * memory so software crypto can proceed. A NULL while it IS up means
+         * real NUMA exhaustion and stays NULL so the QAT op fails cleanly. */
+        if (ptr == NULL && !IntelQaIsStarted()) {
+            isNuma = 0;
+            page_offset = QAE_NOT_NUMA_PAGE;
+            ptr = malloc(size + sizeof(qaeMemHeader));
+        }
     }
     else {
         isNuma = 0;
@@ -611,8 +619,10 @@ void* IntelQaRealloc(void *ptr, size_t size, void* heap, int type
                 copySize = size;
             XMEMCPY(newPtr, ptr, copySize);
 
-            if (newIsNuma == 0 && ptrIsNuma == 0) {
-                /* for non-NUMA, treat as normal REALLOC and free old pointer */
+            if (ptrIsNuma == 0) {
+                /* old pointer is a qae-headed non-NUMA buffer (software
+                 * fallback) -- free it. Caller-owned (ptrIsNuma == -1) and
+                 * NUMA (== 1) buffers are handled by their own paths. */
                 _qaeMemFree(ptr, heap, type
                 #ifdef WOLFSSL_DEBUG_MEMORY
                     , func, line
diff --git a/wolfssl/wolfcrypt/port/intel/quickassist_mem.h b/wolfssl/wolfcrypt/port/intel/quickassist_mem.h
index d5b569548d..a52ddb4b61 100644
--- a/wolfssl/wolfcrypt/port/intel/quickassist_mem.h
+++ b/wolfssl/wolfcrypt/port/intel/quickassist_mem.h
@@ -59,6 +59,10 @@ WOLFSSL_API void* IntelQaRealloc(void *ptr, size_t size, void* heap, int type
 #endif
 );
 
+/* Nonzero when the QAT crypto service is running (defined in quickassist.c).
+ * Lets the memory layer fall back to regular memory when QAT is not up. */
+WOLFSSL_LOCAL int IntelQaIsStarted(void);
+
 #endif /* HAVE_INTEL_QA */
 
 #endif /* _QUICKASSIST_MEM_H_ */