Index: /trunk/src/VBox/Devices/Audio/DrvAudio.cpp
===================================================================
--- /trunk/src/VBox/Devices/Audio/DrvAudio.cpp	(revision 107719)
+++ /trunk/src/VBox/Devices/Audio/DrvAudio.cpp	(revision 107720)
@@ -1490,5 +1490,5 @@
      * Release our stream reference.
      */
-    uint32_t cRefs = drvAudioStreamReleaseInternal(pThis, pStreamEx, true /*fMayDestroy*/);
+    uint32_t const cRefs = drvAudioStreamReleaseInternal(pThis, pStreamEx, true /*fMayDestroy*/);
     LogFlowFunc(("returns (fDestroyed=%d, cRefs=%u)\n", fDestroyed, cRefs)); RT_NOREF(cRefs);
 }
@@ -2120,5 +2120,6 @@
  * @param   pStreamEx       The stream to reference.
  * @param   fMayDestroy     Whether the caller is allowed to implicitly destroy
- *                          the stream or not.
+ *                          the stream or not.  The reference count must _not_
+ *                          reach zero if this is false!
  */
 static uint32_t drvAudioStreamReleaseInternal(PDRVAUDIO pThis, PDRVAUDIOSTREAM pStreamEx, bool fMayDestroy)
@@ -2156,4 +2157,5 @@
 
             drvAudioStreamFree(pStreamEx);
+            pStreamEx = NULL;
         }
         else
@@ -2169,5 +2171,5 @@
     }
 
-    Log12Func(("returns %u (%s)\n", cRefs, cRefs > 0 ? pStreamEx->Core.Cfg.szName : "destroyed"));
+    Log12Func(("returns %u (%s)\n", cRefs, cRefs > 0 ? pStreamEx->Core.Cfg.szName : "destroyed")); /* Not 101% safe, but it's logging. */
     return cRefs;
 }
@@ -2262,5 +2264,6 @@
                     LogFlowFunc(("Successfully cancelled pending pfnStreamInitAsync call (hReqInitAsync=%p).\n",
                                  pStreamEx->hReqInitAsync));
-                    drvAudioStreamReleaseInternal(pThis, pStreamEx, true /*fMayDestroy*/);
+                    uint32_t const cRefs = drvAudioStreamReleaseInternal(pThis, pStreamEx, true /*fMayDestroy*/);
+                    AssertStmt(cRefs > 0, pStreamEx = NULL);
                 }
                 else
@@ -2274,22 +2277,25 @@
                 RTCritSectLeave(&pStreamEx->Core.CritSect);
 
-            /*
-             * Now, if the backend requests asynchronous disabling and destruction
-             * push the disabling and destroying over to a worker thread.
-             *
-             * This is a general offloading feature that all backends should make use of,
-             * however it's rather precarious on macs where stopping an already draining
-             * stream may take 8-10ms which naturally isn't something we should be doing
-             * on an EMT.
-             */
-            if (!(pThis->BackendCfg.fFlags & PDMAUDIOBACKEND_F_ASYNC_STREAM_DESTROY))
-                drvAudioStreamDestroyAsync(pThis, pStreamEx, fImmediate);
-            else
+            if (RT_LIKELY(pStreamEx != NULL)) /* paranoia^2 */
             {
-                int rc2 = RTReqPoolCallEx(pThis->hReqPool, 0 /*cMillies*/, NULL /*phReq*/,
-                                          RTREQFLAGS_VOID | RTREQFLAGS_NO_WAIT,
-                                          (PFNRT)drvAudioStreamDestroyAsync, 3, pThis, pStreamEx, fImmediate);
-                LogFlowFunc(("hReqInitAsync=%p rc2=%Rrc\n", pStreamEx->hReqInitAsync, rc2));
-                AssertRCStmt(rc2, drvAudioStreamDestroyAsync(pThis, pStreamEx, fImmediate));
+                /*
+                 * Now, if the backend requests asynchronous disabling and destruction
+                 * push the disabling and destroying over to a worker thread.
+                 *
+                 * This is a general offloading feature that all backends should make use of,
+                 * however it's rather precarious on macs where stopping an already draining
+                 * stream may take 8-10ms which naturally isn't something we should be doing
+                 * on an EMT.
+                 */
+                if (!(pThis->BackendCfg.fFlags & PDMAUDIOBACKEND_F_ASYNC_STREAM_DESTROY))
+                    drvAudioStreamDestroyAsync(pThis, pStreamEx, fImmediate);
+                else
+                {
+                    int rc2 = RTReqPoolCallEx(pThis->hReqPool, 0 /*cMillies*/, NULL /*phReq*/,
+                                              RTREQFLAGS_VOID | RTREQFLAGS_NO_WAIT,
+                                              (PFNRT)drvAudioStreamDestroyAsync, 3, pThis, pStreamEx, fImmediate);
+                    LogFlowFunc(("hReqInitAsync=%p rc2=%Rrc\n", pStreamEx->hReqInitAsync, rc2));
+                    AssertRCStmt(rc2, drvAudioStreamDestroyAsync(pThis, pStreamEx, fImmediate));
+                }
             }
         }
@@ -3950,6 +3956,6 @@
     pIHostDrvAudio->pfnDoOnWorkerThread(pIHostDrvAudio, pStreamEx->pBackend, uUser, pvUser);
 
-    drvAudioStreamReleaseInternal(pThis, pStreamEx, true /*fMayDestroy*/);
-    LogFlowFunc(("returns\n"));
+    uint32_t const cRefs = drvAudioStreamReleaseInternal(pThis, pStreamEx, true /*fMayDestroy*/);
+    LogFlowFunc(("returns (cRefs=%u)\n", cRefs)); RT_NOREF(cRefs);
 }
 
