diff --git a/CHANGELOG.md b/CHANGELOG.md
index 47c6c5f13..6ac745a0c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 ## `2.17.0`
 - Fixed `xplatform.loadFileUTF8` when trying to open nonexistent file (#454)
+- Bugfix: fix an incorrect check in the recovery router code which might lead to
+  the state cell-pool being released prematurely (#446)
 
 ## `2.16.0`
 - No yaml value converted to null (#442)
diff --git a/c/recovery.c b/c/recovery.c
index fd1ff5611..2c5da2a0a 100644
--- a/c/recovery.c
+++ b/c/recovery.c
@@ -497,7 +497,7 @@ static void * __ptr32 getRecoveryRouterAddress() {
       "         LA    1,RCVXINF           LOAD ROUTER SERVICE INFO             \n"
       "         BRAS  14,RCVSIFLB         RECORD IT, REMOVE CONTEXT, PERCOLATE \n"
       "         TM    RCXFLAG1,R@CF1USP   USER STATE POOL?                     \n"
-      "         BZ    RCVFRL04            NO, DO NOT FREE IT                   \n"
+      "         BNZ   RCVFRL04            NO, DO NOT FREE IT                   \n"
       "         LT    2,RCXSCPID          CELL POOL ZERO?                      \n"
       "         BZ    RCVFRL04            YES, DO NOT FREE IT                  \n"
 #ifdef _LP64
@@ -505,6 +505,8 @@ static void * __ptr32 getRecoveryRouterAddress() {
       "         SYSSTATE AMODE64=NO                                            \n"
 #endif
       "         CPOOL DELETE,CPID=(2)     FREE THE STATE CELL POOL             \n"
+      "         LGFI  2,X'7FFFFBA3'       MAKE AN OBVIOUSLY BAD ADDRESS        \n"
+      "         ST    2,RCXSCPID          MARK THE CPID FOR DEBUGGING PURPOSES \n"
 #ifdef _LP64
       "         SAM64                                                          \n"
       "         SYSSTATE AMODE64=YES                                           \n"
@@ -1291,6 +1293,8 @@ RecoveryStatePool *recoveryMakeStatePool(unsigned int stateCount) {
 
 void recoveryRemoveStatePool(RecoveryStatePool *statePool) {
   removeRecoveryStatePool(statePool->cellPool);
+  // put a bad address for debugging (in case the statePool storage survives)
+  statePool->cellPool = 0x7FFFFBA1;
   storageRelease(statePool, sizeof(RecoveryStatePool));
 }