There's a slight possibility of race in dig code

in bin/dig/dighost.c query_clear unlinks the query, which sets link->prev/next to (void*) -1, but if the response is still in flight then we'll try to dereference this link in send_done.