Funny thing. So when initializing LXC driver's capabilities, firstly the virLXCDriverGetCapabilities() is called. This creates new capabilities, stores them under driver->caps, ref() them and return them. However, the return value is ignored. Secondly, the function is called yet again and since we have driver->caps set, they are ref()-ed again an returned. So in the end, driver's capabilities have refcount of three when in fact they should have refcount of one. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com&gt; ---  src/lxc/lxc_driver.c | 6 ++----  1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c index 6eb88b0ba..784edad39 100644 --- a/src/lxc/lxc_driver.c +++ b/src/lxc/lxc_driver.c @@ -1660,7 +1660,7 @@ static int lxcStateInitialize(bool privileged,      if (!(lxc_driver->hostdevMgr = virHostdevManagerGetDefault()))          goto cleanup;   -    if ((virLXCDriverGetCapabilities(lxc_driver, true)) == NULL) +    if (!(caps = virLXCDriverGetCapabilities(lxc_driver, true)))          goto cleanup;        if (!(lxc_driver->xmlopt = lxcDomainXMLConfInit())) @@ -1669,9 +1669,6 @@ static int lxcStateInitialize(bool privileged,      if (!(lxc_driver->closeCallbacks = virCloseCallbacksNew()))          goto cleanup;   -    if (!(caps = virLXCDriverGetCapabilities(lxc_driver, false))) -        goto cleanup; -      if (virFileMakePath(cfg->stateDir) < 0) {          virReportSystemError(errno,                               _("Failed to mkdir %s"), @@ -1700,6 +1697,7 @@ static int lxcStateInitialize(bool privileged,          goto cleanup;        virNWFilterRegisterCallbackDriver(&lxcCallbackDriver); +    virObjectUnref(caps);      return 0;     cleanup: