diff --git a/src/or/hs_client.c b/src/or/hs_client.c
index 551cf50554..4e2824c13d 100644
--- a/src/or/hs_client.c
+++ b/src/or/hs_client.c
@@ -365,14 +365,12 @@ pick_hsdir_v3(const ed25519_public_key_t *onion_identity_pk)
   int retval;
   char base64_blinded_pubkey[ED25519_BASE64_LEN + 1];
   uint64_t current_time_period = hs_get_time_period_num(0);
-  smartlist_t *responsible_hsdirs;
+  smartlist_t *responsible_hsdirs = NULL;
   ed25519_public_key_t blinded_pubkey;
   routerstatus_t *hsdir_rs = NULL;
 
   tor_assert(onion_identity_pk);
 
-  responsible_hsdirs = smartlist_new();
-
   /* Get blinded pubkey of hidden service */
   hs_build_blinded_pubkey(onion_identity_pk, NULL, 0,
                           current_time_period, &blinded_pubkey);
@@ -383,6 +381,8 @@ pick_hsdir_v3(const ed25519_public_key_t *onion_identity_pk)
   }
 
   /* Get responsible hsdirs of service for this time period */
+  responsible_hsdirs = smartlist_new();
+
   hs_get_responsible_hsdirs(&blinded_pubkey, current_time_period,
                             0, 1, responsible_hsdirs);
 
diff --git a/src/test/test_hs_common.c b/src/test/test_hs_common.c
index 21daa58abd..3ae623ed0a 100644
--- a/src/test/test_hs_common.c
+++ b/src/test/test_hs_common.c
@@ -284,6 +284,7 @@ helper_add_hsdir_to_networkstatus(networkstatus_t *ns,
   routerinfo_t *ri = tor_malloc_zero(sizeof(routerinfo_t));
   uint8_t identity[DIGEST_LEN];
   tor_addr_t ipv4_addr;
+  node_t *node = NULL;
 
   memset(identity, identity_idx, sizeof(identity));
 
@@ -302,7 +303,8 @@ helper_add_hsdir_to_networkstatus(networkstatus_t *ns,
   memset(&ri->cache_info.signing_key_cert->signing_key,
          identity_idx, ED25519_PUBKEY_LEN);
   tt_assert(nodelist_set_routerinfo(ri, NULL));
-  node_t *node = node_get_mutable_by_id(ri->cache_info.identity_digest);
+
+  node = node_get_mutable_by_id(ri->cache_info.identity_digest);
   tt_assert(node);
   node->rs = rs;
   /* We need this to exist for node_has_descriptor() to return true. */
@@ -314,6 +316,9 @@ helper_add_hsdir_to_networkstatus(networkstatus_t *ns,
   smartlist_add(ns->routerstatus_list, rs);
 
  done:
+  if (node == NULL)
+    routerstatus_free(rs);
+
   routerinfo_free(ri);
 }
 
diff --git a/src/test/test_hs_intropoint.c b/src/test/test_hs_intropoint.c
index 0cae2de7e1..b2d2700f8b 100644
--- a/src/test/test_hs_intropoint.c
+++ b/src/test/test_hs_intropoint.c
@@ -43,6 +43,10 @@ new_establish_intro_cell(const char *circ_nonce,
   trn_cell_establish_intro_t *cell = NULL;
   hs_service_intro_point_t *ip = NULL;
 
+  /* Ensure that *cell_out is NULL such that we can use to check if we need to
+   * free `cell` in case of an error. */
+  *cell_out = NULL;
+
   /* Auth key pair is generated in the constructor so we are all set for
    * using this IP object. */
   ip = service_intro_point_new(NULL, 0);
@@ -56,6 +60,9 @@ new_establish_intro_cell(const char *circ_nonce,
   *cell_out = cell;
 
  done:
+  if (*cell_out == NULL)
+    trn_cell_establish_intro_free(cell);
+
   service_intro_point_free(ip);
   return cell_len;
 }