darwin: do not set NULL device in darwin_reload_device

We need to maintain the invariant that `device` is never an invalid
pointer because another thread might be concurrently accessing it. We
want that thread to error from an outdated `device` rather than crash
on a NULL pointer.

Author: osy

libusb/os/darwin_usb.c

@@ -2857,10 +2857,14 @@ static bool darwin_has_capture_entitlements (void) {
 static int darwin_reload_device (struct libusb_device_handle *dev_handle) {
   struct darwin_cached_device *dpriv = DARWIN_CACHED_DEVICE(dev_handle->dev);
   enum libusb_error err;
+  usb_device_t **new_device;
 
   usbi_mutex_lock(&darwin_cached_devices_mutex);
-  (*dpriv->device)->Release(dpriv->device);
-  err = darwin_device_from_service (HANDLE_CTX (dev_handle), dpriv->service, &dpriv->device);
+  err = darwin_device_from_service (HANDLE_CTX (dev_handle), dpriv->service, &new_device);
+  if (err == LIBUSB_SUCCESS) {
+    (*dpriv->device)->Release(dpriv->device);
+    dpriv->device = new_device;
+  }
   usbi_mutex_unlock(&darwin_cached_devices_mutex);
 
   return err;