- handle recv with both TLS-handshake and Application data in same read - robust ref-counting; handle mem_deref() in send-handler and estab-handler