diff --git a/lib/client/client-handshake.c b/lib/client/client-handshake.c
index 79931145..d1b71cd7 100644
--- a/lib/client/client-handshake.c
+++ b/lib/client/client-handshake.c
@@ -245,7 +245,7 @@ lws_client_connect_2(struct lws *wsi)
 		lws_libuv_accept(wsi, wsi->desc);
 		lws_libevent_accept(wsi, wsi->desc);
 
-		if (insert_wsi_socket_into_fds(context, wsi)) {
+		if (__insert_wsi_socket_into_fds(context, wsi)) {
 			compatible_close(wsi->desc.sockfd);
 			cce = "insert wsi failed";
 			goto oom4;
@@ -502,7 +502,7 @@ lws_client_reset(struct lws **pwsi, int ssl, const char *address, int port,
 	compatible_close(wsi->desc.sockfd);
 #endif
 
-	remove_wsi_socket_from_fds(wsi);
+	__remove_wsi_socket_from_fds(wsi);
 
 #ifdef LWS_OPENSSL_SUPPORT
 	wsi->use_ssl = ssl;
diff --git a/lib/context.c b/lib/context.c
index 6bd4a8bd..11a0694d 100644
--- a/lib/context.c
+++ b/lib/context.c
@@ -952,7 +952,7 @@ lws_create_event_pipes(struct lws_context *context)
 		lws_libev_accept(wsi, wsi->desc);
 		lws_libevent_accept(wsi, wsi->desc);
 
-		if (insert_wsi_socket_into_fds(context, wsi))
+		if (__insert_wsi_socket_into_fds(context, wsi))
 			return 1;
 
 		lws_change_pollfd(context->pt[n].pipe_wsi, 0, LWS_POLLIN);
@@ -966,7 +966,7 @@ static void
 lws_destroy_event_pipe(struct lws *wsi)
 {
 	lws_plat_pipe_close(wsi);
-	remove_wsi_socket_from_fds(wsi);
+	__remove_wsi_socket_from_fds(wsi);
 	lws_libevent_destroy(wsi);
 	wsi->context->count_wsi_allocated--;
 	lws_free(wsi);
diff --git a/lib/event-libs/libuv.c b/lib/event-libs/libuv.c
index 47c3615e..788943ff 100644
--- a/lib/event-libs/libuv.c
+++ b/lib/event-libs/libuv.c
@@ -487,6 +487,7 @@ lws_libuv_closewsi(uv_handle_t* handle)
 	struct lws *n = NULL, *wsi = (struct lws *)(((char *)handle) -
 			  (char *)(&n->w_read.uv_watcher));
 	struct lws_context *context = lws_get_context(wsi);
+	struct lws_context_per_thread *pt = &context->pt[(int)wsi->tsi];
 	int lspd = 0;
 
 	if (wsi->mode == LWSCM_SERVER_LISTENER &&
@@ -497,7 +498,9 @@ lws_libuv_closewsi(uv_handle_t* handle)
 			lspd = 2;
 	}
 
-	lws_close_free_wsi_final(wsi);
+	lws_pt_lock(pt, __func__);
+	__lws_close_free_wsi_final(wsi);
+	lws_pt_unlock(pt);
 
 	if (lspd == 2 && context->deprecation_cb) {
 		lwsl_notice("calling deprecation callback\n");
diff --git a/lib/libwebsockets.c b/lib/libwebsockets.c
index 7e5d7a57..c5a0b546 100644
--- a/lib/libwebsockets.c
+++ b/lib/libwebsockets.c
@@ -59,14 +59,14 @@ static const char * const log_level_names[] = {
 #endif
 
 void
-lws_free_wsi(struct lws *wsi)
+__lws_free_wsi(struct lws *wsi)
 {
 	struct lws_context_per_thread *pt;
 	struct allocated_headers *ah;
 
 	if (!wsi)
 		return;
-	
+
 	pt = &wsi->context->pt[(int)wsi->tsi];
 
 	/*
@@ -85,12 +85,11 @@ lws_free_wsi(struct lws *wsi)
 	lwsl_info("ah det due to close\n");
 	/* we're closing, losing some rx is OK */
 	lws_header_table_force_to_detachable_state(wsi);
-	lws_header_table_detach(wsi, 0);
+	__lws_header_table_detach(wsi, 0);
 
 	if (wsi->vhost && wsi->vhost->lserv_wsi == wsi)
 		wsi->vhost->lserv_wsi = NULL;
 
-	lws_pt_lock(pt, __func__);
 	ah = pt->ah_list;
 	while (ah) {
 		if (ah->in_use && ah->wsi == wsi) {
@@ -124,8 +123,6 @@ lws_free_wsi(struct lws *wsi)
 #endif
 	__lws_remove_from_timeout_list(wsi);
 
-	lws_pt_unlock(pt);
-
 	lws_libevent_destroy(wsi);
 
 	wsi->context->count_wsi_allocated--;
@@ -189,17 +186,17 @@ __lws_add_to_timeout_list(struct lws *wsi)
 	*wsi->timeout_list_prev = wsi;
 }
 
-LWS_VISIBLE void
-lws_set_timer(struct lws *wsi, int secs)
+void
+__lws_set_timer(struct lws *wsi, int secs)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+//	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
 	time_t now;
 
 	if (secs < 0) {
 		wsi->timer_active = 0;
 
 		if (!lws_should_be_on_timeout_list(wsi))
-			lws_remove_from_timeout_list(wsi);
+			__lws_remove_from_timeout_list(wsi);
 
 		return;
 	}
@@ -211,14 +208,21 @@ lws_set_timer(struct lws *wsi, int secs)
 
 	if (!wsi->timer_active) {
 		wsi->timer_active = 1;
-		if (!wsi->pending_timeout) {
-			lws_pt_lock(pt, __func__);
+		if (!wsi->pending_timeout)
 			__lws_add_to_timeout_list(wsi);
-			lws_pt_unlock(pt);
-		}
 	}
 }
 
+LWS_VISIBLE void
+lws_set_timer(struct lws *wsi, int secs)
+{
+	//struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+
+//	lws_pt_lock(pt, __func__);
+	__lws_set_timer(wsi, secs);
+//	lws_pt_unlock(pt);
+}
+
 void
 __lws_set_timeout(struct lws *wsi, enum pending_timeout reason, int secs)
 {
@@ -377,7 +381,7 @@ lws_bind_protocol(struct lws *wsi, const struct lws_protocols *p)
 }
 
 void
-lws_close_free_wsi(struct lws *wsi, enum lws_close_status reason, const char *caller)
+__lws_close_free_wsi(struct lws *wsi, enum lws_close_status reason, const char *caller)
 {
 	struct lws_context_per_thread *pt;
 	struct lws *wsi1, *wsi2;
@@ -486,7 +490,7 @@ lws_close_free_wsi(struct lws *wsi, enum lws_close_status reason, const char *ca
 
 	if (wsi->mode == LWSCM_RAW_FILEDESC) {
 		lws_remove_child_from_any_parent(wsi);
-		remove_wsi_socket_from_fds(wsi);
+		__remove_wsi_socket_from_fds(wsi);
 		wsi->protocol->callback(wsi,
 					LWS_CALLBACK_RAW_CLOSE_FILE,
 					wsi->user_space, NULL, 0);
@@ -772,12 +776,12 @@ just_kill_connection:
 	 * we won't be servicing or receiving anything further from this guy
 	 * delete socket from the internal poll list if still present
 	 */
-	lws_ssl_remove_wsi_from_buffered_list(wsi);
-	lws_remove_from_timeout_list(wsi);
+	__lws_ssl_remove_wsi_from_buffered_list(wsi);
+	__lws_remove_from_timeout_list(wsi);
 
 	/* checking return redundant since we anyway close */
 	if (wsi->desc.sockfd != LWS_SOCK_INVALID)
-		remove_wsi_socket_from_fds(wsi);
+		__remove_wsi_socket_from_fds(wsi);
 	else
 		lws_same_vh_protocol_remove(wsi);
 
@@ -875,11 +879,11 @@ async_close:
 		}
 #endif
 
-	lws_close_free_wsi_final(wsi);
+	__lws_close_free_wsi_final(wsi);
 }
 
 void
-lws_close_free_wsi_final(struct lws *wsi)
+__lws_close_free_wsi_final(struct lws *wsi)
 {
 	int n;
 
@@ -916,7 +920,18 @@ lws_close_free_wsi_final(struct lws *wsi)
 	}
 #endif
 
-	lws_free_wsi(wsi);
+	__lws_free_wsi(wsi);
+}
+
+
+void
+lws_close_free_wsi(struct lws *wsi, enum lws_close_status reason, const char *caller)
+{
+	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+
+	lws_pt_lock(pt, __func__);
+	__lws_close_free_wsi(wsi, reason, caller);
+	lws_pt_unlock(pt);
 }
 
 LWS_VISIBLE LWS_EXTERN const char *
diff --git a/lib/plat/lws-plat-unix.c b/lib/plat/lws-plat-unix.c
index e5be9e8a..b2868cb4 100644
--- a/lib/plat/lws-plat-unix.c
+++ b/lib/plat/lws-plat-unix.c
@@ -217,6 +217,9 @@ _lws_plat_service_tsi(struct lws_context *context, int timeout_ms, int tsi)
 	 * list on the pt.  Drain the list and apply the changes to the
 	 * affected pollfds in the correct order.
 	 */
+
+	lws_pt_lock(pt, __func__);
+
 	ftp = vpt->foreign_pfd_list;
 	//lwsl_notice("cleared list %p\n", ftp);
 	while (ftp) {
@@ -228,7 +231,7 @@ _lws_plat_service_tsi(struct lws_context *context, int timeout_ms, int tsi)
 		if (lws_sockfd_valid(pfd->fd)) {
 			wsi = wsi_from_fd(context, pfd->fd);
 			if (wsi)
-				lws_change_pollfd(wsi, ftp->_and, ftp->_or);
+				__lws_change_pollfd(wsi, ftp->_and, ftp->_or);
 		}
 		lws_free((void *)ftp);
 		ftp = next;
@@ -236,6 +239,8 @@ _lws_plat_service_tsi(struct lws_context *context, int timeout_ms, int tsi)
 	vpt->foreign_pfd_list = NULL;
 	lws_memory_barrier();
 
+	lws_pt_unlock(pt);
+
 #ifdef LWS_OPENSSL_SUPPORT
 	if (!n && !pt->rx_draining_ext_list &&
 	    !lws_ssl_anybody_has_buffered_read_tsi(context, tsi)) {
diff --git a/lib/pollfd.c b/lib/pollfd.c
index f00c3002..e26c363d 100644
--- a/lib/pollfd.c
+++ b/lib/pollfd.c
@@ -220,7 +220,7 @@ lws_accept_modulation(struct lws_context_per_thread *pt, int allow)
 #endif
 
 int
-insert_wsi_socket_into_fds(struct lws_context *context, struct lws *wsi)
+__insert_wsi_socket_into_fds(struct lws_context *context, struct lws *wsi)
 {
 	struct lws_pollargs pa = { wsi->desc.sockfd, LWS_POLLIN, 0 };
 	struct lws_context_per_thread *pt = &context->pt[(int)wsi->tsi];
@@ -253,7 +253,6 @@ insert_wsi_socket_into_fds(struct lws_context *context, struct lws *wsi)
 					   wsi->user_space, (void *) &pa, 1))
 		return -1;
 
-	lws_pt_lock(pt, __func__);
 	pt->count_conns++;
 	insert_wsi(context, wsi);
 	wsi->position_in_fds_table = pt->fds_count;
@@ -278,7 +277,6 @@ insert_wsi_socket_into_fds(struct lws_context *context, struct lws *wsi)
 	if ((unsigned int)pt->fds_count == context->fd_limit_per_thread - 1)
 		lws_accept_modulation(pt, 0);
 #endif
-	lws_pt_unlock(pt);
 
 	if (wsi->vhost &&
 	    wsi->vhost->protocols[0].callback(wsi, LWS_CALLBACK_UNLOCK_POLL,
@@ -289,7 +287,7 @@ insert_wsi_socket_into_fds(struct lws_context *context, struct lws *wsi)
 }
 
 int
-remove_wsi_socket_from_fds(struct lws *wsi)
+__remove_wsi_socket_from_fds(struct lws *wsi)
 {
 	struct lws_context *context = wsi->context;
 	struct lws_pollargs pa = { wsi->desc.sockfd, 0, 0 };
@@ -326,8 +324,6 @@ remove_wsi_socket_from_fds(struct lws *wsi)
 	lws_libuv_io(wsi, LWS_EV_STOP | LWS_EV_READ | LWS_EV_WRITE |
 			  LWS_EV_PREPARE_DELETION);
 
-	lws_pt_lock(pt, __func__);
-
 	lwsl_debug("%s: wsi=%p, sock=%d, fds pos=%d, end guy pos=%d, endfd=%d\n",
 		  __func__, wsi, wsi->desc.sockfd, wsi->position_in_fds_table,
 		  pt->fds_count, pt->fds[pt->fds_count].fd);
@@ -363,7 +359,6 @@ remove_wsi_socket_from_fds(struct lws *wsi)
 	    (unsigned int)pt->fds_count < context->fd_limit_per_thread - 1)
 		lws_accept_modulation(pt, 1);
 #endif
-	lws_pt_unlock(pt);
 
 	if (wsi->vhost &&
 	    wsi->vhost->protocols[0].callback(wsi, LWS_CALLBACK_UNLOCK_POLL,
diff --git a/lib/private-libwebsockets.h b/lib/private-libwebsockets.h
index 72342c16..91bb790a 100644
--- a/lib/private-libwebsockets.h
+++ b/lib/private-libwebsockets.h
@@ -1191,7 +1191,7 @@ lws_check_deferred_free(struct lws_context *context, int force);
 #define lws_get_vh_protocol(vh, x) vh->protocols[x]
 
 LWS_EXTERN void
-lws_close_free_wsi_final(struct lws *wsi);
+__lws_close_free_wsi_final(struct lws *wsi);
 LWS_EXTERN void
 lws_libuv_closehandle(struct lws *wsi);
 LWS_EXTERN void
@@ -2035,12 +2035,14 @@ lws_get_addr_scope(const char *ipaddr);
 
 LWS_EXTERN void
 lws_close_free_wsi(struct lws *wsi, enum lws_close_status, const char *caller);
+LWS_EXTERN void
+__lws_close_free_wsi(struct lws *wsi, enum lws_close_status, const char *caller);
 
 LWS_EXTERN void
-lws_free_wsi(struct lws *wsi);
+__lws_free_wsi(struct lws *wsi);
 
 LWS_EXTERN int
-remove_wsi_socket_from_fds(struct lws *wsi);
+__remove_wsi_socket_from_fds(struct lws *wsi);
 LWS_EXTERN int
 lws_rxflow_cache(struct lws *wsi, unsigned char *buf, int n, int len);
 
@@ -2104,15 +2106,11 @@ delete_from_fd(struct lws_context *context, lws_sockfd_type fd);
 #endif
 
 LWS_EXTERN int LWS_WARN_UNUSED_RESULT
-insert_wsi_socket_into_fds(struct lws_context *context, struct lws *wsi);
+__insert_wsi_socket_into_fds(struct lws_context *context, struct lws *wsi);
 
 LWS_EXTERN int LWS_WARN_UNUSED_RESULT
 lws_issue_raw(struct lws *wsi, unsigned char *buf, size_t len);
 
-
-LWS_EXTERN int LWS_WARN_UNUSED_RESULT
-lws_service_timeout_check(struct lws *wsi, time_t sec);
-
 LWS_EXTERN void
 lws_remove_from_timeout_list(struct lws *wsi);
 
@@ -2255,6 +2253,8 @@ lws_header_table_attach(struct lws *wsi, int autoservice);
 
 LWS_EXTERN int
 lws_header_table_detach(struct lws *wsi, int autoservice);
+LWS_EXTERN int
+__lws_header_table_detach(struct lws *wsi, int autoservice);
 
 LWS_EXTERN void
 lws_header_table_reset(struct lws *wsi, int autoservice);
@@ -2322,6 +2322,7 @@ LWS_EXTERN void lwsl_emit_stderr(int level, const char *line);
 #define lws_ssl_context_destroy(_a)
 #define lws_ssl_SSL_CTX_destroy(_a)
 #define lws_ssl_remove_wsi_from_buffered_list(_a)
+#define __lws_ssl_remove_wsi_from_buffered_list(_a)
 #define lws_context_init_ssl_library(_a)
 #define lws_ssl_anybody_has_buffered_read_tsi(_a, _b) (0)
 #define lws_tls_check_all_cert_lifetimes(_a)
@@ -2353,6 +2354,8 @@ LWS_EXTERN void
 lws_ssl_SSL_CTX_destroy(struct lws_vhost *vhost);
 LWS_EXTERN void
 lws_ssl_context_destroy(struct lws_context *context);
+void
+__lws_ssl_remove_wsi_from_buffered_list(struct lws *wsi);
 LWS_VISIBLE void
 lws_ssl_remove_wsi_from_buffered_list(struct lws *wsi);
 LWS_EXTERN int
@@ -2772,8 +2775,6 @@ lws_peer_add_wsi(struct lws_context *context, struct lws_peer *peer,
 void
 __lws_remove_from_timeout_list(struct lws *wsi);
 void
-__lws_ssl_remove_wsi_from_buffered_list(struct lws *wsi);
-void
 __lws_set_timeout(struct lws *wsi, enum pending_timeout reason, int secs);
 int
 __lws_change_pollfd(struct lws *wsi, int _and, int _or);
diff --git a/lib/server/cgi.c b/lib/server/cgi.c
index 4ae67023..ee695847 100644
--- a/lib/server/cgi.c
+++ b/lib/server/cgi.c
@@ -164,7 +164,7 @@ lws_cgi(struct lws *wsi, const char * const *exec_array, int script_uri_path_len
 
 	for (n = 0; n < 3; n++) {
 		lws_libuv_accept(cgi->stdwsi[n], cgi->stdwsi[n]->desc);
-		if (insert_wsi_socket_into_fds(wsi->context, cgi->stdwsi[n]))
+		if (__insert_wsi_socket_into_fds(wsi->context, cgi->stdwsi[n]))
 			goto bail3;
 		cgi->stdwsi[n]->parent = wsi;
 		cgi->stdwsi[n]->sibling_list = wsi->child_list;
@@ -446,11 +446,11 @@ bail3:
 	pt->cgi_list = cgi->cgi_list;
 
 	while (--n >= 0)
-		remove_wsi_socket_from_fds(wsi->cgi->stdwsi[n]);
+		__remove_wsi_socket_from_fds(wsi->cgi->stdwsi[n]);
 bail2:
 	for (n = 0; n < 3; n++)
 		if (wsi->cgi->stdwsi[n])
-			lws_free_wsi(cgi->stdwsi[n]);
+			__lws_free_wsi(cgi->stdwsi[n]);
 
 bail1:
 	for (n = 0; n < 3; n++) {
diff --git a/lib/server/parsers.c b/lib/server/parsers.c
index d63cf159..87293144 100644
--- a/lib/server/parsers.c
+++ b/lib/server/parsers.c
@@ -339,7 +339,7 @@ lws_header_table_is_in_detachable_state(struct lws *wsi)
 	return ah && ah->rxpos == ah->rxlen && wsi->hdr_parsing_completed;
 }
 
-int lws_header_table_detach(struct lws *wsi, int autoservice)
+int __lws_header_table_detach(struct lws *wsi, int autoservice)
 {
 	struct lws_context *context = wsi->context;
 	struct allocated_headers *ah = wsi->ah;
@@ -348,9 +348,7 @@ int lws_header_table_detach(struct lws *wsi, int autoservice)
 	struct lws **pwsi, **pwsi_eligible;
 	time_t now;
 
-	lws_pt_lock(pt, __func__);
 	__lws_remove_from_ah_waiting_list(wsi);
-	lws_pt_unlock(pt);
 
 	if (!ah)
 		return 0;
@@ -372,8 +370,6 @@ int lws_header_table_detach(struct lws *wsi, int autoservice)
 		return 0;
 	}
 
-	lws_pt_lock(pt, __func__);
-
 	/* we did have an ah attached */
 	time(&now);
 	if (ah->assigned && now - ah->assigned > 3) {
@@ -485,8 +481,6 @@ bail:
 	lwsl_info("%s: wsi %p: ah %p (tsi=%d, count = %d)\n", __func__,
 		  (void *)wsi, (void *)ah, pt->tid, pt->ah_count_in_use);
 
-	lws_pt_unlock(pt);
-
 	return 0;
 
 nobody_usable_waiting:
@@ -497,6 +491,19 @@ nobody_usable_waiting:
 	goto bail;
 }
 
+int lws_header_table_detach(struct lws *wsi, int autoservice)
+{
+	struct lws_context *context = wsi->context;
+	struct lws_context_per_thread *pt = &context->pt[(int)wsi->tsi];
+	int n;
+
+	lws_pt_lock(pt, __func__);
+	n = __lws_header_table_detach(wsi, autoservice);
+	lws_pt_unlock(pt);
+
+	return n;
+}
+
 LWS_VISIBLE int
 lws_hdr_fragment_length(struct lws *wsi, enum lws_token_indexes h, int frag_idx)
 {
diff --git a/lib/server/server.c b/lib/server/server.c
index af937874..910b0db4 100644
--- a/lib/server/server.c
+++ b/lib/server/server.c
@@ -177,7 +177,7 @@ lws_context_init_server(struct lws_context_creation_info *info,
 		lws_uv_initvhost(vhost, wsi);
 #endif
 
-	if (insert_wsi_socket_into_fds(vhost->context, wsi))
+	if (__insert_wsi_socket_into_fds(vhost->context, wsi))
 		goto bail;
 
 	vhost->context->count_wsi_allocated++;
@@ -189,7 +189,7 @@ lws_context_init_server(struct lws_context_creation_info *info,
 		lwsl_err("listen failed with error %d\n", LWS_ERRNO);
 		vhost->lserv_wsi = NULL;
 		vhost->context->count_wsi_allocated--;
-		remove_wsi_socket_from_fds(wsi);
+		__remove_wsi_socket_from_fds(wsi);
 		goto bail;
 	}
 	} /* for each thread able to independently listen */
@@ -402,7 +402,7 @@ lws_http_serve(struct lws *wsi, char *uri, const char *origin,
 		wsi->http.fop_fd = fops->LWS_FOP_OPEN(wsi->context->fops,
 							path, vpath, &fflags);
 		if (!wsi->http.fop_fd) {
-			lwsl_err("Unable to open '%s'\n", path);
+			lwsl_err("Unable to open '%s': errno %d\n", path, errno);
 
 			return -1;
 		}
@@ -2096,10 +2096,13 @@ lws_adopt_descriptor_vhost(struct lws_vhost *vh, lws_adoption_type type,
 	lws_libevent_accept(new_wsi, new_wsi->desc);
 
 	if (!ssl) {
-		if (insert_wsi_socket_into_fds(context, new_wsi)) {
+		lws_pt_lock(pt, __func__);
+		if (__insert_wsi_socket_into_fds(context, new_wsi)) {
+			lws_pt_unlock(pt);
 			lwsl_err("%s: fail inserting socket\n", __func__);
 			goto fail;
 		}
+		lws_pt_unlock(pt);
 	} else
 		if (lws_server_socket_service_ssl(new_wsi, fd.sockfd)) {
 			lwsl_info("%s: fail ssl negotiation\n", __func__);
@@ -2340,6 +2343,7 @@ lws_server_socket_service(struct lws_context *context, struct lws *wsi,
 					ah->rxlen = lws_ssl_capable_read(wsi, ah->rx,
 						   sizeof(ah->rx));
 				}
+
 				ah->rxpos = 0;
 				switch (ah->rxlen) {
 				case 0:
@@ -2347,8 +2351,9 @@ lws_server_socket_service(struct lws_context *context, struct lws *wsi,
 						   __func__);
 					wsi->seen_zero_length_recv = 1;
 					lws_change_pollfd(wsi, LWS_POLLIN, 0);
-					goto try_pollout;
-					/* fallthru */
+					// goto try_pollout;
+					goto fail;
+
 				case LWS_SSL_CAPABLE_ERROR:
 					goto fail;
 				case LWS_SSL_CAPABLE_MORE_SERVICE:
@@ -2742,7 +2747,7 @@ lws_serve_http_file(struct lws *wsi, const char *file, const char *content_type,
 		wsi->http.fop_fd = fops->LWS_FOP_OPEN(wsi->context->fops,
 							file, vpath, &fflags);
 		if (!wsi->http.fop_fd) {
-			lwsl_err("Unable to open '%s'\n", file);
+			lwsl_err("Unable to open '%s': errno %d\n", file, errno);
 
 			return -1;
 		}
diff --git a/lib/server/ssl-server.c b/lib/server/ssl-server.c
index 30e4a173..0a83941e 100644
--- a/lib/server/ssl-server.c
+++ b/lib/server/ssl-server.c
@@ -161,10 +161,12 @@ lws_server_socket_service_ssl(struct lws *wsi, lws_sockfd_type accept_fd)
 		else
 			wsi->mode = LWSCM_SSL_ACK_PENDING_RAW;
 
-		if (insert_wsi_socket_into_fds(context, wsi)) {
+		lws_pt_lock(pt, __func__);
+		if (__insert_wsi_socket_into_fds(context, wsi)) {
 			lwsl_err("%s: failed to insert into fds\n", __func__);
 			goto fail;
 		}
+		lws_pt_unlock(pt);
 
 		lws_set_timeout(wsi, PENDING_TIMEOUT_SSL_ACCEPT,
 				context->timeout_secs);
diff --git a/lib/service.c b/lib/service.c
index dfead549..b01396f6 100644
--- a/lib/service.c
+++ b/lib/service.c
@@ -611,8 +611,8 @@ bail_die:
 	return -1;
 }
 
-int
-lws_service_timeout_check(struct lws *wsi, time_t sec)
+static int
+__lws_service_timeout_check(struct lws *wsi, time_t sec)
 {
 	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
 	int n = 0;
@@ -638,13 +638,14 @@ lws_service_timeout_check(struct lws *wsi, time_t sec)
 		if (wsi->protocol &&
 		    wsi->protocol->callback(wsi, LWS_CALLBACK_TIMER,
 					    wsi->user_space, NULL, 0)) {
-			lws_close_free_wsi(wsi, LWS_CLOSE_STATUS_NOSTATUS, "timer cb errored");
+			lws_close_free_wsi(wsi, LWS_CLOSE_STATUS_NOSTATUS,
+					   "timer cb errored");
 
 					return 1;
 		}
 
 		if (!lws_should_be_on_timeout_list(wsi)) {
-			lws_remove_from_timeout_list(wsi);
+			__lws_remove_from_timeout_list(wsi);
 
 			return 0;
 		}
@@ -656,7 +657,7 @@ lws_service_timeout_check(struct lws *wsi, time_t sec)
 	 */
 	if (wsi->pending_timeout &&
 	    lws_compare_time_t(wsi->context, sec, wsi->pending_timeout_set) >
-	    wsi->pending_timeout_limit) {
+			       wsi->pending_timeout_limit) {
 
 		if (wsi->desc.sockfd != LWS_SOCK_INVALID &&
 		    wsi->position_in_fds_table >= 0)
@@ -693,7 +694,7 @@ lws_service_timeout_check(struct lws *wsi, time_t sec)
 				wsi->user_space,
 				(void *)"Timed out waiting SSL", 21);
 
-		lws_close_free_wsi(wsi, LWS_CLOSE_STATUS_NOSTATUS, "timeout");
+		__lws_close_free_wsi(wsi, LWS_CLOSE_STATUS_NOSTATUS, "timeout");
 
 		return 1;
 	}
@@ -850,7 +851,7 @@ lws_service_flag_pending(struct lws_context *context, int tsi)
 			 * at the end of the service, he'll get put back on the
 			 * list then.
 			 */
-			lws_ssl_remove_wsi_from_buffered_list(wsi);
+			__lws_ssl_remove_wsi_from_buffered_list(wsi);
 		}
 
 		wsi = wsi_next;
@@ -1133,12 +1134,13 @@ lws_service_fd_tsi(struct lws_context *context, struct lws_pollfd *pollfd,
 		 * Phase 1: check every wsi on the timeout check list
 		 */
 
+		lws_pt_lock(pt, __func__);
 		wsi = context->pt[tsi].timeout_list;
 		while (wsi) {
 			/* we have to take copies, because he may be deleted */
 			wsi1 = wsi->timeout_list;
 			tmp_fd = wsi->desc.sockfd;
-			if (lws_service_timeout_check(wsi, now)) {
+			if (__lws_service_timeout_check(wsi, now)) {
 				/* he did time out... */
 				if (tmp_fd == our_fd)
 					/* it was the guy we came to service! */
@@ -1221,11 +1223,13 @@ lws_service_fd_tsi(struct lws_context *context, struct lws_pollfd *pollfd,
 				/* it was the guy we came to service! */
 				timed_out = 1;
 
-			lws_close_free_wsi(wsi, LWS_CLOSE_STATUS_NOSTATUS, "excessive ah");
+			__lws_close_free_wsi(wsi, LWS_CLOSE_STATUS_NOSTATUS, "excessive ah");
 
 			ah = pt->ah_list;
 		}
 
+		lws_pt_unlock(pt);
+
 #ifdef LWS_WITH_CGI
 		/*
 		 * Phase 3: handle cgi timeouts
@@ -1430,6 +1434,7 @@ lws_service_fd_tsi(struct lws_context *context, struct lws_pollfd *pollfd,
 	case LWSCM_SERVER_LISTENER:
 	case LWSCM_SSL_ACK_PENDING:
 	case LWSCM_SSL_ACK_PENDING_RAW:
+
 		if (wsi->state == LWSS_CLIENT_HTTP_ESTABLISHED)
 			goto handled;
 
@@ -1668,7 +1673,7 @@ read:
 					eff_buf.token_len);
 				switch (eff_buf.token_len) {
 				case 0:
-					lwsl_info("%s: zero length read\n",
+					lwsl_notice("%s: zero length read\n",
 						  __func__);
 					goto close_and_handled;
 				case LWS_SSL_CAPABLE_MORE_SERVICE:
diff --git a/test-apps/test-server-pthreads.c b/test-apps/test-server-pthreads.c
index 1e559dce..df5453a4 100644
--- a/test-apps/test-server-pthreads.c
+++ b/test-apps/test-server-pthreads.c
@@ -345,6 +345,7 @@ int main(int argc, char **argv)
 	info.count_threads = threads;
 	info.extensions = exts;
 	info.max_http_header_pool = 4;
+	info.pt_serv_buf_size = 128 * 1024;
 
 	/* when doing slow benchmarks with thousands of concurrent
 	 * connections, we need wait longer