The CF inheritance could cause double frees of the underlying objects.
Fixed.
diff --git a/Mac/Modules/cf/_CFmodule.c b/Mac/Modules/cf/_CFmodule.c
index 8543331..04e1624 100644
--- a/Mac/Modules/cf/_CFmodule.c
+++ b/Mac/Modules/cf/_CFmodule.c
@@ -158,6 +158,7 @@
 	if (self->ob_freeit && self->ob_itself)
 	{
 		self->ob_freeit((CFTypeRef)self->ob_itself);
+		self->ob_itself = NULL;
 	}
 	self->ob_type->tp_free((PyObject *)self);
 }
@@ -519,6 +520,7 @@
 	if (self->ob_freeit && self->ob_itself)
 	{
 		self->ob_freeit((CFTypeRef)self->ob_itself);
+		self->ob_itself = NULL;
 	}
 	self->ob_type->tp_base->tp_dealloc((PyObject *)self);
 }
@@ -728,6 +730,7 @@
 	if (self->ob_freeit && self->ob_itself)
 	{
 		self->ob_freeit((CFTypeRef)self->ob_itself);
+		self->ob_itself = NULL;
 	}
 	self->ob_type->tp_base->tp_dealloc((PyObject *)self);
 }
@@ -966,6 +969,7 @@
 	if (self->ob_freeit && self->ob_itself)
 	{
 		self->ob_freeit((CFTypeRef)self->ob_itself);
+		self->ob_itself = NULL;
 	}
 	self->ob_type->tp_base->tp_dealloc((PyObject *)self);
 }
@@ -1157,6 +1161,7 @@
 	if (self->ob_freeit && self->ob_itself)
 	{
 		self->ob_freeit((CFTypeRef)self->ob_itself);
+		self->ob_itself = NULL;
 	}
 	self->ob_type->tp_base->tp_dealloc((PyObject *)self);
 }
@@ -1338,6 +1343,7 @@
 	if (self->ob_freeit && self->ob_itself)
 	{
 		self->ob_freeit((CFTypeRef)self->ob_itself);
+		self->ob_itself = NULL;
 	}
 	self->ob_type->tp_base->tp_dealloc((PyObject *)self);
 }
@@ -1561,6 +1567,7 @@
 	if (self->ob_freeit && self->ob_itself)
 	{
 		self->ob_freeit((CFTypeRef)self->ob_itself);
+		self->ob_itself = NULL;
 	}
 	self->ob_type->tp_base->tp_dealloc((PyObject *)self);
 }
@@ -1839,6 +1846,7 @@
 	if (self->ob_freeit && self->ob_itself)
 	{
 		self->ob_freeit((CFTypeRef)self->ob_itself);
+		self->ob_itself = NULL;
 	}
 	self->ob_type->tp_base->tp_dealloc((PyObject *)self);
 }
@@ -2564,6 +2572,7 @@
 	if (self->ob_freeit && self->ob_itself)
 	{
 		self->ob_freeit((CFTypeRef)self->ob_itself);
+		self->ob_itself = NULL;
 	}
 	self->ob_type->tp_base->tp_dealloc((PyObject *)self);
 }
@@ -2950,6 +2959,7 @@
 	if (self->ob_freeit && self->ob_itself)
 	{
 		self->ob_freeit((CFTypeRef)self->ob_itself);
+		self->ob_itself = NULL;
 	}
 	self->ob_type->tp_base->tp_dealloc((PyObject *)self);
 }
diff --git a/Mac/Modules/cf/cfsupport.py b/Mac/Modules/cf/cfsupport.py
index f236e6d..95aeaa7 100644
--- a/Mac/Modules/cf/cfsupport.py
+++ b/Mac/Modules/cf/cfsupport.py
@@ -273,6 +273,7 @@
 		Output("if (self->ob_freeit && self->ob_itself)")
 		OutLbrace()
 		Output("self->ob_freeit((CFTypeRef)self->ob_itself);")
+		Output("self->ob_itself = NULL;")
 		OutRbrace()
 		
 	def outputCompare(self):