I've carefully reviewed this change, and I think it looks good.

Use_cnt is currently always checked after a flow is locked. In the past this was different.

With this change, the use_cnt update is done in the scope of the flow lock, instead of the hash row lock. As the hash row lock is only released after the flow is locked, there is no chance of a race condition where the flow manager would be able to get to the flow before the use_cnt is updated.

This also makes me wonder if use_cnt needs to be atomic still. I guess it should, as FlowDeReference is called w/o flow lock in a few places.