It's too early to be absolutely certain, but from the logging data I've been collecting it seems that invalid DilloImage accesses always come from this call sequence: a_Bw_stop_clients() -> a_Capi_stop_client() -> a_Cache_stop_client() -> Cache_client_dequeue() -> a_Web_free() -> a_Image_unref() -> Image_free() -> dFree() So the question is: why isn't this call sequence stopping the image callbacks from running before it dFree()s the image? When Cache_process_queue() sees that all the data has arrived for a client it executes "(Client->Callback)(CA_Close, Client);" before calling Cache_client_dequeue(). Perhaps the fix is for a_Cache_stop_client() to close the client too? Regards, Jeremy Henty PS: Interestingly, a_Bw_stop_clients() has a comment: /* * Stop the active clients of this bw's top page. * Note: rendering stops, but the cache continues to be fed. */ This seems to be talking about our problem: the cache is still running and therefore accessing the client, but the client has been freed.