diff --git a/reactos/drivers/lib/ip/transport/tcp/accept.c b/reactos/drivers/lib/ip/transport/tcp/accept.c
index 40287184187..52b7097f6e1 100644
--- a/reactos/drivers/lib/ip/transport/tcp/accept.c
+++ b/reactos/drivers/lib/ip/transport/tcp/accept.c
@@ -109,16 +109,16 @@ VOID TCPAbortListenForSocket( PCONNECTION_ENDPOINT Listener,
     
     TcpipRecursiveMutexEnter( &TCPLock, TRUE );
     
-    for( ListEntry = Listener->ListenRequest.Flink;
-	 ListEntry != &Listener->ListenRequest;
-	 ListEntry = ListEntry->Flink ) {
+    ListEntry = Listener->ListenRequest.Flink;
+    while ( ListEntry != &Listener->ListenRequest ) {
 	Bucket = CONTAINING_RECORD(ListEntry, TDI_BUCKET, Entry);
+	ListEntry = ListEntry->Flink;
 
-	if( Bucket->Request.Handle.ConnectionContext == Connection ) {
+	if( Bucket->AssociatedEndpoint == Connection ) {
 #ifdef MEMTRACK
 	    UntrackFL( __FILE__, __LINE__, Bucket->Request.RequestContext );
 #endif
-	    RemoveEntryList( ListEntry );
+	    RemoveEntryList( ListEntry->Blink );
 	    ExFreePool( Bucket );
 	}
     }
diff --git a/reactos/drivers/net/afd/afd/listen.c b/reactos/drivers/net/afd/afd/listen.c
index 26ef02e0fe7..ad725959255 100644
--- a/reactos/drivers/net/afd/afd/listen.c
+++ b/reactos/drivers/net/afd/afd/listen.c
@@ -80,6 +80,11 @@ NTSTATUS DDKAPI ListenComplete
     PAFD_FCB FCB = (PAFD_FCB)Context;
     PAFD_TDI_OBJECT_QELT Qelt;
 
+    if ( Irp->Cancel ) {
+	/* FIXME: is this anything else we need to do? */
+	return STATUS_SUCCESS;
+    }
+
     if( !SocketAcquireStateLock( FCB ) ) return Status;
 
     FCB->ListenIrp.InFlightRequest = NULL;
diff --git a/reactos/drivers/net/tcpip/tcpip/dispatch.c b/reactos/drivers/net/tcpip/tcpip/dispatch.c
index 378f2665c38..ec417f99b36 100644
--- a/reactos/drivers/net/tcpip/tcpip/dispatch.c
+++ b/reactos/drivers/net/tcpip/tcpip/dispatch.c
@@ -219,6 +219,52 @@ VOID DDKAPI DispCancelRequest(
 }
 
 
+VOID DDKAPI DispCancelListenRequest(
+    PDEVICE_OBJECT Device,
+    PIRP Irp)
+/*
+ * FUNCTION: Cancels a listen IRP
+ * ARGUMENTS:
+ *     Device = Pointer to device object
+ *     Irp    = Pointer to an I/O request packet
+ */
+{
+    PIO_STACK_LOCATION IrpSp;
+    PTRANSPORT_CONTEXT TranContext;
+    PFILE_OBJECT FileObject;
+    PCONNECTION_ENDPOINT Connection;
+    /*NTSTATUS Status = STATUS_SUCCESS;*/
+
+    TI_DbgPrint(DEBUG_IRP, ("Called.\n"));
+
+    IrpSp         = IoGetCurrentIrpStackLocation(Irp);
+    FileObject    = IrpSp->FileObject;
+    TranContext   = (PTRANSPORT_CONTEXT)FileObject->FsContext;
+    ASSERT( TDI_LISTEN == IrpSp->MinorFunction);
+
+    TI_DbgPrint(DEBUG_IRP, ("IRP at (0x%X).\n", Irp));
+
+#ifdef DBG
+    if (!Irp->Cancel)
+        TI_DbgPrint(MIN_TRACE, ("Irp->Cancel is FALSE, should be TRUE.\n"));
+#endif
+
+    /* Try canceling the request */
+    Connection = (PCONNECTION_ENDPOINT)TranContext->Handle.ConnectionContext;
+    TCPAbortListenForSocket(
+	    Connection->AddressFile->Listener,
+	    Connection );
+
+    IoReleaseCancelSpinLock(Irp->CancelIrql);
+
+    DispDataRequestComplete(Irp, STATUS_CANCELLED, 0);
+    
+    DispCancelComplete(FileObject);
+
+    TI_DbgPrint(MAX_TRACE, ("Leaving.\n"));
+}
+
+
 NTSTATUS DispTdiAccept(
   PIRP Irp)
 /*
@@ -536,6 +582,12 @@ NTSTATUS DispTdiListen(
 	  Status = TCPListen( Connection->AddressFile->Listener, 1024 ); 
 	  /* BACKLOG */
   }
+  if( NT_SUCCESS(Status) ) {
+      Status = DispPrepareIrpForCancel
+          (TranContext->Handle.ConnectionContext, 
+           Irp, 
+           (PDRIVER_CANCEL)DispCancelListenRequest);
+  }
 
   if( NT_SUCCESS(Status) ) {
       Status = TCPAccept