diff --git a/configure.ac b/configure.ac
index 0957d20..33e2341 100644
--- a/configure.ac
+++ b/configure.ac
@@ -2,7 +2,7 @@ AC_PREREQ(2.57)
 
 dnl This is the one location where the authoritative version number is stored
 AC_INIT(shellinabox, 2.6, markus@shellinabox.com)
-VCS_REVISION=113
+VCS_REVISION=114
 AC_SUBST(VCS_REVISION)
 AC_DEFINE_UNQUOTED(VCS_REVISION, "${VCS_REVISION}",
                    [Most recent revision number in the version control system])
diff --git a/libhttp/httpconnection.c b/libhttp/httpconnection.c
index 4ff5aa0..eeebd40 100644
--- a/libhttp/httpconnection.c
+++ b/libhttp/httpconnection.c
@@ -354,6 +354,7 @@ void destroyHttpConnection(struct HttpConnection *http) {
       if (http->callback && !http->done) {
         http->callback(http, http->arg, NULL, 0);
       }
+      http->callback       = NULL;
       http->isSuspended    = 0;
       http->isPartialReply = 0;
     }
diff --git a/libhttp/server.c b/libhttp/server.c
index 302fb85..aa08d86 100644
--- a/libhttp/server.c
+++ b/libhttp/server.c
@@ -383,17 +383,17 @@ void serverLoop(struct Server *server) {
         // the end of the list.
         check(--numFds > 0);
         struct pollfd tmpPollFd;
-        memcpy(&tmpPollFd, server->pollFds + numFds, sizeof(struct pollfd));
-        memcpy(server->pollFds + numFds, server->pollFds + i + 1,
-               sizeof(struct pollfd));
-        memcpy(server->pollFds + i + 1, &tmpPollFd, sizeof(struct pollfd));
+        memmove(&tmpPollFd, server->pollFds + numFds, sizeof(struct pollfd));
+        memmove(server->pollFds + numFds, server->pollFds + i + 1,
+                sizeof(struct pollfd));
+        memmove(server->pollFds + i + 1, &tmpPollFd, sizeof(struct pollfd));
         struct ServerConnection tmpConnection;
-        memcpy(&tmpConnection, server->connections + numFds - 1,
-               sizeof(struct ServerConnection));
-        memcpy(server->connections + numFds - 1, server->connections + i,
-               sizeof(struct ServerConnection));
-        memcpy(server->connections + i, &tmpConnection,
-               sizeof(struct ServerConnection));
+        memmove(&tmpConnection, server->connections + numFds - 1,
+                sizeof(struct ServerConnection));
+        memmove(server->connections + numFds - 1, server->connections + i,
+                sizeof(struct ServerConnection));
+        memmove(server->connections + i, &tmpConnection,
+                sizeof(struct ServerConnection));
       }
 
       if (server->connections[i].timeout &&
diff --git a/shellinabox/launcher.c b/shellinabox/launcher.c
index 7f57e79..73e41d5 100644
--- a/shellinabox/launcher.c
+++ b/shellinabox/launcher.c
@@ -1255,7 +1255,7 @@ static void launcherDaemon(int fd) {
       }
 
       // Send file handle and process id back to parent
-      char cmsg_buf[CMSG_SPACE(sizeof(int))];
+      char cmsg_buf[CMSG_SPACE(sizeof(int))] = { 0 };
       struct iovec  iov       = { 0 };
       struct msghdr msg       = { 0 };
       iov.iov_base            = &pid;
diff --git a/shellinabox/shellinaboxd.c b/shellinabox/shellinaboxd.c
index ea4a4b4..460976d 100644
--- a/shellinabox/shellinaboxd.c
+++ b/shellinabox/shellinaboxd.c
@@ -397,6 +397,7 @@ static int dataHandler(HttpConnection *http, struct Service *service,
     }
     free(keyCodes);
     httpSendReply(http, 200, "OK", " ");
+    check(session->http != http);
     return HTTP_DONE;
   } else {
     // This request is polling for data. Finish any pending requests and
@@ -412,7 +413,7 @@ static int dataHandler(HttpConnection *http, struct Service *service,
   session->connection     = serverGetConnection(session->server,
                                                 session->connection,
                                                 session->pty);
-  if (session->buffered) {
+  if (session->buffered || isNew) {
     if (completePendingRequest(session, "", 0, MAX_RESPONSE) &&
         session->connection) {
       // Reset the timeout, as we just received a new request.