Index: uspace/srv/devman/devtree.c
===================================================================
--- uspace/srv/devman/devtree.c	(revision 1b555f0f94be7888c575a30bc1af6160270e2663)
+++ uspace/srv/devman/devtree.c	(revision f89204ee0a3534e30bb9936dc9a0cb7d7bf43303)
@@ -144,6 +144,9 @@
 	}
 
-	fun_add_ref(fun);
-	insert_fun_node(tree, fun, str_dup(""), NULL);
+	if (!insert_fun_node(tree, fun, str_dup(""), NULL)) {
+		fun_del_ref(fun);	/* fun is destroyed */
+		fibril_rwlock_write_unlock(&tree->rwlock);
+		return false;
+	}
 
 	match_id_t *id = create_match_id();
Index: uspace/srv/devman/drv_conn.c
===================================================================
--- uspace/srv/devman/drv_conn.c	(revision 1b555f0f94be7888c575a30bc1af6160270e2663)
+++ uspace/srv/devman/drv_conn.c	(revision f89204ee0a3534e30bb9936dc9a0cb7d7bf43303)
@@ -284,6 +284,8 @@
 
 	fun_node_t *fun = create_fun_node();
-	/* One reference for creation, one for us */
-	fun_add_ref(fun);
+	/*
+	 * Hold a temporary reference while we work with fun. The reference from
+	 * create_fun_node() moves to the device tree.
+	 */
 	fun_add_ref(fun);
 	fun->ftype = ftype;
@@ -300,5 +302,5 @@
 		fun_busy_unlock(fun);
 		fun_del_ref(fun);
-		delete_fun_node(fun);
+		fun_del_ref(fun);	/* fun is destroyed */
 		async_answer_0(call, ENOMEM);
 		return;