diff --git a/fs/userfs/fs_userfs.c b/fs/userfs/fs_userfs.c
index fbdc216eaf5..f9e4982a44f 100644
--- a/fs/userfs/fs_userfs.c
+++ b/fs/userfs/fs_userfs.c
@@ -1066,6 +1066,8 @@ static int userfs_bind(FAR struct inode *blkdriver, FAR const void *data,
 {
   FAR struct userfs_state_s *priv;
   FAR const struct userfs_config_s *config;
+  struct sockaddr_un client;
+  socklen_t addrlen;
   unsigned int iolen;
   int ret;
 
@@ -1110,11 +1112,33 @@ static int userfs_bind(FAR struct inode *blkdriver, FAR const void *data,
       goto errout_with_alloc;
     }
 
+  priv->psock.s_crefs = 1;
+
+  /* Bind the socket to the client address */
+
+  client.sun_family = AF_LOCAL;
+  snprintf(client.sun_path, UNIX_PATH_MAX, USERFS_CLIENT_FMT,
+           config->instance);
+  client.sun_path[UNIX_PATH_MAX - 1] = '\0';
+
+  addrlen = strlen(client.sun_path) + sizeof(sa_family_t) + 1;
+  ret = psock_bind(&priv->psock, (struct sockaddr*)&client, addrlen);
+  if (ret < 0)
+    {
+      ferr("ERROR: bind() failed: %d\n", ret);
+      goto errout_with_psock;
+    }
+
+  priv->psock.s_crefs = 1;
+
   /* Mounted! */
 
   *handle = (FAR void *)priv;
   return OK;
 
+errout_with_psock:
+  psock_close(&priv->psock);
+
 errout_with_alloc:
   kmm_free(priv);
   return ret;
diff --git a/include/nuttx/fs/userfs.h b/include/nuttx/fs/userfs.h
index 0fc30704013..8eeef7d3bfb 100644
--- a/include/nuttx/fs/userfs.h
+++ b/include/nuttx/fs/userfs.h
@@ -115,6 +115,9 @@
 #define USERFS_SERVER_FMT      "/dev/userver%u"
 #define USERFS_SERVER_MAXLEN   (18)
 
+#define USERFS_CLIENT_FMT      "/dev/uclient%u"
+#define USERFS_CLIENT_MAXLEN   (18)
+
 /* It looks like the maximum size of a request is 16 bytes.  We will allow a
  * little more for the maximum size of a request structure.
  */
diff --git a/libc/userfs/lib_userfs.c b/libc/userfs/lib_userfs.c
index 11c2584b44b..a1f275252a6 100644
--- a/libc/userfs/lib_userfs.c
+++ b/libc/userfs/lib_userfs.c
@@ -163,7 +163,7 @@ static inline int userfs_open_dispatch(FAR struct userfs_info_s *info,
   if (nsent < 0)
     {
       ret = -errno;
-      ferr("ERROR: Send open response failed: %d\n", ret)
+      ferr("ERROR: Send open response failed: %d\n", ret);
       return ret;
     }
 
@@ -838,7 +838,7 @@ int userfs_run(FAR const char *mountpt,
                FAR void *volinfo, size_t mxwrite)
 {
   FAR struct userfs_info_s *info;
-  FAR struct userfs_config_s *config;
+  FAR struct userfs_config_s config;
   struct sockaddr_un server;
   unsigned int iolen;
   socklen_t addrlen;
@@ -861,17 +861,17 @@ int userfs_run(FAR const char *mountpt,
 
   /* Initialize the state structure */
 
-  info->userops  = userops;
-  info->volinfo  = volinfo;
-  info->iolen    = iolen;
-  info->mxwrite  = mxwrite;
+  info->userops   = userops;
+  info->volinfo   = volinfo;
+  info->iolen     = iolen;
+  info->mxwrite   = mxwrite;
 
   /* Create the UserFS configuration that will be provided as optional
    * data when the UserFS is mounted.
    */
 
-  config->mxwrite  = mxwrite;
-  config->instance = userfs_instance();
+  config.mxwrite  = mxwrite;
+  config.instance = userfs_instance();
 
   /* Mounts the user file system at the provided mount point path. */
 
@@ -879,7 +879,7 @@ int userfs_run(FAR const char *mountpt,
   if (ret < 0)
     {
       ret = -get_errno();
-      ferr("ERROR: mount() failued: %d\n", ret);
+      ferr("ERROR: mount() failed: %d\n", ret);
       goto errout_with_info;
     }
 
@@ -897,7 +897,7 @@ int userfs_run(FAR const char *mountpt,
 
   server.sun_family = AF_LOCAL;
   snprintf(server.sun_path, UNIX_PATH_MAX, USERFS_SERVER_FMT,
-           config->instance);
+           config.instance);
   server.sun_path[UNIX_PATH_MAX - 1] = '\0';
 
   addrlen = strlen(server.sun_path) + sizeof(sa_family_t) + 1;
diff --git a/net/socket/socket.c b/net/socket/socket.c
index 6f9d64272e1..539ef0b2160 100644
--- a/net/socket/socket.c
+++ b/net/socket/socket.c
@@ -60,6 +60,11 @@
  *   socket() creates an endpoint for communication and returns a socket
  *   structure.
  *
+ *   NOTE: This function does not set the reference count on the socket
+ *   structure.  This down by the socket() front end when socket structure
+ *   was allocated.  Internal OS users of psock_socket() must set the s_crefs
+ *   field to one if psock_socket() returns success.
+ *
  * Input Parameters:
  *   domain   (see sys/socket.h)
  *   type     (see sys/socket.h)