diff --git a/bad_query/ContentView.swift b/bad_query/ContentView.swift
index 242691f..49085ba 100644
--- a/bad_query/ContentView.swift
+++ b/bad_query/ContentView.swift
@@ -108,6 +108,7 @@ struct ContentView: View {
     func replace(source: URL) throws {
         log.append("\nattempting replace mobilegestalt cache...")
         let accessed = source.startAccessingSecurityScopedResource()
+        defer { if accessed { source.stopAccessingSecurityScopedResource() } }
         if !accessed {
             log.append("\nfailed to access replacement?")
             throw NSError(domain: "sbhaxx", code: 2)
diff --git a/bad_query/bad_query.c b/bad_query/bad_query.c
index dce2c4d..4e85344 100644
--- a/bad_query/bad_query.c
+++ b/bad_query/bad_query.c
@@ -148,6 +148,8 @@ void bad_query_release(int64_t handle) {
 // I'm including it here because it's very useful in the context of this sandbox escape, which can't access parent directories (most of the time)
 // This enumerates all directories in a given path, so you can, for example, get all container UUIDs, read their container metadata to get their bundle ID, and derive that entirely on-device without a computer
 char *bad_query_list(char *path, int64_t max_inode) {
+    if (!path || !*path) return NULL;
+    if (max_inode <= 0 || max_inode > 0xFFFFFFFF) max_inode = 0xFFFFFFFF;
     struct statfs sfs;
     if (statfs(path, &sfs) != 0) return NULL;
     fsid_t fsid = sfs.f_fsid;