In ClientCnxn.queuePacket, it checks variables of state and closing and then make decisions. There is toctou race in queuePacket():
A possible race:
When it checks in queuePacket(), state is still alive. Then state isn't alive, SendThread.run() cleans up outgoingQueue. Then queuePacket adds packet to outgoingQueue. The packet should be waken up with exception. But it won't at this case.