Is only ever set to 1 from what I can grep of the code. So when listen.c calls /* * Find the original request in the request list */ oldreq = rl_find_proxy(packet); which in turn executes node = rbtree_find(proxy_tree, &myrequest); if (node) { maybe = rbtree_node2data(proxy_tree, node); rad_assert(maybe->proxy_outstanding > 0); maybe->proxy_outstanding--; /* * Received all of the replies we expect. * delete it from both trees. */ if (maybe->proxy_outstanding == 0) { rl_delete_proxy(&myrequest, node); } } pthread_mutex_unlock(&proxy_mutex); return maybe; How can it be possible (what parts of the code have I not paid sufficient attention to) for this to happen in listen.c ? /* * If there is already a reply, maybe this one is a * duplicate? */ if (oldreq->proxy_reply) { if (memcmp(oldreq->proxy_reply->vector, packet->vector, sizeof(oldreq->proxy_reply->vector)) == 0) { radlog(L_ERR, "Discarding duplicate reply from home server %s port %d - ID: %d for request %d", inet_ntop(packet->src_ipaddr.af,