diff --git a/dev/flags/flags.c b/dev/flags/flags.c
index 48d9a8686..b645e35f2 100644
--- a/dev/flags/flags.c
+++ b/dev/flags/flags.c
@@ -3,6 +3,7 @@
 
 #include <haproxy/channel-t.h>
 #include <haproxy/connection-t.h>
+#include <haproxy/conn_stream-t.h>
 #include <haproxy/http_ana-t.h>
 #include <haproxy/stream-t.h>
 #include <haproxy/stream_interface-t.h>
@@ -18,10 +19,11 @@
 #define SHOW_AS_STRM  0x00000040
 #define SHOW_AS_TASK  0x00000080
 #define SHOW_AS_TXN   0x00000100
+#define SHOW_AS_ENDP  0x00000200
 
 // command line names, must be in exact same order as the SHOW_AS_* flags above
 // so that show_as_words[i] matches flag 1U<<i.
-const char *show_as_words[] = { "ana", "chn", "conn", "cs", "si", "siet", "strm", "task", "txn", };
+const char *show_as_words[] = { "ana", "chn", "conn", "cs", "si", "siet", "strm", "task", "txn", "endp", };
 
 #define SHOW_FLAG(f,n)					\
 	do {				 		\
@@ -177,6 +179,22 @@ void show_conn_flags(unsigned int f)
 	}
 	putchar('\n');
 }
+
+void show_endp_flags(unsigned int f)
+{
+	printf("endp->flags = ");
+	if (!f) {
+		printf("0\n");
+		return;
+	}
+	SHOW_FLAG(f, CS_EP_T_APPLET);
+	SHOW_FLAG(f, CS_EP_T_MUX);
+
+	if (f) {
+		printf("EXTRA(0x%08x)", f);
+	}
+	putchar('\n');
+}
 void show_cs_flags(unsigned int f)
 {
 	printf("cs->flags = ");
@@ -184,8 +202,6 @@ void show_cs_flags(unsigned int f)
 		printf("0\n");
 		return;
 	}
-	SHOW_FLAG(f, CS_FL_ENDP_APP);
-	SHOW_FLAG(f, CS_FL_ENDP_MUX);
 	SHOW_FLAG(f, CS_FL_WEBSOCKET);
 	SHOW_FLAG(f, CS_FL_NOT_FIRST);
 	SHOW_FLAG(f, CS_FL_KILL_CONN);
@@ -485,6 +501,7 @@ int main(int argc, char **argv)
 		if (show_as & SHOW_AS_CHN)   show_chn_flags(flags);
 		if (show_as & SHOW_AS_CONN)  show_conn_flags(flags);
 		if (show_as & SHOW_AS_CS)    show_cs_flags(flags);
+		if (show_as & SHOW_AS_ENDP)  show_endp_flags(flags);
 		if (show_as & SHOW_AS_SI)    show_si_flags(flags);
 		if (show_as & SHOW_AS_SIET)  show_si_et(flags);
 		if (show_as & SHOW_AS_STRM)  show_strm_flags(flags);
diff --git a/include/haproxy/conn_stream-t.h b/include/haproxy/conn_stream-t.h
index dff167c27..56a4ab299 100644
--- a/include/haproxy/conn_stream-t.h
+++ b/include/haproxy/conn_stream-t.h
@@ -27,6 +27,15 @@
 
 struct stream_interface;
 
+/* CS endpoint flags */
+ enum {
+	 CS_EP_NONE       = 0x00000000, /* For initialization purposes */
+
+	 /* Endpoint types */
+	 CS_EP_T_MUX      = 0x00000001, /* The endpoint is a mux (the target may be NULL before the mux init) */
+	 CS_EP_T_APPLET   = 0x00000002, /* The endpoint is an applet */
+ };
+
 /* conn_stream flags */
 enum {
 	CS_FL_NONE          = 0x00000000,  /* Just for initialization purposes */
@@ -57,9 +66,6 @@ enum {
 
 	/* flags set by the mux relayed to the stream */
 	CS_FL_WEBSOCKET     = 0x00200000,  /* websocket stream */
-
-	CS_FL_ENDP_MUX      = 0x00400000,  /* Endpoint is a mux */
-	CS_FL_ENDP_APP      = 0x00800000,  /* Endpoint is an applet */
 };
 
 /* cs_shutr() modes */
@@ -88,6 +94,13 @@ struct data_cb {
 	char name[8];                           /* data layer name, zero-terminated */
 };
 
+
+struct cs_endpoint {
+	void *target;
+	void *ctx;
+	unsigned int flags;
+};
+
 /*
  * This structure describes the elements of a connection relevant to a stream
  */
@@ -95,11 +108,10 @@ struct conn_stream {
 	enum obj_type obj_type;              /* differentiates connection from applet context */
 	/* 3 bytes hole here */
 	unsigned int flags;                  /* CS_FL_* */
-	void *end;                           /* points to the end point (MUX stream or appctx) */
+	struct cs_endpoint *endp;            /* points to the end point (MUX stream or appctx) */
 	enum obj_type *app;                  /* points to the applicative point (stream or check) */
 	struct stream_interface *si;
 	const struct data_cb *data_cb;       /* data layer callbacks. Must be set before xprt->init() */
-	void *ctx;                           /* endpoint-specific context */
 };
 
 
diff --git a/include/haproxy/conn_stream.h b/include/haproxy/conn_stream.h
index d7d9fe163..7a6866809 100644
--- a/include/haproxy/conn_stream.h
+++ b/include/haproxy/conn_stream.h
@@ -34,6 +34,9 @@ struct check;
 
 #define IS_HTX_CS(cs)     (cs_conn(cs) && IS_HTX_CONN(__cs_conn(cs)))
 
+struct cs_endpoint *cs_endpoint_new();
+void cs_endpoint_free(struct cs_endpoint *endp);
+
 struct conn_stream *cs_new();
 void cs_free(struct conn_stream *cs);
 void cs_attach_endp_mux(struct conn_stream *cs, void *endp, void *ctx);
@@ -42,17 +45,29 @@ int cs_attach_app(struct conn_stream *cs, enum obj_type *app);
 void cs_detach_endp(struct conn_stream *cs);
 void cs_detach_app(struct conn_stream *cs);
 
+/* Returns the endpoint target without any control */
+static inline void *__cs_endp_target(const struct conn_stream *cs)
+{
+	return cs->endp->target;
+}
+
+/* Returns the endpoint context without any control */
+static inline void *__cs_endp_ctx(const struct conn_stream *cs)
+{
+	return cs->endp->ctx;
+}
+
 /* Returns the connection from a cs if the endpoint is a mux stream. Otherwise
  * NULL is returned. __cs_conn() returns the connection without any control
  * while cs_conn() check the endpoint type.
  */
 static inline struct connection *__cs_conn(const struct conn_stream *cs)
 {
-	return cs->ctx;
+	return __cs_endp_ctx(cs);
 }
 static inline struct connection *cs_conn(const struct conn_stream *cs)
 {
-	if (cs->flags & CS_FL_ENDP_MUX)
+	if (cs->endp->flags & CS_EP_T_MUX)
 		return __cs_conn(cs);
 	return NULL;
 }
@@ -67,17 +82,32 @@ static inline const struct mux_ops *cs_conn_mux(const struct conn_stream *cs)
 	return (conn ? conn->mux : NULL);
 }
 
+/* Returns the mux from a cs if the endpoint is a mux. Otherwise
+ * NULL is returned. __cs_mux() returns the mux without any control
+ * while cs_mux() check the endpoint type.
+ */
+static inline void *__cs_mux(const struct conn_stream *cs)
+{
+	return __cs_endp_target(cs);
+}
+static inline struct appctx *cs_mux(const struct conn_stream *cs)
+{
+	if (cs->endp->flags & CS_EP_T_MUX)
+		return __cs_mux(cs);
+	return NULL;
+}
+
 /* Returns the appctx from a cs if the endpoint is an appctx. Otherwise
  * NULL is returned. __cs_appctx() returns the appctx without any control
  * while cs_appctx() check the endpoint type.
  */
 static inline struct appctx *__cs_appctx(const struct conn_stream *cs)
 {
-	return cs->end;
+	return __cs_endp_target(cs);
 }
 static inline struct appctx *cs_appctx(const struct conn_stream *cs)
 {
-	if (cs->flags & CS_FL_ENDP_APP)
+	if (cs->endp->flags & CS_EP_T_APPLET)
 		return __cs_appctx(cs);
 	return NULL;
 }
diff --git a/src/conn_stream.c b/src/conn_stream.c
index 53b2992df..0335cbb63 100644
--- a/src/conn_stream.c
+++ b/src/conn_stream.c
@@ -17,7 +17,31 @@
 #include <haproxy/stream_interface.h>
 
 DECLARE_POOL(pool_head_connstream, "conn_stream", sizeof(struct conn_stream));
+DECLARE_POOL(pool_head_cs_endpoint, "cs_endpoint", sizeof(struct cs_endpoint));
 
+void cs_endpoint_init(struct cs_endpoint *endp)
+{
+	endp->target = NULL;
+	endp->ctx = NULL;
+	endp->flags = CS_EP_NONE;
+}
+
+struct cs_endpoint *cs_endpoint_new()
+{
+	struct cs_endpoint *endp;
+
+	endp = pool_alloc(pool_head_cs_endpoint);
+	if (unlikely(!endp))
+		return NULL;
+
+	cs_endpoint_init(endp);
+	return endp;
+}
+
+void cs_endpoint_free(struct cs_endpoint *endp)
+{
+	pool_free(pool_head_cs_endpoint, endp);
+}
 
 /* Tries to allocate a new conn_stream and initialize its main fields. On
  * failure, nothing is allocated and NULL is returned.
@@ -25,20 +49,29 @@ DECLARE_POOL(pool_head_connstream, "conn_stream", sizeof(struct conn_stream));
 struct conn_stream *cs_new()
 {
 	struct conn_stream *cs;
+	struct cs_endpoint *endp;
 
 	cs = pool_alloc(pool_head_connstream);
+
 	if (unlikely(!cs))
-		return NULL;
+		goto alloc_error;
 
 	cs->obj_type = OBJ_TYPE_CS;
 	cs->flags = CS_FL_NONE;
-	cs->end = NULL;
 	cs->app = NULL;
-	cs->ctx = NULL;
 	cs->si = NULL;
 	cs->data_cb = NULL;
 
+	endp = cs_endpoint_new();
+	if (unlikely(!endp))
+		goto alloc_error;
+	cs->endp = endp;
+
 	return cs;
+
+  alloc_error:
+	pool_free(pool_head_connstream, cs);
+	return NULL;
 }
 
 /* Releases a conn_stream previously allocated by cs_new(), as well as any
@@ -47,6 +80,9 @@ struct conn_stream *cs_new()
 void cs_free(struct conn_stream *cs)
 {
 	si_free(cs->si);
+	if (cs->endp) {
+		cs_endpoint_free(cs->endp);
+	}
 	pool_free(pool_head_connstream, cs);
 }
 
@@ -56,8 +92,9 @@ void cs_attach_endp_mux(struct conn_stream *cs, void *endp, void *ctx)
 {
 	struct connection *conn = ctx;
 
-	cs->end = endp;
-	cs->ctx = ctx;
+	cs->endp->target = endp;
+	cs->endp->ctx = ctx;
+	cs->endp->flags |= CS_EP_T_MUX;
 	if (!conn->ctx)
 		conn->ctx = cs;
 	if (cs_strm(cs)) {
@@ -66,7 +103,6 @@ void cs_attach_endp_mux(struct conn_stream *cs, void *endp, void *ctx)
 	}
 	else if (cs_check(cs))
 		cs->data_cb = &check_conn_cb;
-	cs->flags |= CS_FL_ENDP_MUX;
 }
 
 /* Attaches a conn_stream to an applet endpoint and sets the endpoint ctx */
@@ -74,14 +110,14 @@ void cs_attach_endp_app(struct conn_stream *cs, void *endp, void *ctx)
 {
 	struct appctx *appctx = endp;
 
-	cs->end = endp;
-	cs->ctx = ctx;
+	cs->endp->target = endp;
+	cs->endp->ctx = ctx;
+	cs->endp->flags |= CS_EP_T_APPLET;
 	appctx->owner = cs;
 	if (cs->si) {
 		cs->si->ops = &si_applet_ops;
 		cs->data_cb = NULL;
 	}
-	cs->flags |= CS_FL_ENDP_APP;
 }
 
 /* Attaches a conn_stream to a app layer and sets the relevant callbacks */
@@ -95,11 +131,11 @@ int cs_attach_app(struct conn_stream *cs, enum obj_type *app)
 		if (unlikely(!cs->si))
 			return -1;
 
-		if (cs_conn(cs)) {
+		if (cs->endp->flags & CS_EP_T_MUX) {
 			cs->si->ops = &si_conn_ops;
 			cs->data_cb = &si_conn_cb;
 		}
-		else if (cs_appctx(cs)) {
+		else if (cs->endp->flags & CS_EP_T_APPLET) {
 			cs->si->ops = &si_applet_ops;
 			cs->data_cb = NULL;
 		}
@@ -121,10 +157,9 @@ int cs_attach_app(struct conn_stream *cs, enum obj_type *app)
  */
 void cs_detach_endp(struct conn_stream *cs)
 {
-	struct connection *conn;
-	struct appctx *appctx;
+	if (cs->endp->flags & CS_EP_T_MUX) {
+		struct connection *conn = cs_conn(cs);
 
-	if ((conn = cs_conn(cs))) {
 		if (conn->mux) {
 			/* TODO: handle unsubscribe for healthchecks too */
 			if (cs->si && cs->si->wait_event.events != 0)
@@ -142,18 +177,22 @@ void cs_detach_endp(struct conn_stream *cs)
 			conn_free(conn);
 		}
 	}
-	else if ((appctx = cs_appctx(cs))) {
+	else if (cs->endp->flags & CS_EP_T_APPLET) {
+		struct appctx *appctx = cs_appctx(cs);
+
 		if (cs->si)
 			si_applet_release(cs->si);
 		appctx_free(appctx);
 	}
 
+	if (cs->endp) {
+		cs_endpoint_init(cs->endp);
+	}
+
 	/* FIXME: Rest CS for now but must be reviewed. CS flags are only
 	 *        connection related for now but this will evolved
 	 */
 	cs->flags = CS_FL_NONE;
-	cs->end = NULL;
-	cs->ctx = NULL;
 	if (cs->si)
 		cs->si->ops = &si_embedded_ops;
 	cs->data_cb = NULL;
@@ -169,6 +208,6 @@ void cs_detach_app(struct conn_stream *cs)
 	cs->si  = NULL;
 	cs->data_cb = NULL;
 
-	if (cs->end == NULL)
+	if (!cs->endp || !cs->endp->target)
 		cs_free(cs);
 }
diff --git a/src/h3.c b/src/h3.c
index 4906f295d..59c1ae193 100644
--- a/src/h3.c
+++ b/src/h3.c
@@ -636,7 +636,7 @@ static int h3_resp_data_send(struct qcs *qcs, struct buffer *buf, size_t count)
 size_t h3_snd_buf(struct conn_stream *cs, struct buffer *buf, size_t count, int flags)
 {
 	size_t total = 0;
-	struct qcs *qcs = cs->end;
+	struct qcs *qcs = __cs_mux(cs);
 	struct htx *htx;
 	enum htx_blk_type btype;
 	struct htx_blk *blk;
diff --git a/src/hq_interop.c b/src/hq_interop.c
index 68022c6f9..dcaba8ef9 100644
--- a/src/hq_interop.c
+++ b/src/hq_interop.c
@@ -96,7 +96,7 @@ static struct buffer *mux_get_buf(struct qcs *qcs)
 static size_t hq_interop_snd_buf(struct conn_stream *cs, struct buffer *buf,
                                  size_t count, int flags)
 {
-	struct qcs *qcs = cs->end;
+	struct qcs *qcs = __cs_mux(cs);
 	struct htx *htx;
 	enum htx_blk_type btype;
 	struct htx_blk *blk;
diff --git a/src/mux_fcgi.c b/src/mux_fcgi.c
index 3228f8b91..aadaf96b5 100644
--- a/src/mux_fcgi.c
+++ b/src/mux_fcgi.c
@@ -1133,7 +1133,6 @@ static struct fcgi_strm *fcgi_conn_stream_new(struct fcgi_conn *fconn, struct co
 	cs_attach_endp_mux(cs, fstrm, fconn->conn);
 	fstrm->cs = cs;
 	fstrm->sess = sess;
-	cs->end = fstrm;
 	fconn->nb_cs++;
 
 	TRACE_LEAVE(FCGI_EV_FSTRM_NEW, fconn->conn, fstrm);
@@ -3579,14 +3578,12 @@ static void fcgi_destroy(void *ctx)
  */
 static void fcgi_detach(struct conn_stream *cs)
 {
-	struct fcgi_strm *fstrm = cs->end;
+	struct fcgi_strm *fstrm = __cs_mux(cs);
 	struct fcgi_conn *fconn;
 	struct session *sess;
 
 	TRACE_ENTER(FCGI_EV_STRM_END, (fstrm ? fstrm->fconn->conn : NULL), fstrm);
 
-	cs->end = NULL;
-	cs->ctx = NULL;
 	if (!fstrm) {
 		TRACE_LEAVE(FCGI_EV_STRM_END);
 		return;
@@ -3854,7 +3851,7 @@ struct task *fcgi_deferred_shut(struct task *t, void *ctx, unsigned int state)
 /* shutr() called by the conn_stream (mux_ops.shutr) */
 static void fcgi_shutr(struct conn_stream *cs, enum cs_shr_mode mode)
 {
-	struct fcgi_strm *fstrm = cs->end;
+	struct fcgi_strm *fstrm = __cs_mux(cs);
 
 	TRACE_POINT(FCGI_EV_STRM_SHUT, fstrm->fconn->conn, fstrm);
 	if (cs->flags & CS_FL_KILL_CONN)
@@ -3869,7 +3866,7 @@ static void fcgi_shutr(struct conn_stream *cs, enum cs_shr_mode mode)
 /* shutw() called by the conn_stream (mux_ops.shutw) */
 static void fcgi_shutw(struct conn_stream *cs, enum cs_shw_mode mode)
 {
-	struct fcgi_strm *fstrm = cs->end;
+	struct fcgi_strm *fstrm = __cs_mux(cs);
 
 	TRACE_POINT(FCGI_EV_STRM_SHUT, fstrm->fconn->conn, fstrm);
 	if (cs->flags & CS_FL_KILL_CONN)
@@ -3885,7 +3882,7 @@ static void fcgi_shutw(struct conn_stream *cs, enum cs_shw_mode mode)
  */
 static int fcgi_subscribe(struct conn_stream *cs, int event_type, struct wait_event *es)
 {
-	struct fcgi_strm *fstrm = cs->end;
+	struct fcgi_strm *fstrm = __cs_mux(cs);
 	struct fcgi_conn *fconn = fstrm->fconn;
 
 	BUG_ON(event_type & ~(SUB_RETRY_SEND|SUB_RETRY_RECV));
@@ -3911,7 +3908,7 @@ static int fcgi_subscribe(struct conn_stream *cs, int event_type, struct wait_ev
  */
 static int fcgi_unsubscribe(struct conn_stream *cs, int event_type, struct wait_event *es)
 {
-	struct fcgi_strm *fstrm = cs->end;
+	struct fcgi_strm *fstrm = __cs_mux(cs);
 	struct fcgi_conn *fconn = fstrm->fconn;
 
 	BUG_ON(event_type & ~(SUB_RETRY_SEND|SUB_RETRY_RECV));
@@ -3947,7 +3944,7 @@ static int fcgi_unsubscribe(struct conn_stream *cs, int event_type, struct wait_
  */
 static size_t fcgi_rcv_buf(struct conn_stream *cs, struct buffer *buf, size_t count, int flags)
 {
-	struct fcgi_strm *fstrm = cs->end;
+	struct fcgi_strm *fstrm = __cs_mux(cs);
 	struct fcgi_conn *fconn = fstrm->fconn;
 	size_t ret = 0;
 
@@ -3991,7 +3988,7 @@ static size_t fcgi_rcv_buf(struct conn_stream *cs, struct buffer *buf, size_t co
  */
 static size_t fcgi_snd_buf(struct conn_stream *cs, struct buffer *buf, size_t count, int flags)
 {
-	struct fcgi_strm *fstrm = cs->end;
+	struct fcgi_strm *fstrm = __cs_mux(cs);
 	struct fcgi_conn *fconn = fstrm->fconn;
 	size_t total = 0;
 	size_t ret;
diff --git a/src/mux_h1.c b/src/mux_h1.c
index 4baaf43ce..afc09dfad 100644
--- a/src/mux_h1.c
+++ b/src/mux_h1.c
@@ -3337,15 +3337,13 @@ static void h1_destroy(void *ctx)
  */
 static void h1_detach(struct conn_stream *cs)
 {
-	struct h1s *h1s = cs->end;
+	struct h1s *h1s = __cs_mux(cs);
 	struct h1c *h1c;
 	struct session *sess;
 	int is_not_first;
 
 	TRACE_ENTER(H1_EV_STRM_END, h1s ? h1s->h1c->conn : NULL, h1s);
 
-	cs->end = NULL;
-	cs->ctx = NULL;
 	if (!h1s) {
 		TRACE_LEAVE(H1_EV_STRM_END);
 		return;
@@ -3447,7 +3445,7 @@ static void h1_detach(struct conn_stream *cs)
 
 static void h1_shutr(struct conn_stream *cs, enum cs_shr_mode mode)
 {
-	struct h1s *h1s = cs->end;
+	struct h1s *h1s = __cs_mux(cs);
 	struct h1c *h1c;
 
 	if (!h1s)
@@ -3490,7 +3488,7 @@ static void h1_shutr(struct conn_stream *cs, enum cs_shr_mode mode)
 
 static void h1_shutw(struct conn_stream *cs, enum cs_shw_mode mode)
 {
-	struct h1s *h1s = cs->end;
+	struct h1s *h1s = __cs_mux(cs);
 	struct h1c *h1c;
 
 	if (!h1s)
@@ -3550,7 +3548,7 @@ static void h1_shutw_conn(struct connection *conn)
  */
 static int h1_unsubscribe(struct conn_stream *cs, int event_type, struct wait_event *es)
 {
-	struct h1s *h1s = cs->end;
+	struct h1s *h1s = __cs_mux(cs);
 
 	if (!h1s)
 		return 0;
@@ -3579,7 +3577,7 @@ static int h1_unsubscribe(struct conn_stream *cs, int event_type, struct wait_ev
  */
 static int h1_subscribe(struct conn_stream *cs, int event_type, struct wait_event *es)
 {
-	struct h1s *h1s = cs->end;
+	struct h1s *h1s = __cs_mux(cs);
 	struct h1c *h1c;
 
 	if (!h1s)
@@ -3627,7 +3625,7 @@ static int h1_subscribe(struct conn_stream *cs, int event_type, struct wait_even
  */
 static size_t h1_rcv_buf(struct conn_stream *cs, struct buffer *buf, size_t count, int flags)
 {
-	struct h1s *h1s = cs->end;
+	struct h1s *h1s = __cs_mux(cs);
 	struct h1c *h1c = h1s->h1c;
 	struct h1m *h1m = (!(h1c->flags & H1C_F_IS_BACK) ? &h1s->req : &h1s->res);
 	size_t ret = 0;
@@ -3663,7 +3661,7 @@ static size_t h1_rcv_buf(struct conn_stream *cs, struct buffer *buf, size_t coun
 /* Called from the upper layer, to send data */
 static size_t h1_snd_buf(struct conn_stream *cs, struct buffer *buf, size_t count, int flags)
 {
-	struct h1s *h1s = cs->end;
+	struct h1s *h1s = __cs_mux(cs);
 	struct h1c *h1c;
 	size_t total = 0;
 
@@ -3728,7 +3726,7 @@ static size_t h1_snd_buf(struct conn_stream *cs, struct buffer *buf, size_t coun
 /* Send and get, using splicing */
 static int h1_rcv_pipe(struct conn_stream *cs, struct pipe *pipe, unsigned int count)
 {
-	struct h1s *h1s = cs->end;
+	struct h1s *h1s = __cs_mux(cs);
 	struct h1c *h1c = h1s->h1c;
 	struct h1m *h1m = (!(h1c->flags & H1C_F_IS_BACK) ? &h1s->req : &h1s->res);
 	int ret = 0;
@@ -3798,7 +3796,7 @@ static int h1_rcv_pipe(struct conn_stream *cs, struct pipe *pipe, unsigned int c
 
 static int h1_snd_pipe(struct conn_stream *cs, struct pipe *pipe)
 {
-	struct h1s *h1s = cs->end;
+	struct h1s *h1s = __cs_mux(cs);
 	struct h1c *h1c = h1s->h1c;
 	struct h1m *h1m = (!(h1c->flags & H1C_F_IS_BACK) ? &h1s->res : &h1s->req);
 	int ret = 0;
diff --git a/src/mux_h2.c b/src/mux_h2.c
index d06b093e2..7e7bc66ca 100644
--- a/src/mux_h2.c
+++ b/src/mux_h2.c
@@ -4349,14 +4349,12 @@ static void h2_destroy(void *ctx)
  */
 static void h2_detach(struct conn_stream *cs)
 {
-	struct h2s *h2s = cs->end;
+	struct h2s *h2s = __cs_mux(cs);
 	struct h2c *h2c;
 	struct session *sess;
 
 	TRACE_ENTER(H2_EV_STRM_END, h2s ? h2s->h2c->conn : NULL, h2s);
 
-	cs->end = NULL;
-	cs->ctx = NULL;
 	if (!h2s) {
 		TRACE_LEAVE(H2_EV_STRM_END);
 		return;
@@ -4670,7 +4668,7 @@ struct task *h2_deferred_shut(struct task *t, void *ctx, unsigned int state)
 /* shutr() called by the conn_stream (mux_ops.shutr) */
 static void h2_shutr(struct conn_stream *cs, enum cs_shr_mode mode)
 {
-	struct h2s *h2s = cs->end;
+	struct h2s *h2s = __cs_mux(cs);
 
 	TRACE_ENTER(H2_EV_STRM_SHUT, h2s->h2c->conn, h2s);
 	if (cs->flags & CS_FL_KILL_CONN)
@@ -4685,7 +4683,7 @@ static void h2_shutr(struct conn_stream *cs, enum cs_shr_mode mode)
 /* shutw() called by the conn_stream (mux_ops.shutw) */
 static void h2_shutw(struct conn_stream *cs, enum cs_shw_mode mode)
 {
-	struct h2s *h2s = cs->end;
+	struct h2s *h2s = __cs_mux(cs);
 
 	TRACE_ENTER(H2_EV_STRM_SHUT, h2s->h2c->conn, h2s);
 	if (cs->flags & CS_FL_KILL_CONN)
@@ -6362,7 +6360,7 @@ static size_t h2s_make_trailers(struct h2s *h2s, struct htx *htx)
  */
 static int h2_subscribe(struct conn_stream *cs, int event_type, struct wait_event *es)
 {
-	struct h2s *h2s = cs->end;
+	struct h2s *h2s = __cs_mux(cs);
 	struct h2c *h2c = h2s->h2c;
 
 	TRACE_ENTER(H2_EV_STRM_SEND|H2_EV_STRM_RECV, h2c->conn, h2s);
@@ -6396,7 +6394,7 @@ static int h2_subscribe(struct conn_stream *cs, int event_type, struct wait_even
  */
 static int h2_unsubscribe(struct conn_stream *cs, int event_type, struct wait_event *es)
 {
-	struct h2s *h2s = cs->end;
+	struct h2s *h2s = __cs_mux(cs);
 
 	TRACE_ENTER(H2_EV_STRM_SEND|H2_EV_STRM_RECV, h2s->h2c->conn, h2s);
 
@@ -6436,7 +6434,7 @@ static int h2_unsubscribe(struct conn_stream *cs, int event_type, struct wait_ev
  */
 static size_t h2_rcv_buf(struct conn_stream *cs, struct buffer *buf, size_t count, int flags)
 {
-	struct h2s *h2s = cs->end;
+	struct h2s *h2s = __cs_mux(cs);
 	struct h2c *h2c = h2s->h2c;
 	struct htx *h2s_htx = NULL;
 	struct htx *buf_htx = NULL;
@@ -6519,7 +6517,7 @@ static size_t h2_rcv_buf(struct conn_stream *cs, struct buffer *buf, size_t coun
  */
 static size_t h2_snd_buf(struct conn_stream *cs, struct buffer *buf, size_t count, int flags)
 {
-	struct h2s *h2s = cs->end;
+	struct h2s *h2s = __cs_mux(cs);
 	size_t total = 0;
 	size_t ret;
 	struct htx *htx;
diff --git a/src/mux_pt.c b/src/mux_pt.c
index f22c3a1fd..1609a74db 100644
--- a/src/mux_pt.c
+++ b/src/mux_pt.c
@@ -415,9 +415,6 @@ static void mux_pt_detach(struct conn_stream *cs)
 
 	TRACE_ENTER(PT_EV_STRM_END, conn, cs);
 
-	cs->end = NULL;
-	cs->ctx = NULL;
-
 	/* Subscribe, to know if we got disconnected */
 	if (!conn_is_back(conn) && conn->owner != NULL &&
 	    !(conn->flags & (CO_FL_ERROR | CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH))) {
diff --git a/src/mux_quic.c b/src/mux_quic.c
index 08848caae..f61602f7b 100644
--- a/src/mux_quic.c
+++ b/src/mux_quic.c
@@ -1056,12 +1056,11 @@ static int qc_init(struct connection *conn, struct proxy *prx,
 
 static void qc_detach(struct conn_stream *cs)
 {
-	struct qcs *qcs = cs->end;
+	struct qcs *qcs = __cs_mux(cs);
 	struct qcc *qcc = qcs->qcc;
 
 	TRACE_ENTER(QMUX_EV_STRM_END, qcc->conn, qcs);
 
-	cs->ctx = NULL;
 	qcs->cs = NULL;
 	--qcc->nb_cs;
 
@@ -1092,7 +1091,7 @@ static void qc_detach(struct conn_stream *cs)
 static size_t qc_rcv_buf(struct conn_stream *cs, struct buffer *buf,
                          size_t count, int flags)
 {
-	struct qcs *qcs = cs->end;
+	struct qcs *qcs = __cs_mux(cs);
 	struct htx *qcs_htx = NULL;
 	struct htx *cs_htx = NULL;
 	size_t ret = 0;
@@ -1160,7 +1159,7 @@ static size_t qc_rcv_buf(struct conn_stream *cs, struct buffer *buf,
 static size_t qc_snd_buf(struct conn_stream *cs, struct buffer *buf,
                          size_t count, int flags)
 {
-	struct qcs *qcs = cs->end;
+	struct qcs *qcs = __cs_mux(cs);
 	size_t ret;
 
 	TRACE_ENTER(QMUX_EV_STRM_SEND, qcs->qcc->conn, qcs);
@@ -1180,7 +1179,7 @@ static size_t qc_snd_buf(struct conn_stream *cs, struct buffer *buf,
 static int qc_subscribe(struct conn_stream *cs, int event_type,
                         struct wait_event *es)
 {
-	return qcs_subscribe(cs->end, event_type, es);
+	return qcs_subscribe(__cs_mux(cs), event_type, es);
 }
 
 /* Called from the upper layer, to unsubscribe <es> from events <event_type>.
@@ -1189,7 +1188,7 @@ static int qc_subscribe(struct conn_stream *cs, int event_type,
  */
 static int qc_unsubscribe(struct conn_stream *cs, int event_type, struct wait_event *es)
 {
-	struct qcs *qcs = cs->end;
+	struct qcs *qcs = __cs_mux(cs);
 
 	BUG_ON(event_type & ~(SUB_RETRY_SEND|SUB_RETRY_RECV));
 	BUG_ON(qcs->subs && qcs->subs != es);
diff --git a/src/stream.c b/src/stream.c
index 778b4ae75..95e6fc5cc 100644
--- a/src/stream.c
+++ b/src/stream.c
@@ -718,7 +718,7 @@ static void stream_free(struct stream *s)
 
 	/* applets do not release session yet */
 	/* FIXME: Handle it in appctx_free ??? */
-	must_free_sess = objt_appctx(sess->origin) && sess->origin == s->csf->end;
+	must_free_sess = objt_appctx(sess->origin) && sess->origin == __cs_endp_target(s->csf);
 
 	/* FIXME: ATTENTION, si CSF est libere avant, ca plante !!!! */
 	cs_detach_endp(s->csb);
@@ -3253,8 +3253,8 @@ static int stats_dump_full_strm_to_buffer(struct stream_interface *si, struct st
 			     strm->csf->si,
 			     si_state_str(strm->csf->si->state),
 			     strm->csf->si->flags,
-			     obj_type_name(strm->csf->end),
-			     obj_base_ptr(strm->csf->end),
+			     (strm->csf->endp->flags & CS_EP_T_MUX ? "CONN" : "APPCTX"),
+			      __cs_endp_target(strm->csf),
 			     strm->csf->si->exp ?
 			             tick_is_expired(strm->csf->si->exp, now_ms) ? "<PAST>" :
 			                     human_time(TICKS_TO_MS(strm->csf->si->exp - now_ms),
@@ -3266,8 +3266,8 @@ static int stats_dump_full_strm_to_buffer(struct stream_interface *si, struct st
 			     strm->csb->si,
 			     si_state_str(strm->csb->si->state),
 			     strm->csb->si->flags,
-			     obj_type_name(strm->csb->end),
-			     obj_base_ptr(strm->csb->end),
+			     (strm->csb->endp->flags & CS_EP_T_MUX ? "CONN" : "APPCTX"),
+			      __cs_endp_target(strm->csb),
 			     strm->csb->si->exp ?
 			             tick_is_expired(strm->csb->si->exp, now_ms) ? "<PAST>" :
 			                     human_time(TICKS_TO_MS(strm->csb->si->exp - now_ms),
@@ -3275,7 +3275,7 @@ static int stats_dump_full_strm_to_buffer(struct stream_interface *si, struct st
 			     strm->csb->si->err_type, strm->csb->si->wait_event.events);
 
 		cs = strm->csf;
-		chunk_appendf(&trash, "  cs=%p csf=0x%08x endp=%p\n", cs, cs->flags, cs->end);
+		chunk_appendf(&trash, "  cs=%p csf=0x%08x endp=%p,0x%08x\n", cs, cs->flags, cs->endp->target, cs->endp->flags);
 
 		if ((conn = cs_conn(cs)) != NULL) {
 			chunk_appendf(&trash,
@@ -3311,7 +3311,7 @@ static int stats_dump_full_strm_to_buffer(struct stream_interface *si, struct st
 		}
 
 		cs = strm->csb;
-		chunk_appendf(&trash, "  cs=%p csf=0x%08x end=%p\n", cs, cs->flags, cs->end);
+		chunk_appendf(&trash, "  cs=%p csb=0x%08x endp=%p,0x%08x\n", cs, cs->flags, cs->endp->target, cs->endp->flags);
 		if ((conn = cs_conn(cs)) != NULL) {
 			chunk_appendf(&trash,
 			              "      co1=%p ctrl=%s xprt=%s mux=%s data=%s target=%s:%p\n",