In ShardingRecoveryService::acquireRecoverableCriticalSectionBlockWrites we take a database IS lock and a collection S lock. Then later we may insert a document into the config.collection_critical_sections collection, which takes database and collection IX locks. Thus if the namespace originally passed into the function is in the config database, we'll end up upgrading our database lock from IS to IX.