diff --git a/security/nss/lib/dev/devslot.c b/security/nss/lib/dev/devslot.c
index 13c09d32ce..ebd6e6aa5e 100644
--- a/security/nss/lib/dev/devslot.c
+++ b/security/nss/lib/dev/devslot.c
@@ -171,12 +171,11 @@ nssSlot_IsTokenPresent(
 
     nssSlot_EnterMonitor(slot);
     ckrv = CKAPI(epv)->C_GetSlotInfo(slot->slotID, &slotInfo);
+    nssSlot_ExitMonitor(slot);
     if (ckrv != CKR_OK) {
-        if (slot->token) {
-            slot->token->base.name[0] = 0; /* XXX */
-        }
+        slot->token->base.name[0] = 0; /* XXX */
         isPresent = PR_FALSE;
-        goto done; /* slot lock held */
+        goto done;
     }
     slot->ckFlags = slotInfo.flags;
     /* check for the presence of the token */
@@ -184,11 +183,10 @@ nssSlot_IsTokenPresent(
         if (!slot->token) {
             /* token was never present */
             isPresent = PR_FALSE;
-            goto done; /* slot lock held */
+            goto done;
         }
         session = nssToken_GetDefaultSession(slot->token);
         if (session) {
-            nssSlot_ExitMonitor(slot);
             nssSession_EnterMonitor(session);
             /* token is not present */
             if (session->handle != CK_INVALID_SESSION) {
@@ -198,12 +196,6 @@ nssSlot_IsTokenPresent(
                 session->handle = CK_INVALID_SESSION;
             }
             nssSession_ExitMonitor(session);
-            nssSlot_EnterMonitor(slot);
-            if (!slot->token) {
-                /* Check token presence after re-acquiring lock */
-                isPresent = PR_FALSE;
-                goto done; /* slot lock held */
-            }
         }
         if (slot->token->base.name[0] != 0) {
             /* notify the high-level cache that the token is removed */
@@ -214,23 +206,14 @@ nssSlot_IsTokenPresent(
         /* clear the token cache */
         nssToken_Remove(slot->token);
         isPresent = PR_FALSE;
-        goto done; /* slot lock held */
+        goto done;
     }
-    if (!slot->token) {
-        /* This should not occur, based on the fact that the
-         * below calls will dereference NULL otherwise. */
-        PORT_Assert(0);
-        isPresent = PR_FALSE;
-        goto done; /* slot lock held */
-    }
-
     /* token is present, use the session info to determine if the card
      * has been removed and reinserted.
      */
     session = nssToken_GetDefaultSession(slot->token);
     if (session) {
         PRBool tokenRemoved;
-        nssSlot_ExitMonitor(slot);
         nssSession_EnterMonitor(session);
         if (session->handle != CK_INVALID_SESSION) {
             CK_SESSION_INFO sessionInfo;
@@ -244,16 +227,10 @@ nssSlot_IsTokenPresent(
         }
         tokenRemoved = (session->handle == CK_INVALID_SESSION);
         nssSession_ExitMonitor(session);
-        nssSlot_EnterMonitor(slot);
         /* token not removed, finished */
         if (!tokenRemoved) {
             isPresent = PR_TRUE;
-            goto done; /* slot lock held */
-        }
-        if (!slot->token) {
-            /* Check token presence after re-acquiring lock */
-            isPresent = PR_FALSE;
-            goto done; /* slot lock held */
+            goto done;
         }
     }
     /* the token has been removed, and reinserted, or the slot contains
@@ -271,7 +248,6 @@ nssSlot_IsTokenPresent(
         isPresent = PR_FALSE;
     }
 done:
-    nssSlot_ExitMonitor(slot);
     /* Once we've set up the condition variable,
      * Before returning, it's necessary to:
      *  1) Set the lastTokenPingTime so that any other threads waiting on this
diff --git a/security/nss/lib/pk11wrap/pk11obj.c b/security/nss/lib/pk11wrap/pk11obj.c
index bc9e93454e..09ceb11d05 100644
--- a/security/nss/lib/pk11wrap/pk11obj.c
+++ b/security/nss/lib/pk11wrap/pk11obj.c
@@ -1320,23 +1320,23 @@ PK11_UnwrapPrivKey(PK11SlotInfo *slot, PK11SymKey *wrappingKey,
                                                                 NULL, perm, sensitive);
                 SECKEY_DestroyPrivateKey(privKey);
                 PK11_FreeSlot(int_slot);
+                SECITEM_FreeItem(param_free, PR_TRUE);
                 return newPrivKey;
             }
         }
         if (int_slot)
             PK11_FreeSlot(int_slot);
         PORT_SetError(PK11_MapError(crv));
+        SECITEM_FreeItem(param_free, PR_TRUE);
         return NULL;
     }
+    SECITEM_FreeItem(param_free, PR_TRUE);
     return PK11_MakePrivKey(slot, nullKey, PR_FALSE, privKeyID, wincx);
 
 loser:
-    if (newKey) {
-        PK11_FreeSymKey(newKey);
-    }
-    if (ck_id) {
-        SECITEM_FreeItem(ck_id, PR_TRUE);
-    }
+    PK11_FreeSymKey(newKey);
+    SECITEM_FreeItem(ck_id, PR_TRUE);
+    SECITEM_FreeItem(param_free, PR_TRUE);
     return NULL;
 }