Index: trunk/src/VBox/GuestHost/SharedClipboard/clipboard-transfers.cpp
===================================================================
--- trunk/src/VBox/GuestHost/SharedClipboard/clipboard-transfers.cpp	(revision 102953)
+++ trunk/src/VBox/GuestHost/SharedClipboard/clipboard-transfers.cpp	(revision 102954)
@@ -1162,5 +1162,6 @@
  *
  * @returns VBox status code.
- * @param   pTransferCtx                Clipboard transfer to destroy.
+ * @param   pTransfer           Clipboard transfer to destroy.
+ *                              The pointer will be invalid after return.
  */
 int ShClTransferDestroy(PSHCLTRANSFER pTransfer)
@@ -1195,4 +1196,7 @@
 
     ShClEventSourceDestroy(&pTransfer->Events);
+
+    RTMemFree(pTransfer);
+    pTransfer = NULL;
 
     LogFlowFuncLeave();
@@ -2679,10 +2683,6 @@
     RTListForEachSafe(&pTransferCtx->List, pTransfer, pTransferNext, SHCLTRANSFER, Node)
     {
+        shclTransferCtxTransferRemoveAndUnregister(pTransferCtx, pTransfer);
         ShClTransferDestroy(pTransfer);
-
-        shclTransferCtxTransferRemoveAndUnregister(pTransferCtx, pTransfer);
-
-        RTMemFree(pTransfer);
-        pTransfer = NULL;
     }
 
@@ -3235,9 +3235,5 @@
 
             shclTransferCtxTransferRemoveAndUnregister(pTransferCtx, pTransfer);
-
             ShClTransferDestroy(pTransfer);
-
-            RTMemFree(pTransfer);
-            pTransfer = NULL;
         }
         else
Index: trunk/src/VBox/HostServices/SharedClipboard/VBoxSharedClipboardSvc-transfers.cpp
===================================================================
--- trunk/src/VBox/HostServices/SharedClipboard/VBoxSharedClipboardSvc-transfers.cpp	(revision 102953)
+++ trunk/src/VBox/HostServices/SharedClipboard/VBoxSharedClipboardSvc-transfers.cpp	(revision 102954)
@@ -2293,9 +2293,5 @@
 
             ShClTransferCtxUnregisterById(pTxCtx, pTransfer->State.uID);
-
             ShClTransferDestroy(pTransfer);
-
-            RTMemFree(pTransfer);
-            pTransfer = NULL;
         }
     }
@@ -2343,10 +2339,5 @@
 
     if (RT_FAILURE(rc))
-    {
         ShClTransferDestroy(pTransfer);
-
-        RTMemFree(pTransfer);
-        pTransfer = NULL;
-    }
 
     if (RT_FAILURE(rc))
@@ -2383,6 +2374,4 @@
 
     ShClTransferDestroy(pTransfer);
-
-    RTMemFree(pTransfer);
     pTransfer = NULL;
 
Index: trunk/src/VBox/HostServices/SharedClipboard/testcase/tstClipboardTransfers.cpp
===================================================================
--- trunk/src/VBox/HostServices/SharedClipboard/testcase/tstClipboardTransfers.cpp	(revision 102953)
+++ trunk/src/VBox/HostServices/SharedClipboard/testcase/tstClipboardTransfers.cpp	(revision 102954)
@@ -291,4 +291,6 @@
     }
 
+    ShClTransferObjOpenParmsDestroy(&openCreateParms);
+
     rc = ShClTransferDestroy(pTransfer);
     RTTESTI_CHECK_RC_OK(rc);
@@ -310,7 +312,5 @@
     ShClEventSourceReset(&Source);
     RTTESTI_CHECK(ShClEventSourceGetLast(&Source) == NULL); /* Event still valid, but removed from the source. */
-    RTTESTI_CHECK(ShClEventRelease(pEvent) == 0);
-    RTTESTI_CHECK(ShClEventRelease(pEvent) == UINT32_MAX); /* Ref count already was 0, so returns UINT32_MAX. */
-    RTTESTI_CHECK(ShClEventRelease(pEvent) == UINT32_MAX); /* Again. */
+    RTTESTI_CHECK(ShClEventRelease(pEvent) == 0); /* Free'd event, as ref count is 0. */
     RTTESTI_CHECK(ShClEventSourceGetLast(&Source) == NULL); /* Now it should be empty. */
     RTTESTI_CHECK_RC_OK(ShClEventSourceDestroy(&Source));
@@ -325,6 +325,5 @@
     RTTESTI_CHECK(ShClEventRelease(pEvent) == 1);
     RTTESTI_CHECK(ShClEventGetRefs(pEvent) == 1);
-    RTTESTI_CHECK(ShClEventRelease(pEvent) == 0); /* Destroys event, as ref count is 0. */
-    RTTESTI_CHECK(ShClEventRelease(pEvent) == UINT32_MAX);
+    RTTESTI_CHECK(ShClEventRelease(pEvent) == 0); /* Free'd event, as ref count is 0. */
     RTTESTI_CHECK_RC_OK(ShClEventSourceDestroy(&Source)); /* Try to destruct again. */
 }
@@ -339,4 +338,5 @@
     rc = ShClTransferDestroy(pTransfer);
     RTTESTI_CHECK_RC_OK(rc);
+    pTransfer = NULL; /* Was free'd above. */
     rc = ShClTransferDestroy(pTransfer); /* Second time, intentional. */
     RTTESTI_CHECK_RC_OK(rc);
@@ -354,4 +354,7 @@
     ShClTransferListEntryDestroy(&Entry);
     ShClTransferListEntryDestroy(&Entry); /* Second time, intentional. */
+
+    rc = ShClTransferDestroy(pTransfer);
+    RTTESTI_CHECK_RC_OK(rc);
 }
 
