This function seems to be not that safe. The first problem is that the first thing it does if free refcount calling qcow2_update_snapshot_refcount(bs, s->l1_table_offset, s->l1_size, -1). Now if something goes wrong (crash, disk errors) this could lead to refcount == 0 (depending on L1 size, cache, open flags).
If table grow and qcow2_grow_l1_table needs to resize on disk it probably will found some reference counter set to 0 (cause we already decremented it), fail than qcow2_snapshot_goto return -EIO leaving refcounts deallocated. Frediano
