A dns_rpz_unref_rpzs() call is missing when taking the 'goto unlock;' path on shutdown, in order to compensate for the earlier dns_rpz_ref_rpzs() call. Move the dns_rpz_ref_rpzs() call after the shutdown check.