diff --git a/src/mux_fcgi.c b/src/mux_fcgi.c
index ba736f371..45b546f01 100644
--- a/src/mux_fcgi.c
+++ b/src/mux_fcgi.c
@@ -3061,15 +3061,22 @@ struct task *fcgi_io_cb(struct task *t, void *ctx, unsigned int state)
 		conn = fconn->conn;
 		TRACE_POINT(FCGI_EV_FCONN_WAKE, conn);
 
-		conn_in_list = conn->flags & (CO_FL_LIST_MASK|CO_FL_SESS_IDLE);
-		if (conn_in_list) {
-			if (conn->flags & CO_FL_SESS_IDLE) {
-				if (!session_detach_idle_conn(conn->owner, conn))
-					conn_in_list = 0;
-			}
-			else {
-				conn_delete_from_tree(conn, tid);
-			}
+		/* Remove the connection from the list, to be sure nobody attempts
+		 * to use it while we handle the I/O events
+		 */
+		if (LIST_INLIST(&conn->idle_list)) {
+			conn_in_list = 1;
+			BUG_ON(!(conn->flags & CO_FL_LIST_MASK));
+			conn_delete_from_tree(conn, tid);
+		}
+		else if (LIST_INLIST(&conn->sess_el)) {
+			conn_in_list = 1;
+			BUG_ON(!(conn->flags & CO_FL_SESS_IDLE));
+			/* session_detach_idle_conn cannot fail thanks to LIST_INLIST() above test */
+			session_detach_idle_conn(conn->owner, conn);
+		}
+		else {
+			conn_in_list = 0;
 		}
 
 		HA_SPIN_UNLOCK(IDLE_CONNS_LOCK, &idle_conns[tid].idle_conns_lock);
@@ -3106,8 +3113,8 @@ struct task *fcgi_io_cb(struct task *t, void *ctx, unsigned int state)
 				}
 			}
 			else {
-				ASSUME_NONNULL(srv); /* srv is guaranteed by CO_FL_LIST_MASK */
-				srv_add_idle(srv, conn, conn_in_list == CO_FL_SAFE_LIST);
+				ASSUME_NONNULL(srv); /* srv is guaranteed to be non-null if conn is in idle list */
+				srv_add_idle(srv, conn, (conn->flags & CO_FL_LIST_MASK) == CO_FL_SAFE_LIST);
 			}
 		}
 		else {
diff --git a/src/mux_h1.c b/src/mux_h1.c
index 60862fc57..30dcb6086 100644
--- a/src/mux_h1.c
+++ b/src/mux_h1.c
@@ -4342,15 +4342,19 @@ struct task *h1_io_cb(struct task *t, void *ctx, unsigned int state)
 		/* Remove the connection from the list, to be sure nobody attempts
 		 * to use it while we handle the I/O events
 		 */
-		conn_in_list = conn->flags & (CO_FL_LIST_MASK|CO_FL_SESS_IDLE);
-		if (conn_in_list) {
-			if (conn->flags & CO_FL_SESS_IDLE) {
-				if (!session_detach_idle_conn(conn->owner, conn))
-					conn_in_list = 0;
-			}
-			else {
-				conn_delete_from_tree(conn, tid);
-			}
+		if (LIST_INLIST(&conn->idle_list)) {
+			conn_in_list = 1;
+			BUG_ON(!(conn->flags & CO_FL_LIST_MASK));
+			conn_delete_from_tree(conn, tid);
+		}
+		else if (LIST_INLIST(&conn->sess_el)) {
+			conn_in_list = 1;
+			BUG_ON(!(conn->flags & CO_FL_SESS_IDLE));
+			/* session_detach_idle_conn cannot fail thanks to LIST_INLIST() above test */
+			session_detach_idle_conn(conn->owner, conn);
+		}
+		else {
+			conn_in_list = 0;
 		}
 
 		HA_SPIN_UNLOCK(IDLE_CONNS_LOCK, &idle_conns[tid].idle_conns_lock);
@@ -4387,8 +4391,8 @@ struct task *h1_io_cb(struct task *t, void *ctx, unsigned int state)
 				}
 			}
 			else {
-				ASSUME_NONNULL(srv); /* srv is guaranteed by CO_FL_LIST_MASK */
-				srv_add_idle(srv, conn, conn_in_list == CO_FL_SAFE_LIST);
+				ASSUME_NONNULL(srv); /* srv is guaranteed to be non-null if conn is in idle list */
+				srv_add_idle(srv, conn, (conn->flags & CO_FL_LIST_MASK) == CO_FL_SAFE_LIST);
 			}
 		}
 		else {
diff --git a/src/mux_h2.c b/src/mux_h2.c
index 963aa1a8a..006670810 100644
--- a/src/mux_h2.c
+++ b/src/mux_h2.c
@@ -4978,19 +4978,24 @@ struct task *h2_io_cb(struct task *t, void *ctx, unsigned int state)
 		/* Remove the connection from the list, to be sure nobody attempts
 		 * to use it while we handle the I/O events
 		 */
-		conn_in_list = conn->flags & (CO_FL_LIST_MASK|CO_FL_SESS_IDLE);
-		if (conn_in_list) {
-			if (conn->flags & CO_FL_SESS_IDLE) {
-				if (!session_detach_idle_conn(conn->owner, conn))
-					conn_in_list = 0;
-			}
-			else {
-				conn_delete_from_tree(conn, tid);
-			}
+		if (LIST_INLIST(&conn->idle_list)) {
+			conn_in_list = 1;
+			BUG_ON(!(conn->flags & CO_FL_LIST_MASK));
+			conn_delete_from_tree(conn, tid);
+		}
+		else if (LIST_INLIST(&conn->sess_el)) {
+			conn_in_list = 1;
+			BUG_ON(!(conn->flags & CO_FL_SESS_IDLE));
+			/* session_detach_idle_conn cannot fail thanks to LIST_INLIST() above test */
+			session_detach_idle_conn(conn->owner, conn);
+		}
+		else {
+			conn_in_list = 0;
 		}
 
 		HA_SPIN_UNLOCK(IDLE_CONNS_LOCK, &idle_conns[tid].idle_conns_lock);
-	} else {
+	}
+	else {
 		/* we're certain the connection was not in an idle list */
 		conn = h2c->conn;
 		TRACE_ENTER(H2_EV_H2C_WAKE, conn);
@@ -5026,8 +5031,8 @@ struct task *h2_io_cb(struct task *t, void *ctx, unsigned int state)
 				}
 			}
 			else {
-				ASSUME_NONNULL(srv); /* srv is guaranteed by CO_FL_LIST_MASK */
-				srv_add_idle(srv, conn, conn_in_list == CO_FL_SAFE_LIST);
+				ASSUME_NONNULL(srv); /* srv is guaranteed to be non-null if conn is in idle list */
+				srv_add_idle(srv, conn, (conn->flags & CO_FL_LIST_MASK) == CO_FL_SAFE_LIST);
 			}
 		}
 		else {
diff --git a/src/mux_quic.c b/src/mux_quic.c
index da471cc57..43c681394 100644
--- a/src/mux_quic.c
+++ b/src/mux_quic.c
@@ -3399,12 +3399,19 @@ struct task *qcc_io_cb(struct task *t, void *ctx, unsigned int state)
 		/* Remove the connection from the list, to be sure nobody attempts
 		 * to use it while we handle the I/O events
 		 */
-		conn_in_list = conn->flags & (CO_FL_LIST_MASK|CO_FL_SESS_IDLE);
-		if (conn_in_list) {
-			if (conn->flags & CO_FL_SESS_IDLE)
-				session_detach_idle_conn(conn->owner, conn);
-			else
-				conn_delete_from_tree(conn, tid);
+		if (LIST_INLIST(&conn->idle_list)) {
+			conn_in_list = 1;
+			BUG_ON(!(conn->flags & CO_FL_LIST_MASK));
+			conn_delete_from_tree(conn, tid);
+		}
+		else if (LIST_INLIST(&conn->sess_el)) {
+			conn_in_list = 1;
+			BUG_ON(!(conn->flags & CO_FL_SESS_IDLE));
+			/* session_detach_idle_conn cannot fail thanks to LIST_INLIST() above test */
+			session_detach_idle_conn(conn->owner, conn);
+		}
+		else {
+			conn_in_list = 0;
 		}
 
 		HA_SPIN_UNLOCK(IDLE_CONNS_LOCK, &idle_conns[tid].idle_conns_lock);
@@ -3448,7 +3455,7 @@ struct task *qcc_io_cb(struct task *t, void *ctx, unsigned int state)
 			}
 		}
 		else {
-			srv_add_idle(srv, conn, conn_in_list == CO_FL_SAFE_LIST);
+			srv_add_idle(srv, conn, (conn->flags & CO_FL_LIST_MASK) == CO_FL_SAFE_LIST);
 		}
 
 		/* Do not access conn without protection as soon as it is reinserted in idle list. */
diff --git a/src/mux_spop.c b/src/mux_spop.c
index 1307ff6e0..57686838e 100644
--- a/src/mux_spop.c
+++ b/src/mux_spop.c
@@ -2557,15 +2557,22 @@ static struct task *spop_io_cb(struct task *t, void *ctx, unsigned int state)
 		conn = spop_conn->conn;
 		TRACE_POINT(SPOP_EV_SPOP_CONN_WAKE, conn);
 
-		conn_in_list = conn->flags & (CO_FL_LIST_MASK|CO_FL_SESS_IDLE);
-		if (conn_in_list) {
-			if (conn->flags & CO_FL_SESS_IDLE) {
-				if (!session_detach_idle_conn(conn->owner, conn))
-					conn_in_list = 0;
-			}
-			else {
-				conn_delete_from_tree(conn, tid);
-			}
+		/* Remove the connection from the list, to be sure nobody attempts
+		 * to use it while we handle the I/O events
+		 */
+		if (LIST_INLIST(&conn->idle_list)) {
+			conn_in_list = 1;
+			BUG_ON(!(conn->flags & CO_FL_LIST_MASK));
+			conn_delete_from_tree(conn, tid);
+		}
+		else if (LIST_INLIST(&conn->sess_el)) {
+			conn_in_list = 1;
+			BUG_ON(!(conn->flags & CO_FL_SESS_IDLE));
+			/* session_detach_idle_conn cannot fail thanks to LIST_INLIST() above test */
+			session_detach_idle_conn(conn->owner, conn);
+		}
+		else {
+			conn_in_list = 0;
 		}
 
 		HA_SPIN_UNLOCK(IDLE_CONNS_LOCK, &idle_conns[tid].idle_conns_lock);
@@ -2602,8 +2609,8 @@ static struct task *spop_io_cb(struct task *t, void *ctx, unsigned int state)
 				}
 			}
 			else {
-				ASSUME_NONNULL(srv); /* srv is guaranteed by CO_FL_LIST_MASK */
-				srv_add_idle(srv, conn, conn_in_list == CO_FL_SAFE_LIST);
+				ASSUME_NONNULL(srv); /* srv is guaranteed to be non-null if conn is in idle list */
+				srv_add_idle(srv, conn, (conn->flags & CO_FL_LIST_MASK) == CO_FL_SAFE_LIST);
 			}
 		}
 		else {