diff --git a/source3/modules/vfs_default.c b/source3/modules/vfs_default.c
index a30f3ba1d31..a67f5fddbd4 100644
--- a/source3/modules/vfs_default.c
+++ b/source3/modules/vfs_default.c
@@ -780,6 +780,7 @@ static ssize_t vfswrap_pwrite(vfs_handle_struct *handle, files_struct *fsp, cons
 }
 
 struct vfswrap_pread_state {
+	struct tevent_req *req;
 	ssize_t ret;
 	int fd;
 	void *buf;
@@ -809,6 +810,7 @@ static struct tevent_req *vfswrap_pread_send(struct vfs_handle_struct *handle,
 		return NULL;
 	}
 
+	state->req = req;
 	state->ret = -1;
 	state->fd = fsp->fh->fd;
 	state->buf = data;
@@ -825,7 +827,7 @@ static struct tevent_req *vfswrap_pread_send(struct vfs_handle_struct *handle,
 	if (tevent_req_nomem(subreq, req)) {
 		return tevent_req_post(req, ev);
 	}
-	tevent_req_set_callback(subreq, vfs_pread_done, req);
+	tevent_req_set_callback(subreq, vfs_pread_done, state);
 
 	talloc_set_destructor(state, vfs_pread_state_destructor);
 
@@ -861,21 +863,26 @@ static void vfs_pread_do(void *private_data)
 
 static int vfs_pread_state_destructor(struct vfswrap_pread_state *state)
 {
+	state->req = NULL;
 	return -1;
 }
 
 static void vfs_pread_done(struct tevent_req *subreq)
 {
-	struct tevent_req *req = tevent_req_callback_data(
-		subreq, struct tevent_req);
-	struct vfswrap_pread_state *state = tevent_req_data(
-		req, struct vfswrap_pread_state);
+	struct vfswrap_pread_state *state = tevent_req_callback_data(
+		subreq, struct vfswrap_pread_state);
+	struct tevent_req *req = state->req;
 	int ret;
 
 	ret = pthreadpool_tevent_job_recv(subreq);
 	TALLOC_FREE(subreq);
 	SMBPROFILE_BYTES_ASYNC_END(state->profile_bytes);
 	talloc_set_destructor(state, NULL);
+	if (req == NULL) {
+		/* We were shutdown closed in flight. */
+		TALLOC_FREE(state);
+		return;
+	}
 	if (ret != 0) {
 		if (ret != EAGAIN) {
 			tevent_req_error(req, ret);