diff --git a/apps/wolfsshd/test/error_return.sh b/apps/wolfsshd/test/error_return.sh
index 8c876324..9240818b 100755
--- a/apps/wolfsshd/test/error_return.sh
+++ b/apps/wolfsshd/test/error_return.sh
@@ -2,7 +2,9 @@
 
 # sshd local test
 
-PWD=`pwd`
+# Not named PWD: the shell rewrites that variable on every cd, so a saved
+# copy would not survive the cd to the repository root below.
+TESTDIR=`pwd`
 cd ../../..
 
 TEST_CLIENT="./examples/client/client"
@@ -21,11 +23,11 @@ $TEST_CLIENT -c 'bash -c "(exit 2)"' -u $USER -i $PRIVATE_KEY -j $PUBLIC_KEY -h
 RESULT=$?
 if [ "$RESULT" != 2 ]; then
     echo "Expecting error return value of 2 for failed ls command, found $RESULT"
-    cd $PWD
+    cd "$TESTDIR"
     exit 1
 fi
 
-cd $PWD
+cd "$TESTDIR"
 exit 0
 
 
diff --git a/apps/wolfsshd/test/sshd_bad_sftp_test.sh b/apps/wolfsshd/test/sshd_bad_sftp_test.sh
index 362de3bf..c885b701 100755
--- a/apps/wolfsshd/test/sshd_bad_sftp_test.sh
+++ b/apps/wolfsshd/test/sshd_bad_sftp_test.sh
@@ -2,7 +2,9 @@
 
 # sshd local test
 
-PWD=`pwd`
+# Not named PWD: the shell rewrites that variable on every cd, so a saved
+# copy would not survive the cd to the repository root below.
+TESTDIR=`pwd`
 . ./wolfssh_options.sh
 cd ../../..
 
@@ -35,6 +37,6 @@ if [ "$RESULT" = "0" ]; then
 fi
 rm -rf test-$$
 
-cd $PWD
+cd "$TESTDIR"
 exit 0
 
diff --git a/apps/wolfsshd/test/sshd_exec_test.sh b/apps/wolfsshd/test/sshd_exec_test.sh
index 889bc24a..6cdf20cd 100755
--- a/apps/wolfsshd/test/sshd_exec_test.sh
+++ b/apps/wolfsshd/test/sshd_exec_test.sh
@@ -2,7 +2,9 @@
 
 # sshd local test
 
-PWD=`pwd`
+# Not named PWD: the shell rewrites that variable on every cd, so a saved
+# copy would not survive the cd to the repository root below.
+TESTDIR=`pwd`
 cd ../../..
 
 TEST_CLIENT="./examples/client/client"
@@ -22,6 +24,6 @@ $TEST_CLIENT -c 'ls' -u $USER -i $PRIVATE_KEY -j $PUBLIC_KEY -h "$1" -p "$2"
 
 set +e
 
-cd $PWD
+cd "$TESTDIR"
 exit 0
 
diff --git a/apps/wolfsshd/test/sshd_forcedcmd_test.sh b/apps/wolfsshd/test/sshd_forcedcmd_test.sh
index 9aa3adac..881bd091 100755
--- a/apps/wolfsshd/test/sshd_forcedcmd_test.sh
+++ b/apps/wolfsshd/test/sshd_forcedcmd_test.sh
@@ -8,11 +8,26 @@ if [ -z "$1" ] || [ -z "$2" ]; then
     exit 1
 fi
 
-PWD=`pwd`
+# Not named PWD: the shell rewrites that variable on every cd, so a saved copy
+# would not survive the cd to the repository root below.
+TESTDIR=`pwd`
 USER=`whoami`
 TEST_PORT="$2"
 TEST_HOST="$1"
 source ./start_sshd.sh
+
+# Stop the daemon on every exit path. From the "set -e" below onward an aborted
+# client run would otherwise leave a root daemon holding the shared test port,
+# and every later test in the suite would talk to this config.
+cleanup() {
+    if [ -n "$PID" ]; then
+        stop_wolfsshd
+        PID=""
+    fi
+    return 0
+}
+trap cleanup EXIT
+
 cat <<EOF > sshd_config_test_forcedcmd
 Port $TEST_PORT
 Protocol 2
@@ -22,8 +37,8 @@ PasswordAuthentication yes
 PermitEmptyPasswords no
 UsePrivilegeSeparation no
 UseDNS no
-HostKey $PWD/../../../keys/server-key.pem
-AuthorizedKeysFile $PWD/authorized_keys_test
+HostKey $TESTDIR/../../../keys/server-key.pem
+AuthorizedKeysFile $TESTDIR/authorized_keys_test
 
 Match User $USER
 	ForceCommand internal-sftp
@@ -49,8 +64,9 @@ fi
 set -e
 echo exit | $TEST_SFTP -u $USER -i $PRIVATE_KEY -j $PUBLIC_KEY -h $TEST_HOST -p $TEST_PORT
 
-cd $PWD
+cd "$TESTDIR"
 stop_wolfsshd
+PID=""
 
 # A configured ForceCommand that is not "internal-sftp" must still permit the
 # SFTP subsystem. Only a certificate force-command denies file transfer, so a
@@ -64,8 +80,8 @@ PasswordAuthentication yes
 PermitEmptyPasswords no
 UsePrivilegeSeparation no
 UseDNS no
-HostKey $PWD/../../../keys/server-key.pem
-AuthorizedKeysFile $PWD/authorized_keys_test
+HostKey $TESTDIR/../../../keys/server-key.pem
+AuthorizedKeysFile $TESTDIR/authorized_keys_test
 
 Match User $USER
 	ForceCommand /bin/echo
@@ -76,8 +92,9 @@ cd ../../..
 
 echo exit | $TEST_SFTP -u $USER -i $PRIVATE_KEY -j $PUBLIC_KEY -h $TEST_HOST -p $TEST_PORT
 
-cd $PWD
+cd "$TESTDIR"
 stop_wolfsshd
+PID=""
 exit 0
 
 
diff --git a/apps/wolfsshd/test/sshd_large_sftp_test.sh b/apps/wolfsshd/test/sshd_large_sftp_test.sh
index 6699eae2..4f177a37 100755
--- a/apps/wolfsshd/test/sshd_large_sftp_test.sh
+++ b/apps/wolfsshd/test/sshd_large_sftp_test.sh
@@ -2,7 +2,9 @@
 
 # sshd local test
 
-PWD=`pwd`
+# Not named PWD: the shell rewrites that variable on every cd, so a saved
+# copy would not survive the cd to the repository root below.
+TESTDIR=`pwd`
 . ./wolfssh_options.sh
 cd ../../..
 
@@ -56,6 +58,6 @@ rm -f "$REMOTE_FILE"
 
 set +e
 
-cd $PWD
+cd "$TESTDIR"
 exit 0
 
diff --git a/apps/wolfsshd/test/sshd_scp_fail.sh b/apps/wolfsshd/test/sshd_scp_fail.sh
index 02569853..04382faa 100755
--- a/apps/wolfsshd/test/sshd_scp_fail.sh
+++ b/apps/wolfsshd/test/sshd_scp_fail.sh
@@ -2,7 +2,9 @@
 
 # sshd local test
 
-PWD=`pwd`
+# Not named PWD: the shell rewrites that variable on every cd, so a saved
+# copy would not survive the cd to the repository root below.
+TESTDIR=`pwd`
 . ./wolfssh_options.sh
 cd ../../..
 
@@ -48,6 +50,6 @@ fi
 rm -rf test-$$
 rm testout.dat
 
-cd $PWD
+cd "$TESTDIR"
 exit 0
 
diff --git a/apps/wolfsshd/test/sshd_x509_test.sh b/apps/wolfsshd/test/sshd_x509_test.sh
index d52b03c2..e497a707 100755
--- a/apps/wolfsshd/test/sshd_x509_test.sh
+++ b/apps/wolfsshd/test/sshd_x509_test.sh
@@ -2,7 +2,9 @@
 
 # sshd local test
 
-PWD=`pwd`
+# Not named PWD: the shell rewrites that variable on every cd, so a saved
+# copy would not survive the cd to the repository root below.
+TESTDIR=`pwd`
 cd ../../..
 
 if [ -z "$1" ] || [ -z "$2" ] || [ -z "$3" ]; then
@@ -28,11 +30,11 @@ $TEST_CLIENT -X -c 'ls error' -u $3 -i "$PRIVATE_KEY" -J "$PUBLIC_KEY" -A "$CA_C
 # check stderr output was caught
 if [ ! -s error.txt ]; then
     echo "No stderr data was found when expected!!"
-    cd $PWD
+    cd "$TESTDIR"
     exit 1
 fi
 rm -f error.txt
 
-cd $PWD
+cd "$TESTDIR"
 exit 0
 
diff --git a/apps/wolfsshd/test/sshd_x509_upn_fail.sh b/apps/wolfsshd/test/sshd_x509_upn_fail.sh
index 0a19dcdb..8f0ca428 100755
--- a/apps/wolfsshd/test/sshd_x509_upn_fail.sh
+++ b/apps/wolfsshd/test/sshd_x509_upn_fail.sh
@@ -5,7 +5,10 @@
 # "other.example", while the client certificate carries the UPN realm
 # "example". The wolfSSHd UPN domain check must therefore reject the cert.
 
-PWD=`pwd`
+# Not named PWD: the shell rewrites that variable on every cd, so a saved copy
+# would not survive the cd to the repository root below -- and the log counted
+# after the client run lives here, not there.
+TESTDIR=`pwd`
 . ./wolfssh_options.sh
 
 # The UPN domain check is compiled only when wolfSSL is built with FPKI.
@@ -37,7 +40,7 @@ echo "$TEST_CLIENT -X -c 'pwd' -u $3 -i $PRIVATE_KEY -J $PUBLIC_KEY -A $CA_CERT
 $TEST_CLIENT -X -c 'pwd' -u "$3" -i "$PRIVATE_KEY" -J "$PUBLIC_KEY" -A "$CA_CERT" -h "$1" -p "$2"
 RESULT=$?
 
-cd "$PWD"
+cd "$TESTDIR"
 
 # Give the daemon child a moment to flush its rejection to the log.
 sleep 1
diff --git a/apps/wolfsshd/test/start_sshd.sh b/apps/wolfsshd/test/start_sshd.sh
index 1c553c07..3acb1da1 100755
--- a/apps/wolfsshd/test/start_sshd.sh
+++ b/apps/wolfsshd/test/start_sshd.sh
@@ -6,7 +6,13 @@ SSHD_KEYDIR=""
 
 # starts up a sshd session, takes in the sshd_config file as an argument
 start_wolfsshd() {
-    CURRENT_PIDS=`ps -e | grep wolfsshd | grep -oE "[0-9]+"`
+    # Snapshot the PIDs of any daemon already running so the new one can be
+    # picked out below. PIDs only: "ps -e" also prints TIME, and scraping
+    # every digit run off that line mixes clock digits in with the PID.
+    # Sorted so both snapshots order the same way. No daemon running is the
+    # normal case and pgrep exits 1 on no match, which would end a caller
+    # running under "set -e".
+    CURRENT_PIDS=`pgrep -x wolfsshd | sort -n` || true
 
     ORIGCFG="$1"
     CONFIG="$ORIGCFG"
@@ -86,9 +92,11 @@ EOF
     SSHD_BIN="${SSHD_BIN:-../wolfsshd}"
     sudo env $SSHD_ENV "$SSHD_BIN" -d -E ./log.txt -f "$CONFIG"
 
-    # set the PID of started sshd
-    NEW_PID=`ps -e | grep wolfsshd | grep -oE "[0-9]+"`
-    PID=`diff <(echo "$CURRENT_PIDS") <(echo "$NEW_PID") | grep '>' | grep -oE "[0-9]+" | head -n1`
+    # The PID of the started sshd is the one present now that was not there
+    # before. The daemon can still die after sudo returns, so guard the same
+    # way and let the caller's empty-PID check report it.
+    NEW_PIDS=`pgrep -x wolfsshd | sort -n` || true
+    PID=`diff <(echo "$CURRENT_PIDS") <(echo "$NEW_PIDS") | sed -n 's/^> *//p' | head -n1`
     printf "SSHD running on PID $PID\n"
 }