diff --git a/channels/chan_pjsip.c b/channels/chan_pjsip.c
index 06828ac60b1d113f374e494da3e30aa05c6ac927..3e2e9e22e5ac8a66150b1f84bed883c698f4e9d3 100644
--- a/channels/chan_pjsip.c
+++ b/channels/chan_pjsip.c
@@ -2107,7 +2107,7 @@ static int chan_pjsip_incoming_request(struct ast_sip_session *session, struct p
 
 static int call_pickup_incoming_request(struct ast_sip_session *session, pjsip_rx_data *rdata)
 {
-	struct ast_features_pickup_config *pickup_cfg = ast_get_chan_features_pickup_config(session->channel);
+	struct ast_features_pickup_config *pickup_cfg;
 	struct ast_channel *chan;
 
 	/* We don't care about reinvites */
@@ -2115,6 +2115,7 @@ static int call_pickup_incoming_request(struct ast_sip_session *session, pjsip_r
 		return 0;
 	}
 
+	pickup_cfg = ast_get_chan_features_pickup_config(session->channel);
 	if (!pickup_cfg) {
 		ast_log(LOG_ERROR, "Unable to retrieve pickup configuration options. Unable to detect call pickup extension.\n");
 		return 0;
diff --git a/main/bridge_after.c b/main/bridge_after.c
index a21cbf58ea60093e93ddb1d6c72e3edc25018500..a41f8a5483f3eab0582985a16c6f078efe4d5a4a 100644
--- a/main/bridge_after.c
+++ b/main/bridge_after.c
@@ -345,6 +345,7 @@ static void after_bridge_goto_destroy(void *data)
 	ast_free((char *) after_bridge->parseable_goto);
 	ast_free((char *) after_bridge->context);
 	ast_free((char *) after_bridge->exten);
+	ast_free((char *) after_bridge);
 }
 
 /*!
diff --git a/main/manager.c b/main/manager.c
index 783a704de2049be47a6ff399a4ccfbae2adee34a..aa8a5c38cb4723402baddbf5ea1a13ee6bcab677 100644
--- a/main/manager.c
+++ b/main/manager.c
@@ -4970,8 +4970,6 @@ static void *fast_originate(void *data)
 			S_OR(in->cid_name, NULL),
 			in->vars, in->account, &chan, in->early_media, &assignedids);
 	}
-	/* Any vars memory was passed to the ast_pbx_outgoing_xxx() calls. */
-	in->vars = NULL;
 
 	if (!chan) {
 		snprintf(requested_channel, AST_CHANNEL_NAME, "%s/%s", in->tech, in->data);
@@ -5418,11 +5416,11 @@ static int action_originate(struct mansession *s, const struct message *m)
 		}
 	} else if (!ast_strlen_zero(app)) {
 		res = ast_pbx_outgoing_app(tech, cap, data, to, app, appdata, &reason, 1, l, n, vars, account, NULL, assignedids.uniqueid ? &assignedids : NULL);
-		/* Any vars memory was passed to ast_pbx_outgoing_app(). */
+		ast_variables_destroy(vars);
 	} else {
 		if (exten && context && pi) {
 			res = ast_pbx_outgoing_exten(tech, cap, data, to, context, exten, pi, &reason, 1, l, n, vars, account, NULL, bridge_early, assignedids.uniqueid ? &assignedids : NULL);
-			/* Any vars memory was passed to ast_pbx_outgoing_exten(). */
+			ast_variables_destroy(vars);
 		} else {
 			astman_send_error(s, m, "Originate with 'Exten' requires 'Context' and 'Priority'");
 			ast_variables_destroy(vars);
diff --git a/main/pbx.c b/main/pbx.c
index 3e6f07a0ce36b037853a8334f11dd2c80a18d537..08a1e5fa12cbb224e92da3d77c7b88a8b639e3b8 100644
--- a/main/pbx.c
+++ b/main/pbx.c
@@ -8831,7 +8831,7 @@ static void context_merge(struct ast_context **extcontexts, struct ast_hashtab *
 				dupdstr = ast_strdup(prio_item->data);
 
 				res1 = ast_add_extension2(new, 0, prio_item->exten, prio_item->priority, prio_item->label,
-										  prio_item->matchcid ? prio_item->cidmatch : NULL, prio_item->app, dupdstr, prio_item->datad, prio_item->registrar);
+										  prio_item->matchcid ? prio_item->cidmatch : NULL, prio_item->app, dupdstr, ast_free_ptr, prio_item->registrar);
 				if (!res1 && new_exten_item && new_prio_item){
 					ast_verb(3,"Dropping old dialplan item %s/%s/%d [%s(%s)] (registrar=%s) due to conflict with new dialplan\n",
 							context->name, prio_item->exten, prio_item->priority, prio_item->app, (char*)prio_item->data, prio_item->registrar);
diff --git a/main/stasis_channels.c b/main/stasis_channels.c
index 11a2941fa6eacd5fd8d95e41274c051ddd6234d1..6b3f76592249fc61825cec85e553a025e305c5ce 100644
--- a/main/stasis_channels.c
+++ b/main/stasis_channels.c
@@ -1004,13 +1004,14 @@ static struct ast_json *dtmf_end_to_json(
 	const char *direction =
 		ast_json_string_get(ast_json_object_get(blob, "direction"));
 	const struct timeval *tv = stasis_message_timestamp(message);
-	struct ast_json *json_channel = ast_channel_snapshot_to_json(snapshot, sanitize);
+	struct ast_json *json_channel;
 
 	/* Only present received DTMF end events as JSON */
 	if (strcasecmp("Received", direction) != 0) {
 		return NULL;
 	}
 
+	json_channel = ast_channel_snapshot_to_json(snapshot, sanitize);
 	if (!json_channel) {
 		return NULL;
 	}
diff --git a/main/xmldoc.c b/main/xmldoc.c
index 50b6cfe7d022232b9d2f9b9c5426d6b9d6035538..2a17e5287c517900ff8227ef90278f4368ff933c 100644
--- a/main/xmldoc.c
+++ b/main/xmldoc.c
@@ -2533,7 +2533,8 @@ static struct ast_xml_doc_item *xmldoc_build_list_responses(struct ast_xml_node
 	/* Iterate over managerEvent nodes */
 	for (event = ast_xml_node_get_children(list_elements); event; event = ast_xml_node_get_next(event)) {
 		struct ast_xml_node *event_instance;
-		const char *name = ast_xml_get_attribute(event, "name");
+		RAII_VAR(const char *, name, ast_xml_get_attribute(event, "name"),
+			ast_xml_free_attr);
 		struct ast_xml_doc_item *new_item;
 
 		if (!name || strcmp(ast_xml_node_get_name(event), "managerEvent")) {
@@ -2607,10 +2608,16 @@ static struct ast_xml_doc_item *xmldoc_build_final_response(struct ast_xml_node
 		"managerEventInstance", NULL, NULL);
 	if (!event_instance) {
 		return NULL;
+	} else {
+		const char *name;
+		struct ast_xml_doc_item *res;
+
+		name = ast_xml_get_attribute(final_response_event, "name");
+		res = xmldoc_build_documentation_item(event_instance, name, "managerEvent");
+		ast_xml_free_attr(name);
+		return res;
 	}
 
-	return xmldoc_build_documentation_item(event_instance,
-		ast_xml_get_attribute(final_response_event, "name"), "managerEvent");
 }
 
 struct ast_xml_doc_item *ast_xmldoc_build_final_response(const char *type, const char *name, const char *module)
diff --git a/pbx/pbx_spool.c b/pbx/pbx_spool.c
index adec3b26afcbadf95c94969b963c8ae890d0e2d0..119ab08b853c41de3c3f6f5adf17049bc46f1d7a 100644
--- a/pbx/pbx_spool.c
+++ b/pbx/pbx_spool.c
@@ -377,14 +377,12 @@ static void *attempt_thread(void *data)
 		res = ast_pbx_outgoing_app(o->tech, o->capabilities, o->dest, o->waittime * 1000,
 			o->app, o->data, &reason, 2 /* wait to finish */, o->cid_num, o->cid_name,
 			o->vars, o->account, NULL, NULL);
-		o->vars = NULL;
 	} else {
 		ast_verb(3, "Attempting call on %s/%s for %s@%s:%d (Retry %d)\n", o->tech, o->dest, o->exten, o->context,o->priority, o->retries);
 		res = ast_pbx_outgoing_exten(o->tech, o->capabilities, o->dest,
 			o->waittime * 1000, o->context, o->exten, o->priority, &reason,
 			2 /* wait to finish */, o->cid_num, o->cid_name, o->vars, o->account, NULL,
 			ast_test_flag(&o->options, SPOOL_FLAG_EARLY_MEDIA), NULL);
-		o->vars = NULL;
 	}
 	if (res) {
 		ast_log(LOG_NOTICE, "Call failed to go through, reason (%d) %s\n", reason, ast_channel_reason2str(reason));
diff --git a/res/res_pjsip_refer.c b/res/res_pjsip_refer.c
index 87700ac27bed7d8e55c464a98a9816fa07a703a4..cc0616e9d479a6382270eb596fc4562c44d09e10 100644
--- a/res/res_pjsip_refer.c
+++ b/res/res_pjsip_refer.c
@@ -242,16 +242,16 @@ static struct ast_frame *refer_progress_framehook(struct ast_channel *chan, stru
 
 	/* If a notification is due to be sent push it to the thread pool */
 	if (notification) {
-		if (ast_sip_push_task(progress->serializer, refer_progress_notify, notification)) {
-			ao2_cleanup(notification);
-		}
-
 		/* If the subscription is being terminated we don't need the frame hook any longer */
 		if (notification->state == PJSIP_EVSUB_STATE_TERMINATED) {
 			ast_debug(3, "Detaching REFER progress monitoring hook from '%s' as subscription is being terminated\n",
 				ast_channel_name(chan));
 			ast_framehook_detach(chan, progress->framehook);
 		}
+
+		if (ast_sip_push_task(progress->serializer, refer_progress_notify, notification)) {
+			ao2_cleanup(notification);
+		}
 	}
 
 	return f;
@@ -420,6 +420,7 @@ static void refer_attended_destroy(void *obj)
 	ao2_cleanup(attended->transferer);
 	ast_channel_unref(attended->transferer_chan);
 	ao2_cleanup(attended->transferer_second);
+	ao2_cleanup(attended->progress);
 }
 
 /*! \brief Allocator for attended transfer task */