diff --git a/pkg/clientcore/captcha_v2_slider.go b/pkg/clientcore/captcha_v2_slider.go
index 449adee..a8d3dbd 100644
--- a/pkg/clientcore/captcha_v2_slider.go
+++ b/pkg/clientcore/captcha_v2_slider.go
@@ -8,7 +8,7 @@ import (
 	"fmt"
 	"image"
 	"image/color"
-	_ "image/jpeg"
+	_ "image/jpeg" // register JPEG decoder
 	"log"
 	"math"
 	mathrand "math/rand"
diff --git a/pkg/clientcore/main.go b/pkg/clientcore/main.go
index 665a93f..e9ef3e3 100644
--- a/pkg/clientcore/main.go
+++ b/pkg/clientcore/main.go
@@ -1930,6 +1930,7 @@ func oneTurnConnection(ctx context.Context, turnParams *turnParams, peer *net.UD
 	wg := sync.WaitGroup{}
 	wg.Add(1)
 	turnctx, turncancel := context.WithCancel(ctx)
+	defer turncancel()
 	stats := &throughputStats{}
 	go stats.logEvery(turnctx, fmt.Sprintf("[STREAM %d] TURN", streamID), "to-turn", "from-turn")
 
@@ -2201,8 +2202,8 @@ func Run(ctx context.Context, cfg Config) error {
 	if captchaSolverVersion != "v1" && captchaSolverVersion != "v2" {
 		captchaSolverVersion = "v2"
 	}
-	if err := setLocalCaptchaHost(cfg.CaptchaHost); err != nil {
-		return err
+	if captchaHostErr := setLocalCaptchaHost(cfg.CaptchaHost); captchaHostErr != nil {
+		return captchaHostErr
 	}
 	autoCaptchaSliderPOC = !manualCaptcha
 
diff --git a/pkg/clientcore/slider_captcha.go b/pkg/clientcore/slider_captcha.go
index 881aada..4d58a96 100644
--- a/pkg/clientcore/slider_captcha.go
+++ b/pkg/clientcore/slider_captcha.go
@@ -8,7 +8,7 @@ import (
 	"fmt"
 	"image"
 	"image/color"
-	_ "image/jpeg"
+	_ "image/jpeg" // register JPEG decoder
 	"io"
 	"log"
 	"math/rand"
diff --git a/pkg/clientcore/wrap_test.go b/pkg/clientcore/wrap_test.go
index 197fe69..a32b869 100644
--- a/pkg/clientcore/wrap_test.go
+++ b/pkg/clientcore/wrap_test.go
@@ -170,7 +170,7 @@ func TestUnwrapRejectsTamperedPacket(t *testing.T) {
 	wire[wrapHeaderLen+1] ^= 0xFF
 
 	dst := make([]byte, 1600)
-	if _, err := server.unwrapPacket(wire, dst); err == nil {
+	if _, unwrapErr := server.unwrapPacket(wire, dst); unwrapErr == nil {
 		t.Fatalf("unwrapPacket accepted tampered ciphertext")
 	}
 
@@ -180,7 +180,7 @@ func TestUnwrapRejectsTamperedPacket(t *testing.T) {
 	}
 	wire = wire[:n]
 	wire[8] ^= 0x01
-	if _, err := server.unwrapPacket(wire, dst); err == nil {
+	if _, unwrapErr := server.unwrapPacket(wire, dst); unwrapErr == nil {
 		t.Fatalf("unwrapPacket accepted tampered AAD")
 	}
 }
diff --git a/server/udp_listener.go b/server/udp_listener.go
index 1085a26..f6ec4dc 100644
--- a/server/udp_listener.go
+++ b/server/udp_listener.go
@@ -134,7 +134,9 @@ func (l *udpPacketListener) readLoop() {
 func (l *udpPacketListener) dispatchMsg(raddr net.Addr, buf []byte) {
 	conn, ok := l.getConn(raddr, buf)
 	if ok {
-		_, _ = conn.buffer.Write(buf)
+		if _, err := conn.buffer.Write(buf); err != nil {
+			debugf("udp listener buffer write failed: %v", err)
+		}
 	}
 }
 
diff --git a/server/wrap.go b/server/wrap.go
index 3c5bc67..112af3d 100644
--- a/server/wrap.go
+++ b/server/wrap.go
@@ -114,7 +114,10 @@ type wrapPacketConn struct {
 }
 
 func (c *wrapPacketConn) ReadFrom(p []byte) (int, net.Addr, error) {
-	bp := bufPool.Get().(*[]byte)
+	bp, ok := bufPool.Get().(*[]byte)
+	if !ok {
+		return 0, nil, errors.New("wrap: buffer pool returned invalid type")
+	}
 	buf := *bp
 	need := len(p) + wrapOverhead
 	if cap(buf) < need {
@@ -149,7 +152,10 @@ func (c *wrapPacketConn) ReadFrom(p []byte) (int, net.Addr, error) {
 func (c *wrapPacketConn) WriteTo(p []byte, addr net.Addr) (int, error) {
 	wireLen := wrapOverhead + len(p)
 
-	bp := bufPool.Get().(*[]byte)
+	bp, ok := bufPool.Get().(*[]byte)
+	if !ok {
+		return 0, errors.New("wrap: buffer pool returned invalid type")
+	}
 	out := *bp
 	if cap(out) < wireLen {
 		out = make([]byte, wireLen)