@@ -163,10 +163,12 @@
 InfoCallback(CONST SSL *ssl, int where, int ret)
 {
     State *statePtr = (State*)SSL_get_app_data((SSL *)ssl);
     Tcl_Obj *cmdPtr;
     char *major; char *minor;
+
+    dprintf("Called");
 
     if (statePtr->callback == (Tcl_Obj*)NULL)
 	return;
 
     cmdPtr = Tcl_DuplicateObj(statePtr->callback);
@@ -349,10 +351,12 @@
 void
 Tls_Error(State *statePtr, char *msg)
 {
     Tcl_Obj *cmdPtr;
 
+    dprintf("Called");
+
     if (msg && *msg) {
 	Tcl_SetErrorCode(statePtr->interp, "SSL", msg, (char *)NULL);
     } else {
 	msg = Tcl_GetStringFromObj(Tcl_GetObjResult(statePtr->interp), NULL);
     }
@@ -416,10 +420,12 @@
 {
     State *statePtr	= (State *) udata;
     Tcl_Interp *interp	= statePtr->interp;
     Tcl_Obj *cmdPtr;
     int result;
+
+    dprintf("Called");
 
     if (statePtr->password == NULL) {
 	if (Tcl_EvalEx(interp, "tls::password", -1, TCL_EVAL_GLOBAL)
 		== TCL_OK) {
 	    char *ret = (char *) Tcl_GetStringResult(interp);
@@ -488,10 +494,12 @@
     SSL_CTX *ctx = NULL;
     SSL *ssl = NULL;
     STACK_OF(SSL_CIPHER) *sk;
     char *cp, buf[BUFSIZ];
     int index, verbose = 0;
+
+    dprintf("Called");
 
     if (objc < 2 || objc > 3) {
 	Tcl_WrongNumArgs(interp, 1, objv, "protocol ?verbose?");
 	return TCL_ERROR;
     }
@@ -613,10 +621,12 @@
 {
     Tcl_Channel chan;		/* The channel to set a mode on. */
     State *statePtr;		/* client state for ssl socket */
     int ret = 1;
 
+    dprintf("Called");
+
     if (objc != 2) {
 	Tcl_WrongNumArgs(interp, 1, objv, "channel");
 	return TCL_ERROR;
     }
 
@@ -654,12 +664,12 @@
 
 	    if (!errStr || *errStr == 0) {
 		errStr = Tcl_PosixError(interp);
 	    }
 
-	    Tcl_AppendResult(interp, "handshake failed: ", errStr,
-		    (char *) NULL);
+	    Tcl_AppendResult(interp, "handshake failed: ", errStr, (char *) NULL);
+            dprintf("Returning TCL_ERROR with handshake failed: %s", errStr);
 	    return TCL_ERROR;
 	}
     }
 
     Tcl_SetObjResult(interp, Tcl_NewIntObj(ret));
@@ -734,10 +744,12 @@
 #else
     int tls1_2 = 1;
 #endif
     int proto = 0;
     int verify = 0, require = 0, request = 1;
+
+    dprintf("Called");
 
     if (objc < 2) {
 	Tcl_WrongNumArgs(interp, 1, objv, "channel ?options?");
 	return TCL_ERROR;
     }
@@ -864,11 +876,13 @@
      * encryption not to get goofed up).
      * We only want to adjust the buffering in pre-v2 channels, where
      * each channel in the stack maintained its own buffers.
      */
     Tcl_SetChannelOption(interp, chan, "-translation", "binary");
+    dprintf("Consuming Tcl channel %s", Tcl_GetChannelName(chan));
     statePtr->self = Tcl_StackChannel(interp, Tls_ChannelType(), (ClientData) statePtr, (TCL_READABLE | TCL_WRITABLE), chan);
+    dprintf("Created channel named %s", Tcl_GetChannelName(statePtr->self));
     if (statePtr->self == (Tcl_Channel) NULL) {
 	/*
 	 * No use of Tcl_EventuallyFree because no possible Tcl_Preserve.
 	 */
 	Tls_Free((char *) statePtr);
@@ -908,11 +922,11 @@
     SSL_set_verify(statePtr->ssl, verify, VerifyCallback);
 
     SSL_CTX_set_info_callback(statePtr->ctx, InfoCallback);
 
     /* Create Tcl_Channel BIO Handler */
-    statePtr->p_bio	= BIO_new_tcl(statePtr, BIO_CLOSE);
+    statePtr->p_bio	= BIO_new_tcl(statePtr, BIO_NOCLOSE);
     statePtr->bio	= BIO_new(BIO_f_ssl());
 
     if (server) {
 	statePtr->flags |= TLS_TCL_SERVER;
 	SSL_set_accept_state(statePtr->ssl);
@@ -923,10 +937,11 @@
     BIO_set_ssl(statePtr->bio, statePtr->ssl, BIO_NOCLOSE);
 
     /*
      * End of SSL Init
      */
+    dprintf("Returning %s", Tcl_GetChannelName(statePtr->self));
     Tcl_SetResult(interp, (char *) Tcl_GetChannelName(statePtr->self),
 	    TCL_VOLATILE);
     return TCL_OK;
 }
 
@@ -952,10 +967,12 @@
     Tcl_Interp *interp;
     int objc;
     Tcl_Obj *CONST objv[];
 {
     Tcl_Channel chan;		/* The channel to set a mode on. */
+
+    dprintf("Called");
 
     if (objc != 2) {
 	Tcl_WrongNumArgs(interp, 1, objv, "channel");
 	return TCL_ERROR;
     }
@@ -1012,10 +1029,12 @@
     SSL_CTX *ctx = NULL;
     Tcl_DString ds;
     Tcl_DString ds1;
     int off = 0;
     const SSL_METHOD *method;
+
+    dprintf("Called");
 
     if (!proto) {
 	Tcl_AppendResult(interp, "no valid protocol selected", NULL);
 	return (SSL_CTX *)0;
     }
@@ -1262,10 +1281,12 @@
     Tcl_Obj *objPtr;
     Tcl_Channel chan;
     char *channelName, *ciphers;
     int mode;
 
+    dprintf("Called");
+
     switch (objc) {
 	case 2:
 	    channelName = Tcl_GetStringFromObj(objv[1], NULL);
 	    break;
 
@@ -1341,10 +1362,12 @@
     Tcl_Interp *interp;
     int objc;
     Tcl_Obj	*CONST objv[];
 {
     Tcl_Obj *objPtr;
+
+    dprintf("Called");
 
     objPtr = Tcl_NewStringObj(OPENSSL_VERSION_TEXT, -1);
 
     Tcl_SetObjResult(interp, objPtr);
     return TCL_OK;
@@ -1371,10 +1394,12 @@
     Tcl_Obj	*CONST objv[];
 {
     static CONST84 char *commands [] = { "req", NULL };
     enum command { C_REQ, C_DUMMY };
     int cmd;
+
+    dprintf("Called");
 
     if (objc < 2) {
 	Tcl_WrongNumArgs(interp, 1, objv, "subcommand ?args?");
 	return TCL_ERROR;
     }
@@ -1530,10 +1555,12 @@
  */
 void
 Tls_Free( char *blockPtr )
 {
     State *statePtr = (State *)blockPtr;
+
+    dprintf("Called");
 
     Tls_Clean(statePtr);
     ckfree(blockPtr);
 }
 
@@ -1553,17 +1580,16 @@
  * Side effects:
  *	Frees all the state
  *
  *-------------------------------------------------------------------
  */
-void
-Tls_Clean(State *statePtr)
-{
+void Tls_Clean(State *statePtr) {
+    dprintf("Called");
+
     /*
      * we're assuming here that we're single-threaded
      */
-
     if (statePtr->timer != (Tcl_TimerToken) NULL) {
 	Tcl_DeleteTimerHandler(statePtr->timer);
 	statePtr->timer = NULL;
     }
 
@@ -1588,10 +1614,12 @@
     }
     if (statePtr->password) {
 	Tcl_DecrRefCount(statePtr->password);
 	statePtr->password = NULL;
     }
+
+    dprintf("Returning");
 }
 
 /*
  *-------------------------------------------------------------------
  *
@@ -1609,11 +1637,14 @@
  */
 
 int Tls_Init(Tcl_Interp *interp) {
 	const char tlsTclInitScript[] = {
 #include "tls.tcl.h"
+            , 0x00
 	};
+
+        dprintf("Called");
 
 	/*
 	 * We only support Tcl 8.4 or newer
 	 */
 	if (
@@ -1664,10 +1695,11 @@
  *
  *------------------------------------------------------*
  */
 
 int Tls_SafeInit(Tcl_Interp *interp) {
+	dprintf("Called");
 	return(Tls_Init(interp));
 }
 
 /*
  *------------------------------------------------------*
@@ -1689,12 +1721,15 @@
 static int TlsLibInit(void) {
 	static int initialized = 0;
 	int status = TCL_OK;
 
 	if (initialized) {
+		dprintf("Called, but using cached value");
 		return(status);
 	}
+
+	dprintf("Called");
 
 	initialized = 1;
 
 #if defined(OPENSSL_THREADS) && defined(TCL_THREADS)
 	size_t num_locks;
@@ -1719,10 +1754,12 @@
 		goto done;
 	}
 
 	SSL_load_error_strings();
 	ERR_load_crypto_strings();
+
+	BIO_new_tcl(NULL, 0);
 
 #if 0
 	/*
 	 * XXX:TODO: Remove this code and replace it with a check
 	 * for enough entropy and do not try to create our own