A surprise with mutexes and reference counts

If you define "unlock is complete" as the point where other threads are allowed to run in the critical section, then you're right, that can't happen. If I understand the issue correctly, the problem is that this happens before we return from mutex_unlock(), and mutex_unlock() continues to access the memory for the mutex after it's been unlocked and other threads have been allowed to run. These other threads could free the memory which holds the mutex, leading to an invalid memory access in mutex_unlock().