Fix a use-after-free bug in dns_xfrin_create()

'xfr' is used after detaching the only reference, which would have destroyed the object.

Call dns_xfrin_detach() only after the final use of 'xfr'.