diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
index 27c0845c77..22b5e3edd6 100644
--- a/bin/dnssec/dnssec-signzone.c
+++ b/bin/dnssec/dnssec-signzone.c
@@ -3973,6 +3973,7 @@ main(int argc, char *argv[]) {
 			    &sign_finish);
 	}
 	isc_mutex_destroy(&namelock);
+	isc_rwlock_destroy(&keylist_lock);
 
 	return vresult == ISC_R_SUCCESS ? 0 : 1;
 }
diff --git a/lib/dns/keytable.c b/lib/dns/keytable.c
index 662570c749..c6f39302f9 100644
--- a/lib/dns/keytable.c
+++ b/lib/dns/keytable.c
@@ -240,7 +240,7 @@ delete_ds(dns_qp_t *qp, dns_keytable_t *keytable, dns_keynode_t *knode,
 	result = dns_rdata_fromstruct(&dsrdata, dns_rdataclass_in,
 				      dns_rdatatype_ds, ds, &b);
 	if (result != ISC_R_SUCCESS) {
-		RWUNLOCK(&knode->rwlock, isc_rwlocktype_write);
+		RWUNLOCK(&knode->rwlock, isc_rwlocktype_read);
 		return result;
 	}
 
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 20763e612c..a708bd0f0b 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -5121,6 +5121,8 @@ cleanup_nameservers:
 		fetchctx_detach(&fctx->parent);
 	}
 
+	dns_ede_invalidate(&fctx->edectx);
+	isc_mutex_destroy(&fctx->lock);
 	dns_resolver_detach(&fctx->res);
 	isc_mem_putanddetach(&fctx->mctx, fctx, sizeof(*fctx));