There is a race in the new initial sync code where Fetcher::cancel() can be called while we're in a previous batch's _callback() but before the next batch is scheduled. This means that Fetcher::cancel() is called when the callback handle is invalid, and thus Fetcher::_inShutdown is never set to true. The next batch is then scheduled and _inShutdown is never set to false.