There can be an update running in another thread, so use a lock, like it's done in dns_catz_postreconfig().