nta.c:fetch_done could call dns_resolver_destroyfetch on a fetch that hadn't been unlinked yet.