diff --git a/CHANGES b/CHANGES
index 276060d935..d88bc3084f 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+6043.	[bug]		The key file IO locks objects would never get
+			deleted from the hashtable due to off-by-one error.
+			[GL #3727]
+
 6042.	[bug]		ANY responses could sometimes have the wrong TTL.
 			[GL #3613]
 
diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index 9383fdc4d7..1a3ed8518a 100644
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -73,6 +73,12 @@ Bug Fixes
 - The ``named`` would wait for some outstanding recursing queries
   to finish before shutting down.  This has been fixed.  :gl:`#3183`
 
+- When a zone is deleted from a server, an key management objects related to
+  that zone would be kept in the memory and released only at the server
+  shutdown.  This could lead to constantly increasing memory usage for servers
+  with a high zone churn. :gl:`#3727`
+
+
 Known Issues
 ~~~~~~~~~~~~
 
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 47e506b7df..04891f509a 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -18959,7 +18959,7 @@ zonemgr_keymgmt_delete(dns_zonemgr_t *zmgr, dns_zone_t *zone) {
 		if (dns_name_equal(kfio->name, &zone->origin)) {
 			unsigned int count;
 
-			count = atomic_fetch_sub_relaxed(&kfio->count, 1);
+			count = atomic_fetch_sub_relaxed(&kfio->count, 1) - 1;
 			if (count > 0) {
 				/* Keep the entry. */
 				break;