iptables-1.2.11/libiptc/libiptc.c:

int
TC_COMMIT(TC_HANDLE_T *handle)
{
...

        if (setsockopt(sockfd, TC_IPPROTO, SO_SET_REPLACE, repl,
 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;sizeof(*repl)  + (*handle)->entries.size) < 0) {
 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;free(repl-&g t;counters);
 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;free(repl);
 
 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;free(newcoun ters);
 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return  0;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }
...

/usr/src/linux/net/ipv4/netfilter/ip_tables.c:

static struct ipt_table_info *
replace_table(struct ipt_table *table,
                  unsigned int num_counters,
                  struct ipt_table_info *newinfo,
                  int *error)
{
...
        /* Do the substitution. */
        write_lock_bh(&table->lock);
        /* Check inside lock: is the old number correct? */
        if (num_counters != table->private->number) {
                    duprintf("num_counters != table->private->number (%u/%u)\n",
                                num_counters, table->private->number);
                    write_unlock_bh(&table->lock);
                    *error = -EAGAIN;                                              
                    return  NULL;
        }
...
}