diff --git a/src/utun_instance.c b/src/utun_instance.c
index abce9e2b..16e56342 100644
--- a/src/utun_instance.c
+++ b/src/utun_instance.c
@@ -521,7 +521,7 @@ static void instance_destroy(struct UTUN_INSTANCE* instance, int owns_config) {
         while (p) {
             struct PING_CONTEXT* next = p->next;
             if (p->timeout_timer) uasync_cancel_timeout(instance->ua, p->timeout_timer);
-            u_free(p); pc++;
+            u_free(p->user_data); u_free(p); pc++;
             p = next;
         }
         instance->pending_pings = NULL;
diff --git a/tests/test_nat_detection_faults.c b/tests/test_nat_detection_faults.c
index b4bce283..ec2b6f70 100644
--- a/tests/test_nat_detection_faults.c
+++ b/tests/test_nat_detection_faults.c
@@ -372,7 +372,7 @@ static void run_unknown_address(void) {
     DEBUG_INFO(DEBUG_CATEGORY_NAT, "PASS NAT type=UNKNOWN keeps one observed candidate in signed NODEINFO and SQLite");
 }
 
-/* У наблюдателя первый UDP listener недоступен, но управление по TCP и второй IP работают. */
+/* Первый UDP listener наблюдателя недоступен; рабочий второй IP либо принятый вход всё равно дают результат. */
 static void run_endpoint_retry(void) {
     struct nat_fixture fixture; nat_fixture_init(&fixture);
     struct UTUN_INSTANCE *owner = nat_fixture_node(&fixture, "127.0.0.2", NULL,
@@ -384,24 +384,27 @@ static void run_endpoint_retry(void) {
     nat_detection_set_automatic(observer->nat_det, 0); nat_detection_set_automatic(helper->nat_det, 0);
     struct ETCP_SOCKET *bad = test_etcp_bound_socket(observer, "udp");
     assert(!uasync_remove_socket_t(fixture.ua, bad->fd)); bad->socket_id = NULL;
-    /* Управляющие TCP-пиры не должны параллельно открывать входящий UDP и обходить проверяемый retry. */
-    struct ETCP_SOCKET *socket = test_etcp_bound_socket(owner, "udp");
-    socket->type = CFG_SERVER_TYPE_PRIVATE; assert(topo_node_update_my_addresses(owner) >= 0);
     nat_fixture_connect(&fixture, observer, "tcp", helper); nat_fixture_connect(&fixture, owner, "tcp", observer);
     nat_detection_set_automatic(owner->nat_det, 0);
-    socket->type = CFG_SERVER_TYPE_PUBLIC; /* До публикации измерения NCD видит запрет входящего транспорта. */
+    struct ETCP_SOCKET *socket = test_etcp_bound_socket(owner, "udp");
     struct nat_check_status status = {0}; uint64_t end = get_time_tb() + 400000;
     nat_detection_get_status(owner->nat_det, socket, &status); uint32_t rounds = status.rounds;
     assert(!nat_detection_request_check_socket(owner->nat_det, socket, observer->node_id));
     do { test_clock_poll(fixture.ua, 1000); assert(!nat_detection_get_status(owner->nat_det, socket, &status)); }
-    while (get_time_tb() < end && (status.rounds == rounds || status.phase || status.cycling));
+    while (get_time_tb() < end && (status.phase || status.cycling ||
+        (status.rounds == rounds && socket->address_profile.inbound != ADDRESS_IN_OPEN)));
     DEBUG_INFO(DEBUG_CATEGORY_NAT, "endpoint fixture result mapping=%s inbound=%s rounds=%u previous=%u reason=%s",
                address_mapping_name(socket->address_profile.mapping), address_inbound_name(socket->address_profile.inbound),
                status.rounds, rounds, nat_check_reason_name(status.reason));
     assert(socket->address_profile.mapping == ADDRESS_MAP_UNCHANGED && socket->address_profile.inbound == ADDRESS_IN_OPEN);
-    assert(status.helper_reselections && status.observer == observer->node_id);
+    if (!status.helper_reselections) {
+        struct ETCP_LINK *accepted = NULL;
+        for (struct ETCP_LINK *link = instance_find_conn(owner, observer->node_id)->links; link; link = link->next)
+            if (link->conn == socket && link->is_server && link->initialized) accepted = link;
+        assert(accepted && !status.reason && !status.phase && !status.cycling);
+    } else assert(status.observer == observer->node_id);
     nat_fixture_cleanup(&fixture);
-    DEBUG_INFO(DEBUG_CATEGORY_NAT, "PASS NAT retries another observer IP after timeout");
+    DEBUG_INFO(DEBUG_CATEGORY_NAT, "PASS NAT unavailable observer IP: alternative endpoint or accepted incoming connection confirms OPEN");
 }
 
 /* Несколько медленных помощников исчерпывают общий бюджет посередине следующей попытки. */