diff --git a/channels/chan_sip.c b/channels/chan_sip.c
index 3d1b3158f85041da39c309510db4ddab9da83583..10847f7b24f44374b1240c43a029d9b815ef36b2 100644
--- a/channels/chan_sip.c
+++ b/channels/chan_sip.c
@@ -3044,11 +3044,18 @@ static void sip_destroy_peer(struct sip_peer *peer)
 		ast_variables_destroy(peer->chanvars);
 		peer->chanvars = NULL;
 	}
-	if (peer->expire > -1)
-		ast_sched_del(sched, peer->expire);
 
-	if (peer->pokeexpire > -1)
-		ast_sched_del(sched, peer->pokeexpire);
+	/* If the schedule delete fails, that means the schedule is currently
+	 * running, which means we should wait for that thread to complete.
+	 * Otherwise, there's a crashable race condition.
+	 *
+	 * NOTE: once peer is refcounted, this probably is no longer necessary.
+	 */
+	while (peer->expire > -1 && ast_sched_del(sched, peer->expire))
+		usleep(1);
+	while (peer->pokeexpire > -1 && ast_sched_del(sched, peer->pokeexpire))
+		usleep(1);
+
 	register_peer_exten(peer, FALSE);
 	ast_free_ha(peer->ha);
 	if (peer->selfdestruct)
diff --git a/main/translate.c b/main/translate.c
index 1236ee0ee42671e8490624069337c476b19a979f..1611385f50e05a353d91f1b0254800091e3330e4 100644
--- a/main/translate.c
+++ b/main/translate.c
@@ -225,7 +225,10 @@ struct ast_frame *ast_trans_frameout(struct ast_trans_pvt *pvt,
 	f->offset = AST_FRIENDLY_OFFSET;
 	f->src = pvt->t->name;
 	f->data = pvt->outbuf;
-	return f;
+	/* We must clone the frame, because the pvt could disappear
+	 * the moment after we return (and unlock the source channel).
+	 */
+	return ast_frisolate(f);
 }
 
 static struct ast_frame *default_frameout(struct ast_trans_pvt *pvt)