diff --git a/source3/smbd/server_exit.c b/source3/smbd/server_exit.c
index 2378c0c15ca..00994740702 100644
--- a/source3/smbd/server_exit.c
+++ b/source3/smbd/server_exit.c
@@ -110,13 +110,11 @@ static void exit_server_common(enum server_exit_reason how,
 	/*
 	 * Here we typically have just one connection
 	 */
-	for (; xconn != NULL; xconn = xconn_next) {
-		xconn_next = xconn->next;
-		DLIST_REMOVE(client->connections, xconn);
-
+	for (; xconn != NULL; xconn = xconn->next) {
 		/*
 		 * This is typically the disconnect for the only
 		 * (or with multi-channel last) connection of the client
+		 * First mark the connections closed.
 		 */
 		if (NT_STATUS_IS_OK(xconn->transport.status)) {
 			switch (how) {
@@ -128,8 +126,6 @@ static void exit_server_common(enum server_exit_reason how,
 				break;
 			}
 		}
-
-		TALLOC_FREE(xconn);
 		DO_PROFILE_INC(disconnect);
 	}
 
@@ -212,6 +208,17 @@ static void exit_server_common(enum server_exit_reason how,
 	if (client != NULL) {
 		TALLOC_FREE(client->sconn);
 	}
+
+	/*
+	 * Now actually free the connections.
+	 * Here we typically have just one connection
+	 */
+	for (; xconn != NULL; xconn = xconn_next) {
+		xconn_next = xconn->next;
+		DLIST_REMOVE(client->connections, xconn);
+		TALLOC_FREE(xconn);
+	}
+
 	sconn = NULL;
 	xconn = NULL;
 	client = NULL;