diff --git a/daemon/call.c b/daemon/call.c
index 1477c65da..deb90e19d 100644
--- a/daemon/call.c
+++ b/daemon/call.c
@@ -133,7 +133,6 @@ static void call_timer_iterator(struct call *c, struct iterator_helper *hlp) {
 	unsigned int check;
 	bool good = false;
 	struct packet_stream *ps;
-	struct stream_fd *sfd;
 	int tmp_t_reason = UNKNOWN;
 	struct call_monologue *ml;
 	enum call_stream_state css;
@@ -187,8 +186,16 @@ static void call_timer_iterator(struct call *c, struct iterator_helper *hlp) {
 		timestamp = &ps->last_packet;
 
 		if (!ps->media)
-			goto next;
-		sfd = ps->selected_sfd;
+			continue;
+
+		AUTO_CLEANUP(struct stream_fd *sfd, stream_fd_auto_cleanup) = NULL;
+
+		{
+			LOCK(&ps->in_lock);
+			if (ps->selected_sfd)
+				sfd = obj_get(ps->selected_sfd);
+		}
+
 		if (!sfd)
 			goto no_sfd;
 
diff --git a/daemon/ice.c b/daemon/ice.c
index cfee3a24c..13892505f 100644
--- a/daemon/ice.c
+++ b/daemon/ice.c
@@ -1258,6 +1258,7 @@ static int __check_valid(struct ice_agent *ag) {
 					FMT_M(endpoint_print_buf(&pair->remote_candidate->endpoint)));
 		mutex_unlock(&ps->out_lock);
 
+		LOCK(&ps->in_lock);
 		for (m = ps->sfds.head; m; m = m->next) {
 			sfd = m->data;
 			if (sfd->local_intf != pair->local_intf)
diff --git a/daemon/media_player.c b/daemon/media_player.c
index 92c574a9f..8799e6db4 100644
--- a/daemon/media_player.c
+++ b/daemon/media_player.c
@@ -214,6 +214,7 @@ struct send_timer *send_timer_new(struct packet_stream *ps) {
 }
 
 // call is locked in R
+// ssrc_out is locked
 static void send_timer_rtcp(struct send_timer *st, struct ssrc_ctx *ssrc_out) {
 	struct call_media *media = st->sink ? st->sink->media : NULL;
 	if (!media)
@@ -290,25 +291,32 @@ static void __send_timer_send_common(struct send_timer *st, struct codec_packet
 		payload_tracker_add(&cp->ssrc_out->tracker, cp->rtp->m_pt & 0x7f);
 	}
 
-	// do we send RTCP?
-	struct ssrc_ctx *ssrc_out = cp->ssrc_out;
-	if (ssrc_out && ssrc_out->next_rtcp.tv_sec) {
-		mutex_lock(&ssrc_out->parent->h.lock);
-		long long diff = timeval_diff(&ssrc_out->next_rtcp, &rtpe_now);
-		mutex_unlock(&ssrc_out->parent->h.lock);
-		if (diff < 0)
-			send_timer_rtcp(st, ssrc_out);
-	}
-
 out:
 	codec_packet_free(cp);
 }
 
+static void __send_timer_rtcp(struct send_timer *st, struct ssrc_ctx *ssrc_out) {
+	// do we send RTCP?
+	if (!ssrc_out)
+		return;
+	if (!ssrc_out->next_rtcp.tv_sec)
+		return;
+
+	LOCK(&ssrc_out->parent->h.lock);
+	long long diff = timeval_diff(&ssrc_out->next_rtcp, &rtpe_now);
+	if (diff < 0)
+		send_timer_rtcp(st, ssrc_out);
+}
+
 static void send_timer_send_lock(struct send_timer *st, struct codec_packet *cp) {
 	struct call *call = st->call;
 	if (!call)
 		return;
 
+	struct ssrc_ctx *ssrc_out = cp->ssrc_out;
+	if (ssrc_out)
+		ssrc_ctx_hold(ssrc_out);
+
 	log_info_call(call);
 	rwlock_lock_r(&call->master_lock);
 	mutex_lock(&st->sink->out_lock);
@@ -316,6 +324,10 @@ static void send_timer_send_lock(struct send_timer *st, struct codec_packet *cp)
 	__send_timer_send_common(st, cp);
 
 	mutex_unlock(&st->sink->out_lock);
+
+	__send_timer_rtcp(st, ssrc_out);
+	ssrc_ctx_put(&ssrc_out);
+
 	rwlock_unlock_r(&call->master_lock);
 	log_info_pop();
 
diff --git a/daemon/media_socket.c b/daemon/media_socket.c
index 7a8cf43a8..a99eeff79 100644
--- a/daemon/media_socket.c
+++ b/daemon/media_socket.c
@@ -3056,9 +3056,11 @@ next_mirror:
 
 err_next:
 		ilog(LOG_DEBUG | LOG_FLAG_LIMIT ,"Error when sending message. Error: %s", strerror(errno));
+		mutex_lock(&sink->in_lock);
 		atomic64_inc(&sink->stats_in.errors);
 		if (sink->selected_sfd)
 			atomic64_inc(&sink->selected_sfd->local_intf->stats.out.errors);
+		mutex_unlock(&sink->in_lock);
 		RTPE_STATS_INC(errors_user);
 		goto next;
 
diff --git a/daemon/rtcp.c b/daemon/rtcp.c
index 463ef91e2..4f9f33bb4 100644
--- a/daemon/rtcp.c
+++ b/daemon/rtcp.c
@@ -1557,6 +1557,7 @@ void rtcp_receiver_reports(GQueue *out, struct ssrc_hash *hash, struct call_mono
 
 
 // call must be locked in R
+// no in_lock or out_lock must be held
 void rtcp_send_report(struct call_media *media, struct ssrc_ctx *ssrc_out) {
 	// figure out where to send it
 	struct packet_stream *ps = media->streams.head->data;
@@ -1572,13 +1573,15 @@ void rtcp_send_report(struct call_media *media, struct ssrc_ctx *ssrc_out) {
 			rtcp_ps = ps;
 	}
 
+	media_update_stats(media);
+
+	LOCK(&ps->in_lock);
+
 	if (!ps->selected_sfd || !rtcp_ps->selected_sfd)
 		return;
 	if (ps->selected_sfd->socket.fd == -1 || ps->endpoint.address.family == NULL)
 		return;
 
-	media_update_stats(media);
-
 	log_info_stream_fd(ps->selected_sfd);
 
 	GQueue rrs = G_QUEUE_INIT;
@@ -1601,6 +1604,8 @@ void rtcp_send_report(struct call_media *media, struct ssrc_ctx *ssrc_out) {
 
 	str rtcp_packet = STR_INIT_LEN(sr->str, sr->len);
 
+	LOCK(&ps->out_lock);
+
 	const struct streamhandler *crypt_handler = determine_handler(&transport_protocols[PROTO_RTP_AVP],
 			media, true);
 
diff --git a/daemon/ssrc.c b/daemon/ssrc.c
index 883bc2eed..797e2c6d5 100644
--- a/daemon/ssrc.c
+++ b/daemon/ssrc.c
@@ -627,6 +627,7 @@ void ssrc_collect_metrics(struct call_media *media) {
 				e->jitter = e->jitter * 1000 / rpt->clock_rate;
 		}
 
+		LOCK(&ps->in_lock);
 		RTPE_SAMPLE_SFD(jitter_measured, e->jitter, ps->selected_sfd);
 	}
 }
diff --git a/daemon/t38.c b/daemon/t38.c
index 9c4a759a7..a884f2f56 100644
--- a/daemon/t38.c
+++ b/daemon/t38.c
@@ -218,11 +218,12 @@ static int t38_gateway_handler(t38_core_state_t *stat, void *user_data, const ui
 	struct packet_stream *ps = NULL;
 	if (tg->t38_media && tg->t38_media->streams.head)
 		ps = tg->t38_media->streams.head->data;
-	if (ps)
-		mutex_lock(&ps->out_lock);
 	struct stream_fd *sfd = NULL;
-	if (ps)
+	if (ps) {
+		mutex_lock(&ps->in_lock);
+		mutex_lock(&ps->out_lock);
 		sfd = ps->selected_sfd;
+	}
 	if (sfd && sfd->socket.fd != -1 && ps->endpoint.address.family != NULL) {
 		for (int i = 0; i < count; i++) {
 			ilog(LOG_DEBUG, "Sending %u UDPTL bytes", (unsigned int) s->len);
@@ -232,8 +233,10 @@ static int t38_gateway_handler(t38_core_state_t *stat, void *user_data, const ui
 	else
 		ilog(LOG_WARN | LOG_FLAG_LIMIT, "Unable to send T.38 UDPTL packet due to lack of "
 				"socket or stream");
-	if (ps)
+	if (ps) {
 		mutex_unlock(&ps->out_lock);
+		mutex_unlock(&ps->in_lock);
+	}
 
 	g_string_free(s, TRUE);
 
diff --git a/include/call.h b/include/call.h
index e2c966dd8..773beae26 100644
--- a/include/call.h
+++ b/include/call.h
@@ -381,7 +381,7 @@ struct packet_stream {
 	struct recording_stream recording;	/* LOCK: call->master_lock */
 
 	GQueue			sfds;		/* LOCK: call->master_lock */
-	struct stream_fd *	selected_sfd;
+	struct stream_fd *	selected_sfd;	// LOCK: in_lock
 	endpoint_t		last_local_endpoint;
 	struct dtls_connection	ice_dtls;	/* LOCK: in_lock */
 	GQueue			rtp_sinks;	/* LOCK: call->master_lock, in_lock for streamhandler */
diff --git a/t/auto-daemon-tests.pl b/t/auto-daemon-tests.pl
index 753025b74..07b49e84b 100755
--- a/t/auto-daemon-tests.pl
+++ b/t/auto-daemon-tests.pl
@@ -12117,10 +12117,11 @@ $resp = rtpe_req('play media', 'media player', { 'from-tag' => ft(), blob => $wa
 is $resp->{duration}, 100, 'media duration';
 
 ($seq, $ts, $ssrc) = rcv($sock_a, $port_b, rtpm(8 | 0x80, -1, -1, -1, $pcma_1));
+rcv($sock_a, $port_b, rtpm(8, $seq + 1, $ts + 160, $ssrc, $pcma_2));
 #                                         SR  LEN    SSRC  NTP1  NTP2  RTP      PACKETS         OCTETS           SSRC           LOST            SEQ            JITTER           LAST SR       DLSR           CNAME
-@ret1 = rcv($sock_ax, $port_bx, qr/^\x81\xc8\x00\x0c(.{4})(.{4})(.{4})(.{4})\x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x12\x34\x00\x00\x00\x00\x00\x00\x03\xe8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x81\xca\x00\x05(.{4})\x01\x0c([0-9a-f]{12})\x00\x00$/s);
+@ret1 = rcv($sock_ax, $port_bx, qr/^\x81\xc8\x00\x0c(.{4})(.{4})(.{4})(.{4})\x00\x00\x00\x02\x00\x00\x01\x58\x00\x00\x12\x34\x00\x00\x00\x00\x00\x00\x03\xe8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x81\xca\x00\x05(.{4})\x01\x0c([0-9a-f]{12})\x00\x00$/s);
 is $ret1[0], $ssrc, 'SSRC matches';
-is $ret1[3], $ts, 'TS matches';
+is $ret1[3], $ts + 160, 'TS matches';
 is $ret1[4], $ssrc, 'SSRC matches';
 
 rtpe_req('delete', "delete", { 'from-tag' => ft() });
@@ -12192,10 +12193,11 @@ $resp = rtpe_req('play media', 'media player', { 'from-tag' => ft(), blob => $wa
 is $resp->{duration}, 100, 'media duration';
 
 ($seq, $ts, $ssrc) = rcv($sock_a, $port_b, rtpm(8 | 0x80, -1, -1, -1, $pcma_1));
+rcv($sock_a, $port_b, rtpm(8, $seq + 1, $ts + 160, $ssrc, $pcma_2));
 #                                         SR  LEN    SSRC  NTP1  NTP2  RTP      PACKETS         OCTETS           SSRC           LOST            SEQ            JITTER           LAST SR     DLSR     CNAME
-@ret1 = rcv($sock_ax, $port_bx, qr/^\x81\xc8\x00\x0c(.{4})(.{4})(.{4})(.{4})\x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x12\x34\x00\x00\x00\x00\x00\x00\x03\xe8\x00\x00\x00\x00\x56\x78\x9a\xbc(.{4})\x81\xca\x00\x05(.{4})\x01\x0c([0-9a-f]{12})\x00\x00$/s);
+@ret1 = rcv($sock_ax, $port_bx, qr/^\x81\xc8\x00\x0c(.{4})(.{4})(.{4})(.{4})\x00\x00\x00\x02\x00\x00\x01\x58\x00\x00\x12\x34\x00\x00\x00\x00\x00\x00\x03\xe8\x00\x00\x00\x00\x56\x78\x9a\xbc(.{4})\x81\xca\x00\x05(.{4})\x01\x0c([0-9a-f]{12})\x00\x00$/s);
 is $ret1[0], $ssrc, 'SSRC matches';
-is $ret1[3], $ts, 'TS matches';
+is $ret1[3], $ts + 160, 'TS matches';
 cmp_ok $ret1[4], '<', 6553, 'DSLR ok';
 is $ret1[5], $ssrc, 'SSRC matches';