Crash during mosquitto_kick_client_by_clientid call

[D-r-P-3-p-p-3-r]

We're experiencing crashes when calling mosquitto_kick_client_by_clientid under Mosquitto 2.14. Because of issue #3056 we're not using a newer version of Mosquitto (which probably does not matter).

Scenario: We are running a self-written Mosquitto Plug-In. This plugin keeps a white list of devices that are allowed to connect to the broker. The white list content is set by an application via an REST API. If a device is removed from the white list and it is currently connected to the broker we kick it via mosquitto_kick_client_by_clientid . This happens in a thread that is started by the plugin (the thread that handles all the plug-in‘s logic). Occasionally during the calls to mosquitto_kick_client_by_clientid the broker crashes.

I suspect it happens when concurrently with the mosquitto_kick_client_by_clientid call an ACL check is performed in the plugin via Mosquitto.
Before entering the plug-in thread we're extracting information from the event_data (e.g. via mosquitto_client_id(), mosquitto_client_username(), mosquitto_client_certificate()) in Mosquittos own thread.

Is it not ok to call mosquitto_kick_client_by_clientid from a thread that is not Mosquitto's?

Or is the problem that mosquitto_kick_client_by_clientid and mosquitto_client_* are called at the same time from different threads?

Or are there other rules I am not aware of?

Unlike the libmosquitto documentation which states the following

libmosquitto provides thread-safe operation, with the exception of mosquitto_lib_init which is not thread safe.

the plug-in documentation does not talk about thread safety at all.