diff --git a/server/timer.c b/server/timer.c
index a76ce41..fd9604a 100644
--- a/server/timer.c
+++ b/server/timer.c
@@ -174,10 +174,10 @@
 {
     struct timer *timer;
 
-    req->handle = 0;
-    if ((timer = create_timer( get_req_data(req), get_req_data_size(req), req->manual )))
+    reply->handle = 0;
+    if ((timer = create_timer( get_req_data(), get_req_data_size(), req->manual )))
     {
-        req->handle = alloc_handle( current->process, timer, TIMER_ALL_ACCESS, req->inherit );
+        reply->handle = alloc_handle( current->process, timer, TIMER_ALL_ACCESS, req->inherit );
         release_object( timer );
     }
 }
@@ -185,8 +185,8 @@
 /* open a handle to a timer */
 DECL_HANDLER(open_timer)
 {
-    req->handle = open_object( get_req_data(req), get_req_data_size(req),
-                               &timer_ops, req->access, req->inherit );
+    reply->handle = open_object( get_req_data(), get_req_data_size(),
+                                 &timer_ops, req->access, req->inherit );
 }
 
 /* set a waitable timer */