diff --git a/quic/core/quic_connection.cc b/quic/core/quic_connection.cc
index c44e5cf..8b71b3a 100644
--- a/quic/core/quic_connection.cc
+++ b/quic/core/quic_connection.cc
@@ -65,6 +65,7 @@
 
   void OnAlarm() override {
     DCHECK(connection_->ack_frame_updated());
+    DCHECK(connection_->connected());
     QuicConnection::ScopedPacketFlusher flusher(connection_);
     if (connection_->SupportsMultiplePacketNumberSpaces()) {
       connection_->SendAllPendingAcks();
@@ -88,7 +89,10 @@
   RetransmissionAlarmDelegate& operator=(const RetransmissionAlarmDelegate&) =
       delete;
 
-  void OnAlarm() override { connection_->OnRetransmissionTimeout(); }
+  void OnAlarm() override {
+    DCHECK(connection_->connected());
+    connection_->OnRetransmissionTimeout();
+  }
 
  private:
   QuicConnection* connection_;
@@ -103,7 +107,10 @@
   SendAlarmDelegate(const SendAlarmDelegate&) = delete;
   SendAlarmDelegate& operator=(const SendAlarmDelegate&) = delete;
 
-  void OnAlarm() override { connection_->WriteAndBundleAcksIfNotBlocked(); }
+  void OnAlarm() override {
+    DCHECK(connection_->connected());
+    connection_->WriteAndBundleAcksIfNotBlocked();
+  }
 
  private:
   QuicConnection* connection_;
@@ -116,7 +123,10 @@
   PingAlarmDelegate(const PingAlarmDelegate&) = delete;
   PingAlarmDelegate& operator=(const PingAlarmDelegate&) = delete;
 
-  void OnAlarm() override { connection_->OnPingTimeout(); }
+  void OnAlarm() override {
+    DCHECK(connection_->connected());
+    connection_->OnPingTimeout();
+  }
 
  private:
   QuicConnection* connection_;
@@ -130,7 +140,10 @@
   MtuDiscoveryAlarmDelegate& operator=(const MtuDiscoveryAlarmDelegate&) =
       delete;
 
-  void OnAlarm() override { connection_->DiscoverMtu(); }
+  void OnAlarm() override {
+    DCHECK(connection_->connected());
+    connection_->DiscoverMtu();
+  }
 
  private:
   QuicConnection* connection_;
@@ -146,6 +159,7 @@
       const ProcessUndecryptablePacketsAlarmDelegate&) = delete;
 
   void OnAlarm() override {
+    DCHECK(connection_->connected());
     QuicConnection::ScopedPacketFlusher flusher(connection_);
     connection_->MaybeProcessUndecryptablePackets();
   }
diff --git a/quic/core/quic_packet_creator.cc b/quic/core/quic_packet_creator.cc
index fb574fc..bfced90 100644
--- a/quic/core/quic_packet_creator.cc
+++ b/quic/core/quic_packet_creator.cc
@@ -1619,6 +1619,13 @@
     }
   }
 
+  // If this is an ACK frame, validate that it is non-empty and that
+  // largest_acked matches the max packet number.
+  DCHECK(frame.type != ACK_FRAME ||
+         (!frame.ack_frame->packets.Empty() &&
+          frame.ack_frame->packets.Max() == frame.ack_frame->largest_acked))
+      << "Invalid ACK frame: " << frame;
+
   size_t frame_len = GetSerializedFrameLength(frame);
   if (frame_len == 0 && RemoveSoftMaxPacketLength()) {
     // Remove soft max_packet_length and retry.
@@ -1977,5 +1984,13 @@
   creator_->SetDefaultPeerAddress(old_peer_address_);
 }
 
+void QuicPacketCreator::set_encryption_level(EncryptionLevel level) {
+  DCHECK(level == packet_.encryption_level || !HasPendingFrames())
+      << "Cannot update encryption level from " << packet_.encryption_level
+      << " to " << level << " when we already have pending frames: "
+      << QuicFramesToString(queued_frames_);
+  packet_.encryption_level = level;
+}
+
 #undef ENDPOINT  // undef for jumbo builds
 }  // namespace quic
diff --git a/quic/core/quic_packet_creator.h b/quic/core/quic_packet_creator.h
index 2c1ff57..5edcff3 100644
--- a/quic/core/quic_packet_creator.h
+++ b/quic/core/quic_packet_creator.h
@@ -282,9 +282,7 @@
   void SetClientConnectionId(QuicConnectionId client_connection_id);
 
   // Sets the encryption level that will be applied to new packets.
-  void set_encryption_level(EncryptionLevel level) {
-    packet_.encryption_level = level;
-  }
+  void set_encryption_level(EncryptionLevel level);
   EncryptionLevel encryption_level() { return packet_.encryption_level; }
 
   // packet number of the last created packet, or 0 if no packets have been