OK. As I pointed out a commit having multiple things may make analysis difficult, I should have been careful.
So, let me fix the problem by multiple commits.

The first commit is adding log_assert and replacing one use case of close_pc_reader (at two places) into new function release_pcsc_context.

The second commit is replacing a use case of close_pcsc_reader by clearing pcsc.rdrname and calling release_pcsc_context.
This makes the use of close_pcsc_reader to its original purpose only (== closing PC/SC reader as a method of close_reader).

Last commit will be:

diff --git a/scd/apdu.c b/scd/apdu.c
index c809e6791..41c06e0ab 100644
--- a/scd/apdu.c
+++ b/scd/apdu.c
@@ -2094,12 +2094,8 @@ apdu_dev_list_start (const char *portstr, struct dev_list **l_p)
               break;
             }
         }
-
-      pcsc.count++;
     }
 
-  npth_mutex_unlock (&reader_table_lock);
-
   *l_p = dl;
   return 0;
 }
@@ -2123,10 +2119,11 @@ apdu_dev_list_finish (struct dev_list *dl)
         pcsc.rdrname[i] = NULL;
 
       log_assert (pcsc.count > 0);
-      if (--pcsc.count == 0)
+      if (pcsc.count == 0)
         release_pcsc_context ();
     }
   xfree (dl);
+  npth_mutex_unlock (&reader_table_lock);
 }

We should add a comment at the caller side, that this takes a lock in apdu.c.

Please note that we don't use lock in apdu_dev_list_start/finish any more.
Use of lock is narrowed, only within apdu_open_reader function.

Applied in rG32baa9acfb15: scd: Serialize READER_TABLE access for PC/SC..