diff --git a/channels/chan_pjsip.c b/channels/chan_pjsip.c
index 79e7c6e131..74392c419a 100644
--- a/channels/chan_pjsip.c
+++ b/channels/chan_pjsip.c
@@ -1116,14 +1116,17 @@ static int chan_pjsip_devicestate(const char *data)
 static int chan_pjsip_queryoption(struct ast_channel *ast, int option, void *data, int *datalen)
 {
 	struct ast_sip_channel_pvt *channel = ast_channel_tech_pvt(ast);
-	struct ast_sip_session *session = channel->session;
 	int res = -1;
 	enum ast_t38_state state = T38_STATE_UNAVAILABLE;
 
+	if (!channel) {
+		return -1;
+	}
+
 	switch (option) {
 	case AST_OPTION_T38_STATE:
-		if (session->endpoint->media.t38.enabled) {
-			switch (session->t38state) {
+		if (channel->session->endpoint->media.t38.enabled) {
+			switch (channel->session->t38state) {
 			case T38_LOCAL_REINVITE:
 			case T38_PEER_REINVITE:
 				state = T38_STATE_NEGOTIATING;
diff --git a/res/res_fax.c b/res/res_fax.c
index 3f506d4718..645508900a 100644
--- a/res/res_fax.c
+++ b/res/res_fax.c
@@ -3442,6 +3442,15 @@ static struct ast_frame *fax_gateway_framehook(struct ast_channel *chan, struct
 	if (!gateway->bridged) {
 		enum ast_t38_state state_chan;
 		enum ast_t38_state state_peer;
+		int chan_is_hungup;
+		int peer_is_hungup;
+
+		chan_is_hungup = ast_check_hangup(chan);
+		peer_is_hungup = ast_check_hangup(peer);
+		/* Don't start a gateway if either channel is hung up */
+		if (chan_is_hungup || peer_is_hungup) {
+			return f;
+		}
 
 		ast_channel_unlock(chan);
 		state_chan = ast_channel_get_t38_state(chan);