diff --git a/src/include/ipxe/retry.h b/src/include/ipxe/retry.h
index ff26de25..d2ea27fb 100644
--- a/src/include/ipxe/retry.h
+++ b/src/include/ipxe/retry.h
@@ -49,6 +49,12 @@ struct retry_timer {
 	 * timeout has already exceeded @c MAX_TIMEOUT.
 	 */
 	void ( * expired ) ( struct retry_timer *timer, int over );
+	/** Reference counter
+	 *
+	 * If this interface is not part of a reference-counted
+	 * object, this field may be NULL.
+	 */
+	struct refcnt *refcnt;
 };
 
 /**
@@ -56,11 +62,14 @@ struct retry_timer {
  *
  * @v timer		Retry timer
  * @v expired		Timer expired callback
+ * @v refcnt		Reference counter, or NULL
  */
 static inline __attribute__ (( always_inline )) void
 timer_init ( struct retry_timer *timer,
-	     void ( * expired ) ( struct retry_timer *timer, int over ) ) {
+	     void ( * expired ) ( struct retry_timer *timer, int over ),
+	     struct refcnt *refcnt ) {
 	timer->expired = expired;
+	timer->refcnt = refcnt;
 }
 
 extern void start_timer ( struct retry_timer *timer );
diff --git a/src/net/aoe.c b/src/net/aoe.c
index 4a03e2b6..5e1a3b5b 100644
--- a/src/net/aoe.c
+++ b/src/net/aoe.c
@@ -439,7 +439,7 @@ int aoe_attach ( struct ata_device *ata, struct net_device *netdev,
 	if ( ! aoe )
 		return -ENOMEM;
 	ref_init ( &aoe->refcnt, aoe_free );
-	timer_init ( &aoe->timer, aoe_timer_expired );
+	timer_init ( &aoe->timer, aoe_timer_expired, &aoe->refcnt );
 	aoe->netdev = netdev_get ( netdev );
 	memcpy ( aoe->target, netdev->ll_broadcast, sizeof ( aoe->target ) );
 	aoe->tag = AOE_TAG_MAGIC;
diff --git a/src/net/infiniband/ib_mi.c b/src/net/infiniband/ib_mi.c
index 5a01ce25..8c15655f 100644
--- a/src/net/infiniband/ib_mi.c
+++ b/src/net/infiniband/ib_mi.c
@@ -281,7 +281,7 @@ ib_create_madx ( struct ib_device *ibdev, struct ib_mad_interface *mi,
 	madx = zalloc ( sizeof ( *madx ) );
 	if ( ! madx )
 		return NULL;
-	timer_init ( &madx->timer, ib_mi_timer_expired );
+	timer_init ( &madx->timer, ib_mi_timer_expired, NULL );
 	madx->mi = mi;
 	madx->op = op;
 
diff --git a/src/net/ipv4.c b/src/net/ipv4.c
index a3cbdb03..5918bbec 100644
--- a/src/net/ipv4.c
+++ b/src/net/ipv4.c
@@ -222,7 +222,7 @@ static struct io_buffer * ipv4_reassemble ( struct io_buffer * iobuf ) {
 		free_iob ( iobuf );
 
 		/* Set the reassembly timer */
-		timer_init ( &fragbuf->frag_timer, ipv4_frag_expired );
+		timer_init ( &fragbuf->frag_timer, ipv4_frag_expired, NULL );
 		start_timer_fixed ( &fragbuf->frag_timer, IP_FRAG_TIMEOUT );
 
 		/* Add the fragment buffer to the list of fragment buffers */
diff --git a/src/net/retry.c b/src/net/retry.c
index 5eefa3d4..b65bb57e 100644
--- a/src/net/retry.c
+++ b/src/net/retry.c
@@ -57,8 +57,10 @@ static LIST_HEAD ( timers );
  * be stopped and the timer's callback function will be called.
  */
 void start_timer ( struct retry_timer *timer ) {
-	if ( ! timer->running )
+	if ( ! timer->running ) {
 		list_add ( &timer->list, &timers );
+		ref_get ( timer->refcnt );
+	}
 	timer->start = currticks();
 	timer->running = 1;
 
@@ -136,6 +138,8 @@ void stop_timer ( struct retry_timer *timer ) {
 			      timer, timer->timeout );
 		}
 	}
+
+	ref_put ( timer->refcnt );
 }
 
 /**
@@ -164,7 +168,9 @@ static void timer_expired ( struct retry_timer *timer ) {
 	      timer, timer->timeout );
 
 	/* Call expiry callback */
-	timer->expired ( timer, fail );	
+	timer->expired ( timer, fail );
+
+	ref_put ( timer->refcnt );
 }
 
 /**
diff --git a/src/net/tcp.c b/src/net/tcp.c
index b2d88273..1c824bdf 100644
--- a/src/net/tcp.c
+++ b/src/net/tcp.c
@@ -265,8 +265,8 @@ static int tcp_open ( struct interface *xfer, struct sockaddr *peer,
 	DBGC ( tcp, "TCP %p allocated\n", tcp );
 	ref_init ( &tcp->refcnt, NULL );
 	intf_init ( &tcp->xfer, &tcp_xfer_desc, &tcp->refcnt );
-	timer_init ( &tcp->timer, tcp_expired );
-	timer_init ( &tcp->wait, tcp_wait_expired );
+	timer_init ( &tcp->timer, tcp_expired, &tcp->refcnt );
+	timer_init ( &tcp->wait, tcp_wait_expired, &tcp->refcnt );
 	tcp->prev_tcp_state = TCP_CLOSED;
 	tcp->tcp_state = TCP_STATE_SENT ( TCP_SYN );
 	tcp_dump_state ( tcp );
diff --git a/src/net/udp/dhcp.c b/src/net/udp/dhcp.c
index 77d46545..1169abaa 100644
--- a/src/net/udp/dhcp.c
+++ b/src/net/udp/dhcp.c
@@ -1425,7 +1425,7 @@ int start_dhcp ( struct interface *job, struct net_device *netdev ) {
 	ref_init ( &dhcp->refcnt, dhcp_free );
 	intf_init ( &dhcp->job, &dhcp_job_desc, &dhcp->refcnt );
 	intf_init ( &dhcp->xfer, &dhcp_xfer_desc, &dhcp->refcnt );
-	timer_init ( &dhcp->timer, dhcp_timer_expired );
+	timer_init ( &dhcp->timer, dhcp_timer_expired, &dhcp->refcnt );
 	dhcp->netdev = netdev_get ( netdev );
 	dhcp->local.sin_family = AF_INET;
 	dhcp->local.sin_port = htons ( BOOTPC_PORT );
@@ -1528,7 +1528,7 @@ int start_pxebs ( struct interface *job, struct net_device *netdev,
 	ref_init ( &dhcp->refcnt, dhcp_free );
 	intf_init ( &dhcp->job, &dhcp_job_desc, &dhcp->refcnt );
 	intf_init ( &dhcp->xfer, &dhcp_xfer_desc, &dhcp->refcnt );
-	timer_init ( &dhcp->timer, dhcp_timer_expired );
+	timer_init ( &dhcp->timer, dhcp_timer_expired, &dhcp->refcnt );
 	dhcp->netdev = netdev_get ( netdev );
 	dhcp->local.sin_family = AF_INET;
 	fetch_ipv4_setting ( netdev_settings ( netdev ), &ip_setting,
diff --git a/src/net/udp/dns.c b/src/net/udp/dns.c
index 8283e6fb..ddbccc32 100644
--- a/src/net/udp/dns.c
+++ b/src/net/udp/dns.c
@@ -527,7 +527,7 @@ static int dns_resolv ( struct interface *resolv,
 	ref_init ( &dns->refcnt, NULL );
 	intf_init ( &dns->resolv, &dns_resolv_desc, &dns->refcnt );
 	intf_init ( &dns->socket, &dns_socket_desc, &dns->refcnt );
-	timer_init ( &dns->timer, dns_timer_expired );
+	timer_init ( &dns->timer, dns_timer_expired, &dns->refcnt );
 	memcpy ( &dns->sa, sa, sizeof ( dns->sa ) );
 
 	/* Create query */
diff --git a/src/net/udp/slam.c b/src/net/udp/slam.c
index 026bc179..0de138cd 100644
--- a/src/net/udp/slam.c
+++ b/src/net/udp/slam.c
@@ -695,8 +695,10 @@ static int slam_open ( struct interface *xfer, struct uri *uri ) {
 	intf_init ( &slam->xfer, &slam_xfer_desc, &slam->refcnt );
 	intf_init ( &slam->socket, &slam_socket_desc, &slam->refcnt );
 	intf_init ( &slam->mc_socket, &slam_mc_socket_desc, &slam->refcnt );
-	timer_init ( &slam->master_timer, slam_master_timer_expired );
-	timer_init ( &slam->slave_timer, slam_slave_timer_expired );
+	timer_init ( &slam->master_timer, slam_master_timer_expired,
+		     &slam->refcnt );
+	timer_init ( &slam->slave_timer, slam_slave_timer_expired,
+		     &slam->refcnt );
 	/* Fake an invalid cached header of { 0x00, ... } */
 	slam->header_len = 1;
 	/* Fake parameters for initial NACK */
diff --git a/src/net/udp/tftp.c b/src/net/udp/tftp.c
index e8223c99..777632ef 100644
--- a/src/net/udp/tftp.c
+++ b/src/net/udp/tftp.c
@@ -1097,7 +1097,7 @@ static int tftp_core_open ( struct interface *xfer, struct uri *uri,
 	intf_init ( &tftp->xfer, &tftp_xfer_desc, &tftp->refcnt );
 	intf_init ( &tftp->socket, &tftp_socket_desc, &tftp->refcnt );
 	intf_init ( &tftp->mc_socket, &tftp_mc_socket_desc, &tftp->refcnt );
-	timer_init ( &tftp->timer, tftp_timer_expired );
+	timer_init ( &tftp->timer, tftp_timer_expired, &tftp->refcnt );
 	tftp->uri = uri_get ( uri );
 	tftp->blksize = TFTP_DEFAULT_BLKSIZE;
 	tftp->flags = flags;