Index: /trunk/src/VBox/Runtime/r0drv/solaris/dbg-r0drv-solaris.c
===================================================================
--- /trunk/src/VBox/Runtime/r0drv/solaris/dbg-r0drv-solaris.c	(revision 40688)
+++ /trunk/src/VBox/Runtime/r0drv/solaris/dbg-r0drv-solaris.c	(revision 40689)
@@ -38,4 +38,5 @@
 #include <iprt/mem.h>
 #include <iprt/string.h>
+#include <iprt/thread.h>
 
 #include <sys/kobj.h>
@@ -48,7 +49,10 @@
 *   Structures and Typedefs                                                    *
 *******************************************************************************/
+/**
+ * Solaris kernel debug info instance data.
+ */
 typedef struct RTDBGKRNLINFOINT
 {
-    /** Magic value (). */
+    /** Magic value (RTDBGKRNLINFO_MAGIC). */
     uint32_t volatile   u32Magic;
     /** The number of threads referencing this object. */
@@ -59,5 +63,7 @@
     modctl_t           *pGenUnixMod;
 } RTDBGKRNLINFOINT;
+/** Pointer to the solaris kernel debug info instance data. */
 typedef struct RTDBGKRNLINFOINT *PRTDBGKRNLINFOINT;
+
 /** Magic value for RTDBGKRNLINFOINT::u32Magic. (John Carmack) */
 #define RTDBGKRNLINFO_MAGIC       UINT32_C(0x19700820)
@@ -74,5 +80,12 @@
         return VERR_NO_MEMORY;
 
-    int rc = VINF_SUCCESS;
+    int rc;
+    /** @todo r=bird: Where do we release this module? I see other users (crypto) of
+     * this API mod_release_mod().  Not sure if this is a real issue with a primary 
+     * module like genunix, though.  Another thing, I noticed that mod_hold_by_name 
+     * will (a) allocated a module if not found and (b) replace the filename with 
+     * what you hand in under certain conditions.  These issues doesn't apply with 
+     * genunix, but is worth keeping in mind if other modules needs to be held.  A 
+     * safer alternative would probably be mod_name_to_modid + mod_hold_by_id. */ 
     pThis->pGenUnixMod = mod_hold_by_name("genunix");
     if (RT_LIKELY(pThis->pGenUnixMod))
@@ -94,9 +107,7 @@
             return VINF_SUCCESS;
         }
-        else
-        {
-            LogRel(("RTR0DbgKrnlInfoOpen: ctf_modopen failed. err=%d\n", err));
-            rc = VERR_INTERNAL_ERROR_2;
-        }
+
+        LogRel(("RTR0DbgKrnlInfoOpen: ctf_modopen failed. err=%d\n", err));
+        rc = VERR_INTERNAL_ERROR_2;
     }
     else
@@ -116,13 +127,11 @@
     Assert(cRefs && cRefs < 100000);
     NOREF(cRefs);
-}
-
-static void rtR0DbgKrnlInfoDestroy(RTDBGKRNLINFO hKrnlInfo)
-{
-    PRTDBGKRNLINFOINT pThis = hKrnlInfo;
-    AssertPtrReturnVoid(pThis);
-    AssertPtrReturnVoid(pThis->u32Magic == RTDBGKRNLINFO_MAGIC);
-    RT_ASSERT_PREEMPTIBLE();
-
+    return cRefs;
+}
+
+
+static void rtR0DbgKrnlInfoDestroy(PRTDBGKRNLINFOINT pThis)
+{
+    pThis->u32Magic = ~RTDBGKRNLINFO_MAGIC;
     ctf_close(pThis->pGenUnixCTF);
     mod_release_mod(pThis->pGenUnixMod);
@@ -138,11 +147,13 @@
     RT_ASSERT_PREEMPTIBLE();
 
-    if (ASMAtomicDecU32(&pThis->cRefs) == 0)
+    uint32_t cRefs = ASMAtomicDecU32(&pThis->cRefs);
+    if (cRefs == 0)
         rtR0DbgKrnlInfoDestroy(pThis);
+    return cRefs;
 }
 
 
 RTR0DECL(int) RTR0DbgKrnlInfoQueryMember(RTDBGKRNLINFO hKrnlInfo, const char *pszStructure,
-                                               const char *pszMember, size_t *poffMember)
+                                         const char *pszMember, size_t *poffMember)
 {
     PRTDBGKRNLINFOINT pThis = hKrnlInfo;
@@ -179,8 +190,8 @@
     AssertPtrReturn(pszSymbol, VERR_INVALID_PARAMETER);
     AssertPtrReturn(ppvSymbol, VERR_INVALID_PARAMETER);
-    RT_ASSERT_PREEMPTIBLE();
-
-    NOREF(pszModule);
-    *ppvSymbol = kobj_getsymvalue(pszSymbol, 1 /* only kernel */);
+    AssertReturn(!pszModule, VERR_MODULE_NOT_FOUND);
+    RT_ASSERT_PREEMPTIBLE();
+
+    *ppvSymbol = (void *)kobj_getsymvalue((char *)pszSymbol, 1 /* only kernel */);
     if (*ppvSymbol)
         return VINF_SUCCESS;