GENA bug in UPnP SDK

Hi all,
This bug has come up when i have reduced the thread usage in UPnP stack to two: one main thread and other for timer. 
Two control points subscribe to same service of the device.
One of them sets the new value of the service state variable.
Notification message is sent to only the last control point which has subscribed.

This is because in genaNotifyAll() function, the following code is executed,

                thread_struct->reference_count = reference_count;
                thread_struct->UDN = UDN_copy;
                thread_struct->servId = servId_copy;
                thread_struct->headers = headers;
                thread_struct->propertySet = propertySet;
                strcpy( thread_struct->sid, finger->sid );
                thread_struct->eventKey = finger->eventKey++;
                thread_struct->device_handle = device_handle;

and the "thread_struct" is passed on to the genaNotifyThread function which tries to free the structure. When genaNotifyAll() tries to send the notification to other control point, it executes the above piece of code again but since the memory (for reference_count, UDN_copy, headers and propertySet) are already being freed, it was unable to do so. I have replaced  the above code with the following as a temporary measure and its working fine....

                ( *reference_count )++;

                thread_struct->reference_count = reference_count;
                thread_struct->UDN = UDN_copy;
                thread_struct->servId = servId_copy;
                thread_struct->headers = headers;
                thread_struct->propertySet = propertySet;
                strcpy( thread_struct->sid, finger->sid );
                thread_struct->eventKey = finger->eventKey++;
                thread_struct->device_handle = device_handle;
                
                ( *reference_count )--;

The bug somehow doesn't come up when several threads being used in SDK..

Kindly check,
-Sandeep