The dns_zonemgr_releasezone() function makes a decision to destroy 'zmgr' (based on its references count, after decreasing it) inside a lock, and then destroys the object outside of the lock. This causes a race with dns_zonemgr_detach(), which could destroy the object in the meantime. Change dns_zonemgr_releasezone() to detach from 'zmgr' and destroy the object (if needed) using dns_zonemgr_detach(), outside of the lock.