diff --git a/tests/api/test_tls_bounds.c b/tests/api/test_tls_bounds.c
index da3befb378..7c0456ebae 100644
--- a/tests/api/test_tls_bounds.c
+++ b/tests/api/test_tls_bounds.c
@@ -1466,6 +1466,8 @@ int test_ProcessChainOCSPRequest_bounds(void)
     ExpectNotNull(ssl = wolfSSL_new(ctx));
     if (ssl != NULL) {
         TLSX* ext = NULL;
+        DerBuffer* savedCert = ssl->buffers.certificate;
+        DerBuffer* savedChain = ssl->buffers.certChain;
         ExpectIntEQ(TLSX_UseCertificateStatusRequest(&ssl->extensions,
                     WOLFSSL_CSR_OCSP, 0, ssl, ssl->heap, ssl->devId),
                     WOLFSSL_SUCCESS);
@@ -1475,10 +1477,14 @@ int test_ProcessChainOCSPRequest_bounds(void)
         /* A certificate had to be loaded for wolfSSL_new() to succeed (see
          * test_tls_bounds_load_server_cert()); clear both buffers back to
          * NULL so ProcessChainOCSPRequest() sees exactly the "chain ==
-         * NULL" state under test. */
+         * NULL" state under test. The SSL owns these buffers (weOwnCert),
+         * so save and restore them - nulling them outright leaked the DER
+         * copy that wolfSSL_new() allocated. */
         ssl->buffers.certChain = NULL;
         ssl->buffers.certificate = NULL;
         ExpectIntEQ(ProcessChainOCSPRequest(ssl), 0);
+        ssl->buffers.certificate = savedCert;
+        ssl->buffers.certChain = savedChain;
     }
     wolfSSL_free(ssl);
     ssl = NULL;
diff --git a/wolfcrypt/src/memory.c b/wolfcrypt/src/memory.c
index 4c02e3f200..bba2808724 100644
--- a/wolfcrypt/src/memory.c
+++ b/wolfcrypt/src/memory.c
@@ -162,6 +162,19 @@ static int wc_MemFailCount_AllocMem(void)
 
     return ret;
 }
+/* An allocation was counted by wc_MemFailCount_AllocMem() above, but the
+ * underlying allocator then returned NULL (a caller-installed failing
+ * allocator via wolfSSL_SetAllocators(), or a genuine out-of-memory). No
+ * block exists to be freed, so undo the count to keep Total (allocs)
+ * balanced with Frees. */
+static void wc_MemFailCount_AllocFailed(void)
+{
+    wc_LockMutex(&memFailMutex);
+    if (mem_fail_allocs > 0) {
+        mem_fail_allocs--;
+    }
+    wc_UnLockMutex(&memFailMutex);
+}
 static void wc_MemFailCount_FreeMem(void)
 {
     wc_LockMutex(&memFailMutex);
@@ -406,10 +419,19 @@ void* wolfSSL_Malloc(size_t size)
             free(res); /* native heap */
         }
         gMemFailCount = gMemFailCountSeed; /* reset */
+    #ifdef WOLFSSL_MEM_FAIL_COUNT
+        wc_MemFailCount_AllocFailed();
+    #endif
         return NULL;
     }
 #endif
 
+#ifdef WOLFSSL_MEM_FAIL_COUNT
+    if (res == NULL) {
+        wc_MemFailCount_AllocFailed();
+    }
+#endif
+
     return res;
 }