peer_on_no_reqs was called unsafely in peer_on_choke. It should only be

called after removing the last request.

btpd/download_subr.c

@@ -415,6 +415,9 @@ dl_unassign_requests(struct peer *p)
             req = next;
         }
 
+        if (p->nreqs_out == 0)
+            peer_on_no_reqs(p);
+
         if (was_full && !piece_full(pc))
             dl_on_piece_unfull(pc);
     }
@@ -497,6 +500,7 @@ dl_unassign_requests_eg(struct peer *p)
         }
     }
     assert(BTPDQ_EMPTY(&p->my_reqs));
+    peer_on_no_reqs(p);
 
     pc = BTPDQ_FIRST(&tmp);
     while (pc != NULL) {

btpd/peer.c

@@ -369,8 +369,6 @@ peer_on_choke(struct peer *p)
     if ((p->flags & PF_P_CHOKE) != 0)
         return;
     else {
-        if (p->nreqs_out > 0)
-            peer_on_no_reqs(p);
         p->flags |= PF_P_CHOKE;
         dl_on_choke(p);
         struct nb_link *nl = BTPDQ_FIRST(&p->outq);