The dns_zone_getxfrintime() function fails to lock the zone before accessing its 'xfrintime' structure member, which can cause a data race between soa_query() and the statistics channel. Add the missing locking/unlocking pair, like it's done in numerous other similar functions.