I think it's safer to lock here with:
MONOBJC_MUTEX_LOCK(&data->INSTANCES_MUTEX);

If all other places take the instance lock using LOCK_INSTANCES() then it's true you don't need it since the domain lock is taken. But, can we guarantee any future code will adhere to that and this won't come back as an issue? It may at least be worth adding a comment.