--- a/src/auth/auth-client-connection.c	Wed Aug 18 08:13:47 2004 +0300
+++ b/src/auth/auth-client-connection.c	Thu Aug 19 02:42:31 2004 +0300
@@ -31,7 +31,7 @@
 	iov[0].iov_base = reply;
 	iov[0].iov_len = sizeof(*reply);
 	iov[1].iov_base = data;
-	iov[2].iov_len = reply->data_size;
+	iov[1].iov_len = reply->data_size;
 
 	ret = o_stream_sendv(conn->output, iov, 2);
 	if (ret == (ssize_t)(iov[0].iov_len + iov[1].iov_len)) {
@@ -215,7 +215,7 @@
 	iov[0].iov_base = &handshake_reply;
 	iov[0].iov_len = sizeof(handshake_reply);
 	iov[1].iov_base = master->handshake_reply + 1;
-	iov[2].iov_len = handshake_reply.data_size;
+	iov[1].iov_len = handshake_reply.data_size;
 
 	if (o_stream_sendv(conn->output, iov, 2) < 0) {
 		auth_client_connection_destroy(conn);

--- a/src/auth/mech.c	Wed Aug 18 08:13:47 2004 +0300
+++ b/src/auth/mech.c	Thu Aug 19 02:42:31 2004 +0300
@@ -226,6 +226,7 @@
 {
 	struct auth_client_request_reply reply;
 	void *reply_data;
+	int free_request;
 
 	if (!success) {
 		/* failure. don't announce it immediately to avoid
@@ -239,10 +240,13 @@
 	reply.id = auth_request->id;
 	reply.result = AUTH_CLIENT_RESULT_SUCCESS;
 
+	/* get this before callback because it can destroy connection */
+	free_request = AUTH_MASTER_IS_DUMMY(auth_request->conn->master);
+
 	reply_data = mech_auth_success(&reply, auth_request, data, data_size);
 	auth_request->callback(&reply, reply_data, auth_request->conn);
 
-	if (AUTH_MASTER_IS_DUMMY(auth_request->conn->master)) {
+	if (free_request) {
 		/* we don't have master process, the request is no longer
 		   needed */
 		mech_request_free(auth_request, auth_request->id);