diff --git a/src/cart/crt_iv.c b/src/cart/crt_iv.c
index 9913686e5f1..71d1e741309 100644
--- a/src/cart/crt_iv.c
+++ b/src/cart/crt_iv.c
@@ -1,6 +1,6 @@
 /*
  * (C) Copyright 2016-2024 Intel Corporation.
- * (C) Copyright 2025 Hewlett Packard Enterprise Development LP
+ * (C) Copyright 2025-2026 Hewlett Packard Enterprise Development LP
  *
  * SPDX-License-Identifier: BSD-2-Clause-Patent
  */
@@ -1136,7 +1136,7 @@ crt_ivf_rpc_issue(d_rank_t dest_node, crt_iv_key_t *iv_key,
 	struct crt_iv_fetch_in		*input;
 	crt_bulk_t			local_bulk = CRT_BULK_NULL;
 	crt_endpoint_t			ep = {0};
-	crt_rpc_t			*rpc;
+	crt_rpc_t                       *rpc;
 	struct ivf_key_in_progress	*entry;
 	int				rc = 0;
 	struct crt_iv_ops		*iv_ops;
@@ -1236,6 +1236,7 @@ crt_ivf_rpc_issue(d_rank_t dest_node, crt_iv_key_t *iv_key,
 	} else {
 		D_DEBUG(DB_ALL, "Group Version Changed: From %d: To %d\n",
 			grp_ver, local_grp_ver);
+		RPC_PUB_DECREF(rpc);
 		D_GOTO(exit, rc = -DER_GRPVER);
 	}
 
@@ -2611,7 +2612,7 @@ crt_ivu_rpc_issue(d_rank_t dest_rank, crt_iv_key_t *iv_key,
 	struct crt_iv_update_in		*input;
 	crt_bulk_t			local_bulk = CRT_BULK_NULL;
 	crt_endpoint_t			ep = {0};
-	crt_rpc_t			*rpc;
+	crt_rpc_t                       *rpc;
 	int				rc = 0;
 	uint32_t			local_grp_ver;
 
@@ -2642,6 +2643,7 @@ crt_ivu_rpc_issue(d_rank_t dest_rank, crt_iv_key_t *iv_key,
 		}
 		if (rc != 0) {
 			D_ERROR("crt_bulk_create(): "DF_RC"\n", DP_RC(rc));
+			RPC_PUB_DECREF(rpc);
 			D_GOTO(exit, rc);
 		}
 	} else {
@@ -2677,6 +2679,7 @@ crt_ivu_rpc_issue(d_rank_t dest_rank, crt_iv_key_t *iv_key,
 			"On entry: %d: Changed to :%d\n",
 			ivns_internal->cii_gns.gn_ivns_id.ii_group_name,
 			grp_ver, local_grp_ver);
+		RPC_PUB_DECREF(rpc);
 		D_GOTO(exit, rc = -DER_GRPVER);
 	}
 	input->ivu_grp_ver = grp_ver;
diff --git a/src/object/srv_obj_migrate.c b/src/object/srv_obj_migrate.c
index 2ccda79e4c2..169f8658790 100644
--- a/src/object/srv_obj_migrate.c
+++ b/src/object/srv_obj_migrate.c
@@ -953,11 +953,11 @@ migrate_fetch_update_inline(struct migrate_one *mrone, daos_handle_t oh,
 				    VOS_OF_REBUILD, &mrone->mo_dkey, iod_cnt,
 				    &mrone->mo_iods[start], iod_csums,
 				    &sgls[start]);
+		daos_csummer_free_ic(csummer, &iod_csums);
 		if (rc) {
 			DL_ERROR(rc, DF_RB ": migrate failed", DP_RB_MRO(mrone));
 			D_GOTO(out, rc);
 		}
-		daos_csummer_free_ic(csummer, &iod_csums);
 	}
 
 out:
@@ -4325,8 +4325,10 @@ migrate_check_one(void *data)
 		migrate_pool_tls_get(tls);
 		tls->mpt_post_process_started = 1;
 		D_ALLOC_PTR(ult_arg);
-		if (ult_arg == NULL)
+		if (ult_arg == NULL) {
+			migrate_pool_tls_put(tls);
 			D_GOTO(out, rc = -DER_NOMEM);
+		}
 
 		ult_arg->rpa_tls = tls;
 		ult_arg->rpa_migrated_root = &tls->mpt_migrated_root;
@@ -4464,10 +4466,6 @@ ds_object_migrate_send(struct ds_pool *pool, uuid_t pool_hdl_uuid, uuid_t cont_h
 		return -DER_NONEXIST;
 	}
 
-	/* NB: let's send object list to 0 xstream to simplify the migrate
-	 * object handling process for now, for example avoid lock to insert
-	 * objects in the object tree.
-	 */
 	tgt_ep.ep_rank = target->ta_comp.co_rank;
 	index = target->ta_comp.co_index;
 	ABT_rwlock_unlock(pool->sp_lock);
diff --git a/src/rebuild/scan.c b/src/rebuild/scan.c
index 61f8d86680c..a070819916d 100644
--- a/src/rebuild/scan.c
+++ b/src/rebuild/scan.c
@@ -291,7 +291,7 @@ rebuild_objects_send_ult(void *data)
 		D_GOTO(out, rc = -DER_NOMEM);
 
 	D_ALLOC_ARRAY(punched_ephs, REBUILD_SEND_LIMIT);
-	if (ephs == NULL)
+	if (punched_ephs == NULL)
 		D_GOTO(out, rc = -DER_NOMEM);
 
 	arg.count = 0;