net/socket/net_clone.c: On a failure to start the TCP monitor, the clone socket is closed but is not properly freed, leaving it attached to a TCP connection structure with the wrong reference count.

net/socket/net_clone.c

@@ -141,6 +141,12 @@ int net_clone(FAR struct socket *psock1, FAR struct socket *psock2)
            */
 
           (void)inet_close(psock2);
+
+          /* Then release our reference on the socket structure containing
+           * the connection.
+           */
+
+          sock_release(psock2);
         }
     }
 #endif