diff --git a/CHANGES b/CHANGES
index 4681c78e8e..8060d208bd 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+3520.	[bug]		'mctx' was not being referenced counted in some places
+			where it should have been.  [RT #32794]
+
 	--- 9.9.3b2 released ---
 	
 3517.	[bug]		Reorder destruction to avoid shutdown race. [RT #32777]
diff --git a/bin/named/controlconf.c b/bin/named/controlconf.c
index 8a3d3b0932..bcdca274a2 100644
--- a/bin/named/controlconf.c
+++ b/bin/named/controlconf.c
@@ -149,7 +149,7 @@ free_listener(controllistener_t *listener) {
 	if (listener->acl != NULL)
 		dns_acl_detach(&listener->acl);
 
-	isc_mem_put(listener->mctx, listener, sizeof(*listener));
+	isc_mem_putanddetach(&listener->mctx, listener, sizeof(*listener));
 }
 
 static void
@@ -1066,8 +1066,9 @@ add_listener(ns_controls_t *cp, controllistener_t **listenerp,
 		result = ISC_R_NOMEMORY;
 
 	if (result == ISC_R_SUCCESS) {
+		listener->mctx = NULL;
+		isc_mem_attach(mctx, &listener->mctx);
 		listener->controls = cp;
-		listener->mctx = mctx;
 		listener->task = cp->server->task;
 		listener->address = *addr;
 		listener->sock = NULL;
diff --git a/bin/named/interfacemgr.c b/bin/named/interfacemgr.c
index f07258fc76..16b654858d 100644
--- a/bin/named/interfacemgr.c
+++ b/bin/named/interfacemgr.c
@@ -80,11 +80,13 @@ ns_interfacemgr_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
 	if (mgr == NULL)
 		return (ISC_R_NOMEMORY);
 
+	mgr->mctx = NULL;
+	isc_mem_attach(mctx, &mgr->mctx);
+
 	result = isc_mutex_init(&mgr->lock);
 	if (result != ISC_R_SUCCESS)
 		goto cleanup_mem;
 
-	mgr->mctx = mctx;
 	mgr->taskmgr = taskmgr;
 	mgr->socketmgr = socketmgr;
 	mgr->dispatchmgr = dispatchmgr;
@@ -116,7 +118,7 @@ ns_interfacemgr_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
 	ns_listenlist_detach(&mgr->listenon4);
 	ns_listenlist_detach(&mgr->listenon6);
  cleanup_mem:
-	isc_mem_put(mctx, mgr, sizeof(*mgr));
+	isc_mem_putanddetach(&mgr->mctx, mgr, sizeof(*mgr));
 	return (result);
 }
 
@@ -129,7 +131,7 @@ ns_interfacemgr_destroy(ns_interfacemgr_t *mgr) {
 	clearlistenon(mgr);
 	DESTROYLOCK(&mgr->lock);
 	mgr->magic = 0;
-	isc_mem_put(mgr->mctx, mgr, sizeof(*mgr));
+	isc_mem_putanddetach(&mgr->mctx, mgr, sizeof(*mgr));
 }
 
 dns_aclenv_t *
diff --git a/lib/dns/ssu.c b/lib/dns/ssu.c
index 83aa679361..189c597eb6 100644
--- a/lib/dns/ssu.c
+++ b/lib/dns/ssu.c
@@ -82,7 +82,8 @@ dns_ssutable_create(isc_mem_t *mctx, dns_ssutable_t **tablep) {
 		return (result);
 	}
 	table->references = 1;
-	table->mctx = mctx;
+	table->mctx = NULL;
+	isc_mem_attach(mctx, &table->mctx);
 	ISC_LIST_INIT(table->rules);
 	table->magic = SSUTABLEMAGIC;
 	*tablep = table;
@@ -115,7 +116,7 @@ destroy(dns_ssutable_t *table) {
 	}
 	DESTROYLOCK(&table->lock);
 	table->magic = 0;
-	isc_mem_put(mctx, table, sizeof(dns_ssutable_t));
+	isc_mem_putanddetach(&table->mctx, table, sizeof(dns_ssutable_t));
 }
 
 void
diff --git a/lib/dns/view.c b/lib/dns/view.c
index cff618651c..b64a00d45a 100644
--- a/lib/dns/view.c
+++ b/lib/dns/view.c
@@ -87,6 +87,9 @@ dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass,
 	view = isc_mem_get(mctx, sizeof(*view));
 	if (view == NULL)
 		return (ISC_R_NOMEMORY);
+
+	view->mctx = NULL;
+	isc_mem_attach(mctx, &view->mctx);
 	view->name = isc_mem_strdup(mctx, name);
 	if (view->name == NULL) {
 		result = ISC_R_NOMEMORY;
@@ -126,7 +129,6 @@ dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass,
 	view->resolver = NULL;
 	view->adb = NULL;
 	view->requestmgr = NULL;
-	view->mctx = mctx;
 	view->rdclass = rdclass;
 	view->frozen = ISC_FALSE;
 	view->task = NULL;
@@ -262,7 +264,7 @@ dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass,
 	isc_mem_free(mctx, view->name);
 
  cleanup_view:
-	isc_mem_put(mctx, view, sizeof(*view));
+	isc_mem_putanddetach(&view->mctx, view, sizeof(*view));
 
 	return (result);
 }
@@ -443,7 +445,7 @@ destroy(dns_view_t *view) {
 	DESTROYLOCK(&view->lock);
 	isc_refcount_destroy(&view->references);
 	isc_mem_free(view->mctx, view->name);
-	isc_mem_put(view->mctx, view, sizeof(*view));
+	isc_mem_putanddetach(&view->mctx, view, sizeof(*view));
 }
 
 /*
diff --git a/lib/dns/xfrin.c b/lib/dns/xfrin.c
index 55c79fa276..00defd70f5 100644
--- a/lib/dns/xfrin.c
+++ b/lib/dns/xfrin.c
@@ -783,7 +783,8 @@ xfrin_create(isc_mem_t *mctx,
 	xfr = isc_mem_get(mctx, sizeof(*xfr));
 	if (xfr == NULL)
 		return (ISC_R_NOMEMORY);
-	xfr->mctx = mctx;
+	xfr->mctx = NULL;
+	isc_mem_attach(mctx, &xfr->mctx);
 	xfr->refcount = 0;
 	xfr->zone = NULL;
 	dns_zone_iattach(zone, &xfr->zone);
@@ -878,7 +879,7 @@ xfrin_create(isc_mem_t *mctx,
 		dns_db_detach(&xfr->db);
 	isc_task_detach(&xfr->task);
 	dns_zone_idetach(&xfr->zone);
-	isc_mem_put(mctx, xfr, sizeof(*xfr));
+	isc_mem_putanddetach(&xfr->mctx, xfr, sizeof(*xfr));
 
 	return (result);
 }
@@ -1493,7 +1494,7 @@ maybe_free(dns_xfrin_ctx_t *xfr) {
 	if (xfr->zone != NULL)
 		dns_zone_idetach(&xfr->zone);
 
-	isc_mem_put(xfr->mctx, xfr, sizeof(*xfr));
+	isc_mem_putanddetach(&xfr->mctx, xfr, sizeof(*xfr));
 }
 
 /*
diff --git a/lib/isc/symtab.c b/lib/isc/symtab.c
index d4c1dccf0a..8cebb97840 100644
--- a/lib/isc/symtab.c
+++ b/lib/isc/symtab.c
@@ -71,15 +71,17 @@ isc_symtab_create(isc_mem_t *mctx, unsigned int size,
 	symtab = (isc_symtab_t *)isc_mem_get(mctx, sizeof(*symtab));
 	if (symtab == NULL)
 		return (ISC_R_NOMEMORY);
+
+	symtab->mctx = NULL;
+	isc_mem_attach(mctx, &symtab->mctx);
 	symtab->table = (eltlist_t *)isc_mem_get(mctx,
 						 size * sizeof(eltlist_t));
 	if (symtab->table == NULL) {
-		isc_mem_put(mctx, symtab, sizeof(*symtab));
+		isc_mem_putanddetach(&symtab->mctx, symtab, sizeof(*symtab));
 		return (ISC_R_NOMEMORY);
 	}
 	for (i = 0; i < size; i++)
 		INIT_LIST(symtab->table[i]);
-	symtab->mctx = mctx;
 	symtab->size = size;
 	symtab->count = 0;
 	symtab->maxload = size * 3 / 4;
@@ -117,7 +119,7 @@ isc_symtab_destroy(isc_symtab_t **symtabp) {
 	isc_mem_put(symtab->mctx, symtab->table,
 		    symtab->size * sizeof(eltlist_t));
 	symtab->magic = 0;
-	isc_mem_put(symtab->mctx, symtab, sizeof(*symtab));
+	isc_mem_putanddetach(&symtab->mctx, symtab, sizeof(*symtab));
 
 	*symtabp = NULL;
 }
diff --git a/lib/isc/taskpool.c b/lib/isc/taskpool.c
index 25d9516828..8d6cdaa0e0 100644
--- a/lib/isc/taskpool.c
+++ b/lib/isc/taskpool.c
@@ -52,13 +52,15 @@ alloc_pool(isc_taskmgr_t *tmgr, isc_mem_t *mctx, unsigned int ntasks,
 	pool = isc_mem_get(mctx, sizeof(*pool));
 	if (pool == NULL)
 		return (ISC_R_NOMEMORY);
-	pool->mctx = mctx;
+
+	pool->mctx = NULL;
+	isc_mem_attach(mctx, &pool->mctx);
 	pool->ntasks = ntasks;
 	pool->quantum = quantum;
 	pool->tmgr = tmgr;
 	pool->tasks = isc_mem_get(mctx, ntasks * sizeof(isc_task_t *));
 	if (pool->tasks == NULL) {
-		isc_mem_put(mctx, pool, sizeof(*pool));
+		isc_mem_putanddetach(&pool->mctx, pool, sizeof(*pool));
 		return (ISC_R_NOMEMORY);
 	}
 	for (i = 0; i < ntasks; i++)
@@ -168,7 +170,7 @@ isc_taskpool_destroy(isc_taskpool_t **poolp) {
 	}
 	isc_mem_put(pool->mctx, pool->tasks,
 		    pool->ntasks * sizeof(isc_task_t *));
-	isc_mem_put(pool->mctx, pool, sizeof(*pool));
+	isc_mem_putanddetach(&pool->mctx, pool, sizeof(*pool));
 	*poolp = NULL;
 }
 
diff --git a/lib/isccfg/parser.c b/lib/isccfg/parser.c
index 7afdf1dd6d..de0fa31ee2 100644
--- a/lib/isccfg/parser.c
+++ b/lib/isccfg/parser.c
@@ -387,13 +387,15 @@ cfg_parser_create(isc_mem_t *mctx, isc_log_t *lctx, cfg_parser_t **ret) {
 	if (pctx == NULL)
 		return (ISC_R_NOMEMORY);
 
+	pctx->mctx = NULL;
+	isc_mem_attach(mctx, &pctx->mctx);
+
 	result = isc_refcount_init(&pctx->references, 1);
 	if (result != ISC_R_SUCCESS) {
-		isc_mem_put(mctx, pctx, sizeof(*pctx));
+		isc_mem_putanddetach(&pctx->mctx, pctx, sizeof(*pctx));
 		return (result);
 	}
 
-	pctx->mctx = mctx;
 	pctx->lctx = lctx;
 	pctx->lexer = NULL;
 	pctx->seen_eof = ISC_FALSE;
@@ -434,7 +436,7 @@ cfg_parser_create(isc_mem_t *mctx, isc_log_t *lctx, cfg_parser_t **ret) {
 		isc_lex_destroy(&pctx->lexer);
 	CLEANUP_OBJ(pctx->open_files);
 	CLEANUP_OBJ(pctx->closed_files);
-	isc_mem_put(mctx, pctx, sizeof(*pctx));
+	isc_mem_putanddetach(&pctx->mctx, pctx, sizeof(*pctx));
 	return (result);
 }
 
@@ -555,7 +557,7 @@ cfg_parser_destroy(cfg_parser_t **pctxp) {
 		 */
 		CLEANUP_OBJ(pctx->open_files);
 		CLEANUP_OBJ(pctx->closed_files);
-		isc_mem_put(pctx->mctx, pctx, sizeof(*pctx));
+		isc_mem_putanddetach(&pctx->mctx, pctx, sizeof(*pctx));
 	}
 	*pctxp = NULL;
 }