diff --git a/main/sorcery.c b/main/sorcery.c
index 9f8c35c3b9..5d0b38ff54 100644
--- a/main/sorcery.c
+++ b/main/sorcery.c
@@ -1879,12 +1879,17 @@ static int sorcery_cache_create(void *obj, void *arg, int flags)
 
 void *ast_sorcery_retrieve_by_id(const struct ast_sorcery *sorcery, const char *type, const char *id)
 {
-	RAII_VAR(struct ast_sorcery_object_type *, object_type, ao2_find(sorcery->types, type, OBJ_KEY), ao2_cleanup);
+	struct ast_sorcery_object_type *object_type;
 	void *object = NULL;
 	int i;
 	unsigned int cached = 0;
 
-	if (!object_type || ast_strlen_zero(id)) {
+	if (ast_strlen_zero(id)) {
+		return NULL;
+	}
+
+	object_type = ao2_find(sorcery->types, type, OBJ_SEARCH_KEY);
+	if (!object_type) {
 		return NULL;
 	}
 
@@ -1912,6 +1917,7 @@ void *ast_sorcery_retrieve_by_id(const struct ast_sorcery *sorcery, const char *
 	}
 	AST_VECTOR_RW_UNLOCK(&object_type->wizards);
 
+	ao2_ref(object_type, -1);
 	return object;
 }
 
diff --git a/main/stun.c b/main/stun.c
index ecabdadef1..d9f8c8751a 100644
--- a/main/stun.c
+++ b/main/stun.c
@@ -413,6 +413,7 @@ int ast_stun_request(int s, struct sockaddr_in *dst,
 		/* send request, possibly wait for reply */
 		struct sockaddr_in src;
 		socklen_t srclen;
+		struct timeval start;
 
 		/* Send STUN message. */
 		res = stun_send(s, dst, req);
@@ -426,12 +427,20 @@ int ast_stun_request(int s, struct sockaddr_in *dst,
 			break;
 		}
 
+		start = ast_tvnow();
 try_again:
 		/* Wait for response. */
 		{
 			struct pollfd pfds = { .fd = s, .events = POLLIN };
+			int ms;
 
-			res = ast_poll(&pfds, 1, 3000);
+			ms = ast_remaining_ms(start, 3000);
+			if (ms <= 0) {
+				/* No response, timeout */
+				res = 1;
+				continue;
+			}
+			res = ast_poll(&pfds, 1, ms);
 			if (res < 0) {
 				/* Error */
 				continue;
diff --git a/res/res_pjsip/config_transport.c b/res/res_pjsip/config_transport.c
index 3c41f175aa..d180296f42 100644
--- a/res/res_pjsip/config_transport.c
+++ b/res/res_pjsip/config_transport.c
@@ -286,15 +286,16 @@ static struct internal_state *find_internal_state_by_transport(const struct ast_
 static struct ast_sip_transport_state *find_state_by_transport(const struct ast_sip_transport *transport)
 {
 	struct internal_state *state;
+	struct ast_sip_transport_state *trans_state;
 
 	state = find_internal_state_by_transport(transport);
 	if (!state) {
 		return NULL;
 	}
-	ao2_bump(state->state);
-	ao2_cleanup(state);
+	trans_state = ao2_bump(state->state);
+	ao2_ref(state, -1);
 
-	return state->state;
+	return trans_state;
 }
 
 static int remove_temporary_state(void)
@@ -1297,22 +1298,22 @@ static struct ast_sip_cli_formatter_entry *cli_formatter;
 
 struct ast_sip_transport_state *ast_sip_get_transport_state(const char *transport_id)
 {
-	struct internal_state * state = NULL;
+	struct internal_state *state = NULL;
+	struct ast_sip_transport_state *trans_state;
 
 	if (!transport_states) {
 		return NULL;
 	}
 
 	state = ao2_find(transport_states, transport_id, OBJ_SEARCH_KEY);
-	if (!state || !state->state) {
-		ao2_cleanup(state);
+	if (!state) {
 		return NULL;
 	}
 
-	ao2_ref(state->state, +1);
+	trans_state = ao2_bump(state->state);
 	ao2_ref(state, -1);
 
-	return state->state;
+	return trans_state;
 }
 
 static int populate_transport_states(void *obj, void *arg, int flags)