@@ -202,6 +202,9 @@ func (c *Client) Close() error {
 	}
 	c.closed = true
 	c.invalidateMappingsLocked(true)
+	if c.uPnPHTTPClient != nil {
+		c.uPnPHTTPClient.CloseIdleConnections()
+	}
 	// TODO: close some future ever-listening UDP socket(s),
 	// waiting for multicast announcements from router.
 	return nil
@@ -298,6 +301,16 @@ func (c *Client) invalidateMappingsLocked(releaseOld bool) {
 	c.uPnPMeta = uPnPDiscoResponse{}
 }
 
+// setMappingLocked stores m or releases it if closed. c.mu must be held.
+func (c *Client) setMappingLocked(m mapping) bool {
+	if c.closed {
+		m.Release(context.Background())
+		return false
+	}
+	c.mapping = m
+	return true
+}
+
 func (c *Client) sawPMPRecently() bool {
 	c.mu.Lock()
 	defer c.mu.Unlock()
@@ -391,7 +404,7 @@ func (c *Client) GetCachedMappingOrStartCreatingOne(ctx context.Context) (extern
 //
 // c.mu must be held.
 func (c *Client) maybeStartMappingLocked(ctx context.Context) {
-	if !c.runningCreate {
+	if !c.closed && !c.runningCreate {
 		c.runningCreate = true
 		go c.createMapping(ctx)
 	}
@@ -435,6 +448,10 @@ func (c *Client) createOrGetMapping(ctx context.Context) (external netip.AddrPor
 	}
 
 	c.mu.Lock()
+	if c.closed {
+		c.mu.Unlock()
+		return netip.AddrPort{}, NoMappingError{net.ErrClosed}
+	}
 	localPort := c.localPort
 	internalAddr := netip.AddrPortFrom(myIP, localPort)
 
@@ -587,7 +604,9 @@ func (c *Client) createOrGetMapping(ctx context.Context) (external netip.AddrPor
 				pcpMapping.gw = netip.AddrPortFrom(gw, c.pxpPort())
 				c.mu.Lock()
 				defer c.mu.Unlock()
-				c.mapping = pcpMapping
+				if !c.setMappingLocked(pcpMapping) {
+					return netip.AddrPort{}, NoMappingError{net.ErrClosed}
+				}
 				return pcpMapping.external, nil
 			default:
 				c.logf("unknown PMP/PCP version number: %d %v", version, res[:n])
@@ -598,7 +617,9 @@ func (c *Client) createOrGetMapping(ctx context.Context) (external netip.AddrPor
 		if m.externalValid() {
 			c.mu.Lock()
 			defer c.mu.Unlock()
-			c.mapping = m
+			if !c.setMappingLocked(m) {
+				return netip.AddrPort{}, NoMappingError{net.ErrClosed}
+			}
 			return m.external, nil
 		}
 	}
 
@@ -5,6 +5,9 @@ package portmapper
 
 import (
 	"context"
+	"encoding/binary"
+	"net"
+	"net/netip"
 	"os"
 	"reflect"
 	"strconv"
@@ -122,3 +125,67 @@ func TestPCPIntegration(t *testing.T) {
 		t.Errorf("got nil mapping after successful createOrGetMapping")
 	}
 }
+
+func TestSetMappingLockedReleasesAfterClose(t *testing.T) {
+	t.Parallel()
+	for _, tt := range []struct {
+		name                                          string
+		version                                       byte
+		pktLen, lifetimeOff, internalOff, externalOff int
+	}{
+		{"PMP", pmpVersion, 12, 8, 4, 6},
+		{"PCP", pcpVersion, 60, 4, 40, 42},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			pc, err := net.ListenPacket("udp4", "127.0.0.1:0")
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer pc.Close()
+			c := NewClient(t.Logf, nil, nil, nil)
+			c.testPxPPort = uint16(pc.LocalAddr().(*net.UDPAddr).Port)
+			lo := netip.MustParseAddr("127.0.0.1")
+			gw, internal := netip.AddrPortFrom(lo, c.testPxPPort), netip.AddrPortFrom(lo, 41641)
+			newMapping := func(port uint16) mapping {
+				ext := netip.AddrPortFrom(lo, port)
+				if tt.version == pmpVersion {
+					return &pmpMapping{c: c, gw: gw, internal: internal, external: ext}
+				}
+				return &pcpMapping{c: c, gw: gw, internal: internal, external: ext}
+			}
+
+			before := newMapping(4241)
+			c.mu.Lock()
+			installed := c.setMappingLocked(before)
+			retained := c.mapping
+			c.mu.Unlock()
+			if !installed || retained != before {
+				t.Fatalf("setMappingLocked before Close = %v, retained %v", installed, retained)
+			}
+			c.Close()
+			c.mu.Lock()
+			installed = c.setMappingLocked(newMapping(4242))
+			retained = c.mapping
+			c.mu.Unlock()
+			if installed || retained != nil {
+				t.Errorf("setMappingLocked after Close = %v, retained %v; want false, nil", installed, retained)
+			}
+
+			pc.SetReadDeadline(time.Now().Add(10 * time.Second))
+			buf := make([]byte, 1500)
+			for _, port := range []uint16{4241, 4242} {
+				n, _, err := pc.ReadFrom(buf)
+				if err != nil {
+					t.Fatalf("reading delete for port %d: %v", port, err)
+				}
+				if pkt := buf[:n]; n != tt.pktLen || pkt[0] != tt.version ||
+					binary.BigEndian.Uint32(pkt[tt.lifetimeOff:]) != 0 ||
+					binary.BigEndian.Uint16(pkt[tt.internalOff:]) != internal.Port() ||
+					binary.BigEndian.Uint16(pkt[tt.externalOff:]) != port {
+					t.Errorf("got % x; want %s delete for external port %d", pkt, tt.name, port)
+				}
+			}
+		})
+	}
+}
@@ -267,10 +267,22 @@ func (c *Client) getUPnPPortMapping(
 	var client upnpClient
 	var err error
 	c.mu.Lock()
+	if c.closed {
+		c.mu.Unlock()
+		return netip.AddrPort{}, false
+	}
 	oldMapping, ok := c.mapping.(*upnpMapping)
 	meta := c.uPnPMeta
 	httpClient := c.upnpHTTPClientLocked()
 	c.mu.Unlock()
+	defer func() {
+		c.mu.Lock()
+		defer c.mu.Unlock()
+		// In-flight requests can reopen the idle pool after Close.
+		if c.closed {
+			httpClient.CloseIdleConnections()
+		}
+	}()
 	if ok && oldMapping != nil {
 		client = oldMapping.client
 	} else {
@@ -287,6 +299,19 @@ func (c *Client) getUPnPPortMapping(
 		return netip.AddrPort{}, false
 	}
 
+	// Failed IP lookups must not leave untracked mappings.
+	extIP, err := client.GetExternalIPAddress(ctx)
+	if c.debug.VerboseLogs {
+		c.logf("client.GetExternalIPAddress: %v, %v", extIP, err)
+	}
+	if err != nil {
+		return netip.AddrPort{}, false
+	}
+	externalIP, err := netip.ParseAddr(extIP)
+	if err != nil {
+		return netip.AddrPort{}, false
+	}
+
 	var newPort uint16
 	newPort, err = addAnyPortMapping(
 		ctx,
@@ -302,19 +327,6 @@ func (c *Client) getUPnPPortMapping(
 	if err != nil {
 		return netip.AddrPort{}, false
 	}
-	// TODO cache this ip somewhere?
-	extIP, err := client.GetExternalIPAddress(ctx)
-	if c.debug.VerboseLogs {
-		c.logf("client.GetExternalIPAddress: %v, %v", extIP, err)
-	}
-	if err != nil {
-		// TODO this doesn't seem right
-		return netip.AddrPort{}, false
-	}
-	externalIP, err := netip.ParseAddr(extIP)
-	if err != nil {
-		return netip.AddrPort{}, false
-	}
 
 	upnp.external = netip.AddrPortFrom(externalIP, newPort)
 	d := time.Duration(pmpMapLifetimeSec) * time.Second
@@ -323,7 +335,9 @@ func (c *Client) getUPnPPortMapping(
 	upnp.client = client
 	c.mu.Lock()
 	defer c.mu.Unlock()
-	c.mapping = upnp
+	if !c.setMappingLocked(upnp) {
+		return netip.AddrPort{}, false
+	}
 	c.localPort = newPort
 	return upnp.external, true
 }