diff --git a/qa/workunits/rbd/permissions.sh b/qa/workunits/rbd/permissions.sh
index a4b0c32fdee..b38ad067bf4 100755
--- a/qa/workunits/rbd/permissions.sh
+++ b/qa/workunits/rbd/permissions.sh
@@ -12,11 +12,11 @@ delete_pools() {
 }
 
 recreate_pools() {
-    create_pools
     delete_pools
+    create_pools
 }
 
-delete_uers() {
+delete_users() {
     (ceph auth del client.volumes || true) >/dev/null 2>&1
     (ceph auth del client.images || true) >/dev/null 2>&1
 }
@@ -26,31 +26,54 @@ create_users() {
     ceph auth get-or-create client.images mon 'allow r' osd 'allow class-read object_prefix rbd_children, allow rwx pool images' >> $KEYRING
 }
 
+expect() {
+
+  set +e
+
+  local expected_ret=$1
+  local ret
+
+  shift
+  cmd=$@
+
+  eval $cmd
+  ret=$?
+
+  set -e
+
+  if [[ $ret -ne $expected_ret ]]; then
+    echo "ERROR: running \'$cmd\': expected $expected_ret got $ret"
+    return 1
+  fi
+
+  return 0
+}
+
 test_images_access() {
-    rbd -k $KEYRING --id images create --format 2 -s 1 images/foo
+    rbd -k $KEYRING --id images create --image-format 2 -s 1 images/foo
     rbd -k $KEYRING --id images snap create images/foo@snap
     rbd -k $KEYRING --id images snap protect images/foo@snap
     rbd -k $KEYRING --id images snap unprotect images/foo@snap
     rbd -k $KEYRING --id images snap protect images/foo@snap
     rbd -k $KEYRING --id images export images/foo@snap - >/dev/null
-    ! rbd -k $KEYRING --id images snap rm images/foo@snap
+    expect 16 rbd -k $KEYRING --id images snap rm images/foo@snap
 
     rbd -k $KEYRING --id volumes clone images/foo@snap volumes/child
-    ! rbd -k $KEYRING --id images snap unprotect images/foo@snap
-    ! rbd -k $KEYRING --id volumes snap unprotect images/foo@snap
-    ! rbd -k $KEYRING --id images flatten volumes/child
+    expect 16 rbd -k $KEYRING --id images snap unprotect images/foo@snap
+    expect 1 rbd -k $KEYRING --id volumes snap unprotect images/foo@snap
+    expect 1 rbd -k $KEYRING --id images flatten volumes/child
     rbd -k $KEYRING --id volumes flatten volumes/child
-    ! rbd -k $KEYRING --id volumes snap unprotect images/foo@snap
+    expect 1 rbd -k $KEYRING --id volumes snap unprotect images/foo@snap
     rbd -k $KEYRING --id images snap unprotect images/foo@snap
 
-    ! rbd -k $KEYRING --id images rm images/foo
+    expect 39 rbd -k $KEYRING --id images rm images/foo
     rbd -k $KEYRING --id images snap rm images/foo@snap
     rbd -k $KEYRING --id images rm images/foo
     rbd -k $KEYRING --id volumes rm volumes/child
 }
 
 test_volumes_access() {
-    rbd -k $KEYRING --id images create --format 2 -s 1 images/foo
+    rbd -k $KEYRING --id images create --image-format 2 -s 1 images/foo
     rbd -k $KEYRING --id images snap create images/foo@snap
     rbd -k $KEYRING --id images snap protect images/foo@snap
 
@@ -64,16 +87,16 @@ test_volumes_access() {
     rbd -k $KEYRING --id volumes lock list images/foo
 
     # commands that fail with read-only access
-    ! rbd -k $KEYRING --id volumes resize -s 2 images/foo --allow-shrink
-    ! rbd -k $KEYRING --id volumes snap create images/foo@2
-    ! rbd -k $KEYRING --id volumes snap rollback images/foo@snap
-    ! rbd -k $KEYRING --id volumes snap remove images/foo@snap
-    ! rbd -k $KEYRING --id volumes snap purge images/foo
-    ! rbd -k $KEYRING --id volumes snap unprotect images/foo@snap
-    ! rbd -k $KEYRING --id volumes flatten images/foo
-    ! rbd -k $KEYRING --id volumes lock add images/foo test
-    ! rbd -k $KEYRING --id volumes lock remove images/foo test locker
-    ! rbd -k $KEYRING --id volumes ls rbd
+    expect 1 rbd -k $KEYRING --id volumes resize -s 2 images/foo --allow-shrink
+    expect 1 rbd -k $KEYRING --id volumes snap create images/foo@2
+    expect 1 rbd -k $KEYRING --id volumes snap rollback images/foo@snap
+    expect 1 rbd -k $KEYRING --id volumes snap remove images/foo@snap
+    expect 1 rbd -k $KEYRING --id volumes snap purge images/foo
+    expect 1 rbd -k $KEYRING --id volumes snap unprotect images/foo@snap
+    expect 1 rbd -k $KEYRING --id volumes flatten images/foo
+    expect 1 rbd -k $KEYRING --id volumes lock add images/foo test
+    expect 1 rbd -k $KEYRING --id volumes lock remove images/foo test locker
+    expect 1 rbd -k $KEYRING --id volumes ls rbd
 
     # create clone and snapshot
     rbd -k $KEYRING --id volumes clone images/foo@snap volumes/child
@@ -82,14 +105,14 @@ test_volumes_access() {
     rbd -k $KEYRING --id volumes snap create volumes/child@snap2
 
     # make sure original snapshot stays protected
-    ! rbd -k $KEYRING --id images snap unprotect images/foo@snap
+    expect 16 rbd -k $KEYRING --id images snap unprotect images/foo@snap
     rbd -k $KEYRING --id volumes flatten volumes/child
-    ! rbd -k $KEYRING --id images snap unprotect images/foo@snap
+    expect 16 rbd -k $KEYRING --id images snap unprotect images/foo@snap
     rbd -k $KEYRING --id volumes snap rm volumes/child@snap2
-    ! rbd -k $KEYRING --id images snap unprotect images/foo@snap
-    ! rbd -k $KEYRING --id volumes snap rm volumes/child@snap2
+    expect 16 rbd -k $KEYRING --id images snap unprotect images/foo@snap
+    expect 2 rbd -k $KEYRING --id volumes snap rm volumes/child@snap2
     rbd -k $KEYRING --id volumes snap unprotect volumes/child@snap1
-    ! rbd -k $KEYRING --id images snap unprotect images/foo@snap
+    expect 16 rbd -k $KEYRING --id images snap unprotect images/foo@snap
 
     # clean up
     rbd -k $KEYRING --id volumes snap rm volumes/child@snap1
diff --git a/src/librbd/ImageWatcher.cc b/src/librbd/ImageWatcher.cc
index 3e0b522d246..d4aa428efe9 100644
--- a/src/librbd/ImageWatcher.cc
+++ b/src/librbd/ImageWatcher.cc
@@ -100,7 +100,6 @@ int ImageWatcher::unregister_watch() {
   int r = 0;
   {
     RWLock::WLocker l(m_watch_lock);
-    assert(m_watch_state != WATCH_STATE_UNREGISTERED);
     if (m_watch_state == WATCH_STATE_REGISTERED) {
       r = m_image_ctx.md_ctx.unwatch2(m_watch_handle);
     }