diff --git a/src/app-layer.c b/src/app-layer.c
index 6d49bce549..be22283df6 100644
--- a/src/app-layer.c
+++ b/src/app-layer.c
@@ -30,6 +30,7 @@
 #include "stream-tcp-reassemble.h"
 #include "stream-tcp-private.h"
 #include "flow.h"
+#include "flow-util.h"
 
 #include "util-debug.h"
 #include "util-print.h"
@@ -258,17 +259,13 @@ int AppLayerHandleTCPMsg(AlpProtoDetectThreadCtx *dp_ctx, StreamMsg *smsg)
             }
         }
 
-        /* flow is free again */
-        FlowDecrUsecnt(smsg->flow);
-        /* dereference the flow */
-        smsg->flow = NULL;
+        FlowDeReference(&smsg->flow);
     } else { /* no ssn ptr */
         /* if there is no ssn ptr we won't
          * be inspecting this msg in detect
          * so return it to the pool. */
 
-        /* flow is free again */
-        FlowDecrUsecnt(smsg->flow);
+        FlowDeReference(&smsg->flow);
 
         /* return the used message to the queue */
         StreamMsgReturnToPool(smsg);
diff --git a/src/detect.c b/src/detect.c
index 20e8bbda52..484c0671a7 100644
--- a/src/detect.c
+++ b/src/detect.c
@@ -1426,8 +1426,6 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh
             SCLogDebug("STREAM_EOF set");
         }
 
-        FlowIncrUsecnt(p->flow);
-
         FLOWLOCK_WRLOCK(p->flow);
         {
             /* live ruleswap check for flow updates */
@@ -1985,8 +1983,6 @@ end:
         StreamMsgReturnListToPool(smsg);
 
         FLOWLOCK_UNLOCK(p->flow);
-
-        FlowDecrUsecnt(p->flow);
     }
     PACKET_PROFILING_DETECT_END(p, PROF_DETECT_CLEANUP);
 
diff --git a/src/flow-hash.c b/src/flow-hash.c
index 6d9b7ac872..283cbc480c 100644
--- a/src/flow-hash.c
+++ b/src/flow-hash.c
@@ -442,8 +442,6 @@ static Flow *FlowGetNew(Packet *p) {
         /* flow is initialized (recylced) but *unlocked* */
     }
 
-    FlowIncrUsecnt(f);
-
     FLOWLOCK_WRLOCK(f);
     return f;
 }
@@ -488,6 +486,8 @@ Flow *FlowGetFlowFromHash (Packet *p)
         fb->head = f;
         fb->tail = f;
 
+        FlowReference(&p->flow, f);
+
         /* got one, now lock, initialize and return */
         FlowInit(f,p);
         f->fb = fb;
@@ -523,6 +523,8 @@ Flow *FlowGetFlowFromHash (Packet *p)
 
                 f->hprev = pf;
 
+                FlowReference(&p->flow, f);
+
                 /* initialize and return */
                 FlowInit(f,p);
                 f->fb = fb;
@@ -550,8 +552,9 @@ Flow *FlowGetFlowFromHash (Packet *p)
                 fb->head->hprev = f;
                 fb->head = f;
 
+                FlowReference(&p->flow, f);
+
                 /* found our flow, lock & return */
-                FlowIncrUsecnt(f);
                 FLOWLOCK_WRLOCK(f);
                 FBLOCK_UNLOCK(fb);
                 FlowHashCountUpdate;
@@ -561,7 +564,7 @@ Flow *FlowGetFlowFromHash (Packet *p)
     }
 
     /* lock & return */
-    FlowIncrUsecnt(f);
+    FlowReference(&p->flow, f);
     FLOWLOCK_WRLOCK(f);
     FBLOCK_UNLOCK(fb);
     FlowHashCountUpdate;
diff --git a/src/flow-timeout.c b/src/flow-timeout.c
index fc6f41249c..c3b15cc119 100644
--- a/src/flow-timeout.c
+++ b/src/flow-timeout.c
@@ -113,8 +113,7 @@ static inline Packet *FlowForceReassemblyPseudoPacketSetup(Packet *p,
 {
     p->datalink = DLT_RAW;
     p->proto = IPPROTO_TCP;
-    p->flow = f;
-    FlowIncrUsecnt(f);
+    FlowReference(&p->flow, f);
     p->flags |= PKT_STREAM_EST;
     p->flags |= PKT_STREAM_EOF;
     p->flags |= PKT_HAS_FLOW;
diff --git a/src/flow-util.h b/src/flow-util.h
index a44a553a8d..21768bd327 100644
--- a/src/flow-util.h
+++ b/src/flow-util.h
@@ -127,14 +127,18 @@
 #define FLOW_CHECK_MEMCAP(size) \
     ((((uint64_t)SC_ATOMIC_GET(flow_memuse) + (uint64_t)(size)) <= flow_config.memcap))
 
-#define FlowReference(dst_f_ptr, f) do {        \
-        FlowIncrUsecnt((f));                    \
-        *(dst_f_ptr) = f;                       \
+#define FlowReference(dst_f_ptr, f) do {            \
+        if ((f) != NULL) {                          \
+            FlowIncrUsecnt((f));                    \
+            *(dst_f_ptr) = f;                       \
+        }                                           \
     } while (0)
 
-#define FlowDeReference(src_f_ptr) do {           \
-        FlowDecrUsecnt(*(src_f_ptr));   \
-        *(src_f_ptr) = NULL;                      \
+#define FlowDeReference(src_f_ptr) do {               \
+        if (*(src_f_ptr) != NULL) {                   \
+            FlowDecrUsecnt(*(src_f_ptr));             \
+            *(src_f_ptr) = NULL;                      \
+        }                                             \
     } while (0)
 
 Flow *FlowAlloc(void);
diff --git a/src/flow.c b/src/flow.c
index 0a8462ce57..ad9931c1b6 100644
--- a/src/flow.c
+++ b/src/flow.c
@@ -310,7 +310,6 @@ void FlowHandlePacket (ThreadVars *tv, Packet *p)
     FLOWLOCK_UNLOCK(f);
 
     /* set the flow in the packet */
-    p->flow = f;
     p->flags |= PKT_HAS_FLOW;
     return;
 }
diff --git a/src/stream-tcp-reassemble.c b/src/stream-tcp-reassemble.c
index 9347c14509..78ae7b052e 100644
--- a/src/stream-tcp-reassemble.c
+++ b/src/stream-tcp-reassemble.c
@@ -1714,11 +1714,9 @@ static void StreamTcpSetupMsg(TcpSession *ssn, TcpStream *stream, Packet *p,
     }
 
     smsg->data.data_len = 0;
-    smsg->flow = p->flow;
+    FlowReference(&smsg->flow, p->flow);
     BUG_ON(smsg->flow == NULL);
 
-    FlowIncrUsecnt(smsg->flow);
-
     SCLogDebug("smsg %p", smsg);
     SCReturn;
 }
diff --git a/src/stream-tcp.c b/src/stream-tcp.c
index 596928f013..55cfde7d15 100644
--- a/src/stream-tcp.c
+++ b/src/stream-tcp.c
@@ -4494,9 +4494,7 @@ Packet *StreamTcpPseudoSetup(Packet *parent, uint8_t *pkt, uint32_t len)
     p->ts.tv_sec = parent->ts.tv_sec;
     p->ts.tv_usec = parent->ts.tv_usec;
 
-    p->flow = parent->flow;
-    FlowIncrUsecnt(p->flow);
-
+    FlowReference(&p->flow, parent->flow);
     /* set tunnel flags */
 
     /* tell new packet it's part of a tunnel */