diff --git a/src/core/ddsi/src/ddsi_security_exchange.c b/src/core/ddsi/src/ddsi_security_exchange.c
index c583f71..e510e2c 100644
--- a/src/core/ddsi/src/ddsi_security_exchange.c
+++ b/src/core/ddsi/src/ddsi_security_exchange.c
@@ -296,10 +296,10 @@ static bool write_crypto_exchange_message(const struct participant *pp, const dd
   };
   serdata = ddsi_serdata_from_sample (gv->rawcdr_topic, SDK_DATA, &raw);
   tk = ddsi_tkmap_lookup_instance_ref (gv->m_tkmap, serdata);
-  ddsrt_mutex_unlock (&wr->e.lock);
-  ddsrt_free(data);
 
   r = write_sample_p2p_wrlock_held(wr, seq, NULL, serdata, tk, prd);
+  ddsrt_mutex_unlock (&wr->e.lock);
+  ddsrt_free(data);
   ddsi_tkmap_instance_unref (gv->m_tkmap, tk);
   ddsi_serdata_unref (serdata);
 
diff --git a/src/core/ddsi/src/ddsi_security_omg.c b/src/core/ddsi/src/ddsi_security_omg.c
index 8e3808d..7204515 100644
--- a/src/core/ddsi/src/ddsi_security_omg.c
+++ b/src/core/ddsi/src/ddsi_security_omg.c
@@ -1829,7 +1829,6 @@ bool q_omg_is_similar_participant_security_info(struct participant *pp, struct p
       proxypp->security_info.plugin_security_attributes = pp_security_info.plugin_security_attributes;
     }
   }
-  assert(matching);
   return matching;
 }
 
@@ -2504,10 +2503,10 @@ void q_omg_security_set_remote_writer_crypto_tokens(struct reader *rd, const dds
     {
       GVTRACE("set_remote_writer_crypto_tokens "PGUIDFMT" with reader "PGUIDFMT"\n", PGUID(pwr->e.guid), PGUID(rd->e.guid));
       match->matched = true;
-      DDS_Security_DataHolderSeq_free(tseq);
     }
     else
       EXCEPTION_ERROR(sc, &exception, "Failed to set remote writer crypto tokens "PGUIDFMT" for reader "PGUIDFMT, PGUID(pwr->e.guid), PGUID(rd->e.guid));
+    DDS_Security_DataHolderSeq_free(tseq);
   }
   ddsrt_mutex_unlock(&rd->e.lock);
 
@@ -2551,10 +2550,10 @@ void q_omg_security_set_remote_reader_crypto_tokens(struct writer *wr, const dds
     {
       GVTRACE("set_remote_reader_crypto_tokens "PGUIDFMT" with writer "PGUIDFMT"\n", PGUID(prd->e.guid), PGUID(wr->e.guid));
       match->matched = true;
-      DDS_Security_DataHolderSeq_free(tseq);
     }
     else
       EXCEPTION_ERROR(sc, &exception, "Failed to set remote reader crypto tokens "PGUIDFMT" for writer "PGUIDFMT, PGUID(prd->e.guid), PGUID(wr->e.guid));
+    DDS_Security_DataHolderSeq_free(tseq);
   }
   ddsrt_mutex_unlock(&wr->e.lock);
 
diff --git a/src/core/ddsi/src/q_receive.c b/src/core/ddsi/src/q_receive.c
index 640436b..7a5f9a7 100644
--- a/src/core/ddsi/src/q_receive.c
+++ b/src/core/ddsi/src/q_receive.c
@@ -1649,23 +1649,26 @@ static int handle_InfoTS (const struct receiver_state *rst, const InfoTS_t *msg,
 static int handle_one_gap (struct proxy_writer *pwr, struct pwr_rd_match *wn, seqno_t a, seqno_t b, struct nn_rdata *gap, int *refc_adjust)
 {
   struct nn_rsample_chain sc;
-  nn_reorder_result_t res;
+  nn_reorder_result_t res = 0;
   int gap_was_valuable = 0;
   ASSERT_MUTEX_HELD (&pwr->e.lock);
 
   /* Clean up the defrag admin: no fragments of a missing sample will
      be arriving in the future */
   if (!(wn && wn->filtered))
-     nn_defrag_notegap (pwr->defrag, a, b);
-
-  /* Primary reorder: the gap message may cause some samples to become
-     deliverable. */
-  if ((res = nn_reorder_gap (&sc, pwr->reorder, gap, a, b, refc_adjust)) > 0)
   {
-    if (pwr->deliver_synchronously)
-      deliver_user_data_synchronously (&sc, NULL);
-    else
-      nn_dqueue_enqueue (pwr->dqueue, &sc, res);
+    nn_defrag_notegap (pwr->defrag, a, b);
+
+    /* Primary reorder: the gap message may cause some samples to become
+     deliverable. */
+
+    if ((res = nn_reorder_gap (&sc, pwr->reorder, gap, a, b, refc_adjust)) > 0)
+    {
+      if (pwr->deliver_synchronously)
+        deliver_user_data_synchronously (&sc, NULL);
+      else
+        nn_dqueue_enqueue (pwr->dqueue, &sc, res);
+    }
   }
 
   /* If the result was REJECT or TOO_OLD, then this gap didn't add