During TLS client connection shutdown, a deadlock can happen, blocking all radius messages being forwarded (except status-server).

If a request was originated from a TLS client, forwarded to a dynamically discovered TLS server and a reply was correctly received and sent back to the client; And after that, the server connection is terminated followed by the client connection, the deadlock can happen.

During the TLS client connection shutdown, the dupcache is cleaned up. The successful request is still in this cache, and the rq->to field still points to the server. But the server has already terminated and freed its memory.