In a multi-layered service configuration where there are services that use other services in their targets, the deletion of an upper level service (parent) is not taken into account by the lower level services (child) if done with maxctrl destroy service --force. This causes a use-after-free to take place the next time the parent pointer is accessed.

Additionally, in readwritesplit stale services are not removed from the per-service statistics. The diagnostics function accesses the pointers without first checking for the validity of it.