--- sys/libprop/prop_ingest.c	2026-06-29 12:51:19.000000000 +0000
+++ /tmp/opencode/prop_ingest_fixed.c	2026-10-10 06:30:07.526028187 +0000
@@ -149,10 +149,20 @@
 			ctx->pic_error = PROP_INGEST_ERROR_WRONG_TYPE;
 			return (false);
 		}
+		/*
+		 * Pin the object across the handler callback: the
+		 * dictionary is unlocked here (prop_dictionary_get()
+		 * drops pd_rwlock before returning) and another thread
+		 * may drop the key's last reference while the handler
+		 * runs, freeing the object out from under it.
+		 */
+		prop_object_retain(obj);
 		if ((*pite->pite_handler)(ctx, obj) == false) {
+			prop_object_release(obj);
 			ctx->pic_error = PROP_INGEST_ERROR_HANDLER_FAILED;
 			return (false);
 		}
+		prop_object_release(obj);
 	}
 
 	return (true);