additional fix for the patch from bug 126087. Must not set symKey->slot to NULL after leaving the freelist lock, or somebody else might pick up the symKey from the freelist, have their slot NULL'ed, and whamo..

security/nss/lib/pk11wrap/pk11skey.c

@@ -268,9 +268,9 @@ PK11_FreeSymKey(PK11SymKey *symKey)
             PK11_USE_THREADS(PZ_Lock(slot->freeListLock);)
 	    symKey->next = slot->freeSymKeysHead;
 	    slot->freeSymKeysHead = symKey;
+	    symKey->slot = NULL;
 	    PK11_USE_THREADS(PZ_Unlock(slot->freeListLock);)
 	    PR_AtomicIncrement(&slot->keyCount);
-	    symKey->slot = NULL;
 	    freeit = PR_FALSE;
         }
         if (freeit) {