Found by inspection and very unlikely in real world.

If the call to __session_add_dhandle in __session_get_dhandle returns an error, we will have retrieved the handle and bumped the session_ref count, the reference count won't be decremented.

The code in __session_get_dhandle should cleanup on error.