diff --git a/lib/core-net/close.c b/lib/core-net/close.c
index 494c967f8..9c0ec1f6b 100644
--- a/lib/core-net/close.c
+++ b/lib/core-net/close.c
@@ -248,7 +248,7 @@ __lws_free_wsi(struct lws *wsi)
 			wsi->a.context->pt[(int)wsi->tsi].fds_count);
 
 	/* confirm no sul left scheduled in wsi itself */
-	lws_sul_debug_zombies(wsi->a.context, wsi, sizeof(wsi), __func__);
+	lws_sul_debug_zombies(wsi->a.context, wsi, sizeof(*wsi), __func__);
 
 	__lws_lc_untag(&wsi->lc);
 	lws_free(wsi);
diff --git a/lib/core-net/sorted-usec-list.c b/lib/core-net/sorted-usec-list.c
index 16ff617f1..fbceba876 100644
--- a/lib/core-net/sorted-usec-list.c
+++ b/lib/core-net/sorted-usec-list.c
@@ -81,6 +81,8 @@ lws_sul2_schedule(struct lws_context *context, int tsi, int flags,
 
 	lws_pt_assert_lock_held(pt);
 
+	assert(sul->cb);
+
 	__lws_sul_insert(
 		&pt->pt_sul_owner[!!(flags & LWSSULLI_WAKE_IF_SUSPENDED)], sul);
 }
@@ -272,6 +274,8 @@ lws_sul_schedule(struct lws_context *ctx, int tsi, lws_sorted_usec_list_t *sul,
 {
 	struct lws_context_per_thread *_pt = &ctx->pt[tsi];
 
+	assert(_cb);
+
 	lws_pt_lock(_pt, __func__);
 
 	if (_us == (lws_usec_t)LWS_SET_TIMER_USEC_CANCEL)
@@ -292,6 +296,8 @@ lws_sul_schedule_wakesuspend(struct lws_context *ctx, int tsi,
 {
 	struct lws_context_per_thread *_pt = &ctx->pt[tsi];
 
+	assert(_cb);
+
 	lws_pt_lock(_pt, __func__);
 
 	if (_us == (lws_usec_t)LWS_SET_TIMER_USEC_CANCEL)
@@ -334,12 +340,19 @@ lws_sul_debug_zombies(struct lws_context *ctx, void *po, size_t len,
 					lws_container_of(p,
 						lws_sorted_usec_list_t, list);
 
+				if (!po) {
+					lwsl_err("%s: %s\n", __func__, destroy_description);
+					/* just sanity check the list */
+					assert(sul->cb);
+				}
+
 				/*
 				 * Is the sul resident inside the object that is
 				 * indicated as being deleted?
 				 */
 
-				if ((void *)sul >= po &&
+				if (po &&
+				    (void *)sul >= po &&
 				    (size_t)lws_ptr_diff(sul, po) < len) {
 					lwsl_err("%s: ERROR: Zombie Sul "
 						 "(on list %d) %s, cb %p\n",
diff --git a/lib/secure-streams/secure-streams-client.c b/lib/secure-streams/secure-streams-client.c
index 602813bb9..3e5abaa70 100644
--- a/lib/secure-streams/secure-streams-client.c
+++ b/lib/secure-streams/secure-streams-client.c
@@ -717,6 +717,11 @@ lws_sspc_destroy(lws_sspc_handle_t **ph)
 	lws_sul_cancel(&h->sul_retry);
 
 	__lws_lc_untag(&h->lc);
+
+	/* confirm no sul left scheduled in handle or user allocation object */
+	lws_sul_debug_zombies(h->context, h, sizeof(*h) + h->ssi.user_alloc,
+			      __func__);
+
 	free(h);
 }