diff --git a/conev.c b/conev.c
index ce75d86..2a23301 100644
--- a/conev.c
+++ b/conev.c
@@ -4,6 +4,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <limits.h>
+#include <assert.h>
 
 
 struct poolhd *init_pool(int count)
@@ -43,6 +44,7 @@ struct poolhd *init_pool(int count)
 struct eval *add_event(struct poolhd *pool, enum eid type,
         int fd, int e)
 {
+    assert(fd > 0);
     if (pool->count >= pool->max) {
         return 0;
     }
@@ -74,15 +76,19 @@ struct eval *add_event(struct poolhd *pool, enum eid type,
 
 void del_event(struct poolhd *pool, struct eval *val) 
 {
-    if (!val->fd) {
+    assert(val && ((val->fd > 0 && val->mod_iter < pool->iters) ||
+        val->mod_iter == pool->iters));
+    if (val->fd == -1) {
         return;
     }
+    
     if (val->buff.data) {
+        assert(val->buff.size);
         free(val->buff.data);
         val->buff.data = 0;
     }
     close(val->fd);
-    val->fd = 0;
+    val->fd = -1;
     val->mod_iter = pool->iters;
     pool->count--;
     
@@ -98,12 +104,14 @@ void del_event(struct poolhd *pool, struct eval *val)
         ev->index = index;
     }
     if (val->pair) {
-        if (val->pair == val) {
+        if (val->pair->pair == val) {
             val->pair->pair = 0;
         }
-        del_event(pool, val->pair);
+        struct eval *e = val->pair;
         val->pair = 0;
+        del_event(pool, e);
     }
+    assert(pool->count > 0);
 }
 
 
@@ -137,6 +145,7 @@ struct eval *next_event(struct poolhd *pool, int *offs, int *type)
 {
     while (1) {
         int i = *offs;
+        assert(i >= -1 && i < pool->count);
         if (i < 0) {
             i = (epoll_wait(pool->efd, pool->pevents, pool->max, -1) - 1);
             if (i < 0) {
@@ -160,6 +169,7 @@ struct eval *next_event(struct poolhd *pool, int *offs, int *type)
 
 int mod_etype(struct poolhd *pool, struct eval *val, int type)
 {
+    assert(val->fd > 0);
     struct epoll_event ev = {
         .events = EPOLLRDHUP | type, .data = {val}
     };
@@ -170,6 +180,7 @@ int mod_etype(struct poolhd *pool, struct eval *val, int type)
 struct eval *next_event(struct poolhd *pool, int *offs, int *typel)
 {
     for (int i = *offs; ; i--) {
+        assert(i >= -1 && i < pool->max);
         if (i < 0) {
             if (poll(pool->pevents, pool->count, -1) <= 0) {
                 return 0;
@@ -185,6 +196,7 @@ struct eval *next_event(struct poolhd *pool, int *offs, int *typel)
             continue;
         }
         struct eval *val = pool->links[i];
+        assert((i < pool->count) || (val->mod_iter == pool->iters));
         if (val->mod_iter == pool->iters) {
             continue;
         }
@@ -198,6 +210,7 @@ struct eval *next_event(struct poolhd *pool, int *offs, int *typel)
 
 int mod_etype(struct poolhd *pool, struct eval *val, int type)
 {
+   assert(val->index >= 0 && val->index < pool->count);
    pool->pevents[val->index].events = type;
    return 0;
 }
diff --git a/extend.c b/extend.c
index 6669c0f..46dc95f 100644
--- a/extend.c
+++ b/extend.c
@@ -12,6 +12,7 @@
 #endif
 
 #include <string.h>
+#include <assert.h>
 
 #include "proxy.h"
 #include "error.h"
@@ -45,10 +46,12 @@ int set_timeout(int fd, unsigned int s)
 int mode_add_get(struct sockaddr_ina *dst, int m)
 {
     // m < 0: get, m > 0: set, m == 0: delete
-    time_t t;
-    struct elem *val;
+    assert(m >= -1 && m < params.dp_count);
+    
+    time_t t = 0;
+    struct elem *val = 0;
     char *str = (char *)&dst->in;
-    int len = sizeof(dst->sa.sa_family);
+    int len = 0;
     
     if (dst->sa.sa_family == AF_INET) {
         len = sizeof(dst->in);
@@ -57,6 +60,7 @@ int mode_add_get(struct sockaddr_ina *dst, int m)
         len = sizeof(dst->in6) - sizeof(dst->in6.sin6_scope_id);
     }
     len -= sizeof(dst->sa.sa_family);
+    assert(len > 0);
     
     if (m == 0) {
         mem_delete(params.mempool, str, len);
@@ -89,6 +93,8 @@ int mode_add_get(struct sockaddr_ina *dst, int m)
 int ext_connect(struct poolhd *pool, struct eval *val, 
         struct sockaddr_ina *dst, int next, int m)
 {
+    assert(m >= 0 && m < params.dp_count && dst && val);
+    
     struct desync_params *dp = &params.dp[m];
     if (dp->to_ip) {
         struct sockaddr_ina addr = { .in6 = dp->addr };
@@ -147,6 +153,7 @@ bool check_host(struct mphdr *hosts, struct eval *val)
     if (!(len = parse_tls(val->buff.data, val->buff.size, &host))) {
         len = parse_http(val->buff.data, val->buff.size, &host, 0);
     }
+    assert(len == 0 || host != 0);
     return (len > 0) && mem_get(hosts, host, len) != 0;
 }
 
@@ -241,7 +248,7 @@ int on_tunnel_check(struct poolhd *pool, struct eval *val,
     }
     ssize_t n = recv(val->fd, buffer, bfsize, 0);
     if (n < 1) {
-        uniperror("recv");
+        if (n) uniperror("recv");
         switch (get_e()) {
             case ECONNRESET:
             case ECONNREFUSED:
@@ -255,6 +262,7 @@ int on_tunnel_check(struct poolhd *pool, struct eval *val,
     if (on_response(pool, val, buffer, n) == 0) {
         return 0;
     }
+    val->recv_count += n;
     struct eval *pair = val->pair;
     
     ssize_t sn = send(pair->fd, buffer, n, 0);
@@ -265,6 +273,7 @@ int on_tunnel_check(struct poolhd *pool, struct eval *val,
     val->type = EV_TUNNEL;
     pair->type = EV_TUNNEL;
     
+    assert(pair->buff.data);
     free(pair->buff.data);
     pair->buff.data = 0;
     pair->buff.size = 0;
@@ -298,7 +307,7 @@ int on_desync(struct poolhd *pool, struct eval *val,
         }
         val = val->pair;
     }
-    ssize_t n;
+    ssize_t n = 0;
     int m = val->attempt;
     LOG((m ? LOG_S : LOG_L), "desync params index: %d\n", m);
     
@@ -310,6 +319,7 @@ int on_desync(struct poolhd *pool, struct eval *val,
         }
         val->buff.size = n;
         val->recv_count += n;
+        assert(val->buff.offset == 0);
         
         if (!(val->buff.data = malloc(n))) {
             uniperror("malloc");
@@ -337,6 +347,7 @@ int on_desync(struct poolhd *pool, struct eval *val,
     }
     else {
         n = val->buff.size;
+        assert(n > 0 && n <= params.bfsize);
         memcpy(buffer, val->buff.data, n);
     }
     if (params.timeout &&
diff --git a/mpool.c b/mpool.c
index 690fae0..bcc0792 100644
--- a/mpool.c
+++ b/mpool.c
@@ -1,5 +1,6 @@
 #include <stdlib.h>
 #include <string.h>
+
 #include "mpool.h"
 
 
@@ -37,7 +38,7 @@ struct elem *mem_get(struct mphdr *hdr, char *str, int len)
 
 struct elem *mem_add(struct mphdr *hdr, char *str, int len)
 {
-    struct elem *v, *e = malloc(sizeof(struct elem));
+    struct elem *v, *e = calloc(sizeof(struct elem), 1);
     if (!e) {
         return 0;
     }