diff --git a/bgpd/bgpd.c b/bgpd/bgpd.c
index 8ed598d..733b33a 100644
--- a/bgpd/bgpd.c
+++ b/bgpd/bgpd.c
@@ -687,6 +687,15 @@
 static inline void
 peer_free (struct peer *peer)
 {
+  assert (peer->status == Deleted);
+  
+  /* this /ought/ to have been done already through bgp_stop earlier,
+   * but just to be sure.. 
+   */
+  bgp_timer_set (peer);
+  BGP_READ_OFF (peer->t_read);
+  BGP_WRITE_OFF (peer->t_write);
+  
   if (peer->desc)
     XFREE (MTYPE_PEER_DESC, peer->desc);
   
@@ -704,6 +713,7 @@
   if (peer->clear_node_queue)
     work_queue_free (peer->clear_node_queue);
   
+  bgp_sync_delete (peer);
   memset (peer, 0, sizeof (struct peer));
   
   XFREE (MTYPE_BGP_PEER, peer);
@@ -714,7 +724,8 @@
 peer_lock (struct peer *peer)
 {
   assert (peer && (peer->lock >= 0));
-  
+  assert (peer->status != Deleted);
+    
   peer->lock++;
   
   return peer;
@@ -761,18 +772,17 @@
   struct servent *sp;
 
   /* Allocate new peer. */
-  peer = XMALLOC (MTYPE_BGP_PEER, sizeof (struct peer));
-  memset (peer, 0, sizeof (struct peer));
+  peer = XCALLOC (MTYPE_BGP_PEER, sizeof (struct peer));
 
   /* Set default value. */
   peer->fd = -1;
-  peer->lock = 1;
   peer->v_start = BGP_INIT_START_TIMER;
   peer->v_connect = BGP_DEFAULT_CONNECT_RETRY;
   peer->v_asorig = BGP_DEFAULT_ASORIGINATE;
   peer->status = Idle;
   peer->ostatus = Idle;
   peer->weight = 0;
+  peer = peer_lock (peer); /* initial reference */
 
   /* Set default flags.  */
   for (afi = AFI_IP; afi < AFI_MAX; afi++)
@@ -1139,7 +1149,17 @@
   bgp_clear_route_all (peer);
 }
 
-/* Delete peer from confguration. */
+/* Delete peer from confguration.
+ *
+ * The peer is moved to a dead-end "Deleted" neighbour-state, to allow
+ * it to "cool off" and refcounts to hit 0, at which state it is freed.
+ *
+ * This function /should/ take care to be idempotent, to guard against
+ * it being called multiple times through stray events that come in
+ * that happen to result in this function being called again.  That
+ * said, getting here for a "Deleted" peer is a bug in the neighbour
+ * FSM.
+ */
 int
 peer_delete (struct peer *peer)
 {
@@ -1149,6 +1169,8 @@
   struct bgp *bgp;
   struct bgp_filter *filter;
 
+  assert (peer->status != Deleted);
+  
   bgp = peer->bgp;
 
   if (CHECK_FLAG (peer->sflags, PEER_STATUS_NSF_WAIT))
@@ -1158,8 +1180,13 @@
      relationship.  */
   if (peer->group)
     {
-      peer = peer_unlock (peer); /* peer-group reference */
-      listnode_delete (peer->group->peer, peer);
+      struct listnode *pn;
+
+      if ((pn = listnode_lookup (peer->group->peer, peer)))
+        {
+          peer = peer_unlock (peer); /* group->peer list reference */
+          list_delete_node (peer->group->peer, pn);
+        }
       peer->group = NULL;
     }
   
@@ -1169,29 +1196,25 @@
    */
   peer->last_reset = PEER_DOWN_NEIGHBOR_DELETE;
   bgp_stop (peer);
-  bgp_fsm_change_status (peer, Idle); /* stops all timers */
+  bgp_fsm_change_status (peer, Deleted);
+  bgp_timer_set (peer); /* stops all timers for Deleted */
   
-  /* Stop all timers - should already have been done in bgp_stop */
-  BGP_TIMER_OFF (peer->t_start);
-  BGP_TIMER_OFF (peer->t_connect);
-  BGP_TIMER_OFF (peer->t_holdtime);
-  BGP_TIMER_OFF (peer->t_keepalive);
-  BGP_TIMER_OFF (peer->t_asorig);
-  BGP_TIMER_OFF (peer->t_routeadv);
-  BGP_TIMER_OFF (peer->t_pmax_restart);
-  BGP_TIMER_OFF (peer->t_gr_restart);
-  BGP_TIMER_OFF (peer->t_gr_stale);
-
   /* Delete from all peer list. */
   if (! CHECK_FLAG (peer->sflags, PEER_STATUS_GROUP))
     {
-      peer_unlock (peer); /* bgp peer list reference */
-      listnode_delete (bgp->peer, peer);
+      struct listnode *pn;
       
-      if (peer_rsclient_active (peer))
+      if ((pn = listnode_lookup (bgp->peer, peer)))
+        {
+          peer_unlock (peer); /* bgp peer list reference */
+          list_delete_node (bgp->peer, pn);
+        }
+      
+      if (peer_rsclient_active (peer)
+          && (pn = listnode_lookup (bgp->rsclient, peer)))
         {
           peer_unlock (peer); /* rsclient list reference */
-          listnode_delete (bgp->rsclient, peer);
+          list_delete_node (bgp->rsclient, pn);
         }
     }
 
@@ -1219,8 +1242,6 @@
     sockunion_free (peer->su_remote);
   peer->su_local = peer->su_remote = NULL;
   
-  bgp_sync_delete (peer);
-
   /* Free filter related memory.  */
   for (afi = AFI_IP; afi < AFI_MAX; afi++)
     for (safi = SAFI_UNICAST; safi < SAFI_MAX; safi++)
@@ -1692,7 +1713,7 @@
       peer->group = group;
       peer->af_group[afi][safi] = 1;
 
-      peer = peer_lock (peer); /* peer-group group->peer reference */
+      peer = peer_lock (peer); /* group->peer list reference */
       listnode_add (group->peer, peer);
       peer_group2peer_config_copy (group, peer, afi, safi);
 
@@ -1733,9 +1754,11 @@
     {
       peer->group = group;
       
-      peer = peer_lock (peer); /* peer-group group->peer reference */
+      peer = peer_lock (peer); /* group->peer list reference */
       listnode_add (group->peer, peer);
     }
+  else
+    assert (group && peer->group == group);
 
   if (first_member)
     {
@@ -1759,13 +1782,16 @@
 
   if (CHECK_FLAG(peer->af_flags[afi][safi], PEER_FLAG_RSERVER_CLIENT))
     {
+      struct listnode *pn;
+      
       /* If it's not configured as RSERVER_CLIENT in any other address
           family, without being member of a peer_group, remove it from
           list bgp->rsclient.*/
-      if (! peer_rsclient_active (peer))
+      if (! peer_rsclient_active (peer)
+          && (pn = listnode_lookup (bgp->rsclient, peer)))
         {
           peer_unlock (peer); /* peer rsclient reference */
-          listnode_delete (bgp->rsclient, peer);
+          list_delete_node (bgp->rsclient, pn);
         }
 
       bgp_table_finish (peer->rib[afi][safi]);
@@ -1821,6 +1847,7 @@
 
   if (! peer_group_active (peer))
     {
+      assert (listnode_lookup (group->peer, peer));
       peer_unlock (peer); /* peer group list reference */
       listnode_delete (group->peer, peer);
       peer->group = NULL;