--- xen-4.3.0.orig/tools/qemu-xen/ui/vnc.c
+++ xen-4.3.0/tools/qemu-xen/ui/vnc.c
@@ -2703,6 +2703,8 @@
 
     vs->csock = csock;
 
+    QTAILQ_INSERT_HEAD(&vd->clients, vs, next);
+
     if (skipauth) {
 	vs->auth = VNC_AUTH_NONE;
 #ifdef CONFIG_VNC_TLS
@@ -2739,17 +2741,11 @@
 
     vs->vd = vd;
 
-#ifdef CONFIG_VNC_WS
-    if (!vs->websocket)
-#endif
-    {
-        vnc_init_state(vs);
-    }
-}
+    if (vs->vd->lock_key_sync)
+        vs->led = qemu_add_led_event_handler(kbd_leds, vs);
 
-void vnc_init_state(VncState *vs)
-{
-    VncDisplay *vd = vs->vd;
+    vs->mouse_mode_notifier.notify = check_pointer_type_change;
+    qemu_add_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
 
     vs->ds = vd->ds;
     vs->last_x = -1;
@@ -2763,21 +2759,26 @@
     qemu_mutex_init(&vs->output_mutex);
     vs->bh = qemu_bh_new(vnc_jobs_bh, vs);
 
-    QTAILQ_INSERT_HEAD(&vd->clients, vs, next);
+    vnc_init_timer(vd);
 
+#ifdef CONFIG_VNC_WS
+    if (!vs->websocket)
+#endif
+    {
+        vnc_init_state(vs);
+    }
+}
+
+void vnc_init_state(VncState *vs)
+{
+    VncDisplay *vd = vs->vd;
+
     vga_hw_update();
 
     vnc_write(vs, "RFB 003.008\n", 12);
     vnc_flush(vs);
     vnc_read_when(vs, protocol_version, 12);
     reset_keys(vs);
-    if (vs->vd->lock_key_sync)
-        vs->led = qemu_add_led_event_handler(kbd_leds, vs);
-
-    vs->mouse_mode_notifier.notify = check_pointer_type_change;
-    qemu_add_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
-
-    vnc_init_timer(vd);
 
     /* vs might be free()ed here */
 }