diff --git a/lib/core-net/service.c b/lib/core-net/service.c
index ac5c661bd..f4014a733 100644
--- a/lib/core-net/service.c
+++ b/lib/core-net/service.c
@@ -272,14 +272,16 @@ __lws_service_timeout_check(struct lws *wsi, time_t sec)
 			  wsi->pending_timeout);
 #endif
 
-		/*
-		 * Since he failed a timeout, he already had a chance to do
-		 * something and was unable to... that includes situations like
-		 * half closed connections.  So process this "failed timeout"
-		 * close as a violent death and don't try to do protocol
-		 * cleanup like flush partials.
-		 */
-		wsi->socket_is_permanently_unusable = 1;
+		/* cgi timeout */
+		if (wsi->pending_timeout != PENDING_TIMEOUT_HTTP_KEEPALIVE_IDLE)
+			/*
+			 * Since he failed a timeout, he already had a chance to
+			 * do something and was unable to... that includes
+			 * situations like half closed connections.  So process
+			 * this "failed timeout" close as a violent death and
+			 * don't try to do protocol cleanup like flush partials.
+			 */
+			wsi->socket_is_permanently_unusable = 1;
 		if (lwsi_state(wsi) == LRS_WAITING_SSL && wsi->protocol)
 			wsi->protocol->callback(wsi,
 				LWS_CALLBACK_CLIENT_CONNECTION_ERROR,
diff --git a/lib/roles/cgi/cgi-server.c b/lib/roles/cgi/cgi-server.c
index 684c74f42..e2d0437e8 100644
--- a/lib/roles/cgi/cgi-server.c
+++ b/lib/roles/cgi/cgi-server.c
@@ -952,6 +952,8 @@ agin:
 			if (wsi->http2_substream)
 				m = lws_write(wsi, (unsigned char *)start, 0,
 					      LWS_WRITE_HTTP_FINAL);
+			else
+				return -1;
 			return 1;
 		}
 		wsi->cgi_stdout_zero_length = 1;