Noticed by Andrew Walker <awalker@ixsystems.com>.

                set_sec_ctx(del_token->uid,
                                del_token->gid,
                                del_token->ngroups,
                                del_token->groups,
                                del_nt_token);

                if (!del_share_mode(lck, fsp)) {
                        DEBUG(0, ("close_directory: Could not delete share
entry for "
                                  "%s\n", fsp_str_dbg(fsp)));
                }

                TALLOC_FREE(lck);

                if ((fsp->conn->fs_capabilities & FILE_NAMED_STREAMS)
                    && !is_ntfs_stream_smb_fname(fsp->fsp_name)) {

                        status = delete_all_streams(fsp->conn,
fsp->fsp_name);
                        if (!NT_STATUS_IS_OK(status)) {
                                DEBUG(5, ("delete_all_streams failed: %s\n",
                                          nt_errstr(status)));
                                file_free(req, fsp);
                                return status;
                        }
                }

Shouldn't we be pop_sec_ctx() before returning status here? Am I
misunderstanding something?