--- old/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11DSAKeyFactory.java	2018-09-18 15:57:56.904358713 +0200
+++ new/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11DSAKeyFactory.java	2018-09-18 15:57:56.735357576 +0200
@@ -179,7 +179,7 @@
             session = token.getObjSession();
             long keyID = token.p11.C_CreateObject(session.id(), attributes);
             return P11Key.publicKey
-                (session, keyID, "DSA", p.bitLength(), attributes);
+                (session, keyID, "DSA", p.bitLength(), attributes, true);
         } finally {
             token.releaseSession(session);
         }
@@ -202,7 +202,7 @@
             session = token.getObjSession();
             long keyID = token.p11.C_CreateObject(session.id(), attributes);
             return P11Key.privateKey
-                (session, keyID, "DSA", p.bitLength(), attributes);
+                (session, keyID, "DSA", p.bitLength(), attributes, true);
         } finally {
             token.releaseSession(session);
         }
@@ -218,7 +218,13 @@
                 new CK_ATTRIBUTE(CKA_SUBPRIME),
                 new CK_ATTRIBUTE(CKA_BASE),
             };
-            token.p11.C_GetAttributeValue(session[0].id(), key.keyID, attributes);
+            key.incNativeKeyRef();
+            try {
+                token.p11.C_GetAttributeValue(session[0].id(), key.keyID,
+                        attributes);
+            } finally {
+                key.decNativeKeyRef();
+            }
             KeySpec spec = new DSAPublicKeySpec(
                 attributes[0].getBigInteger(),
                 attributes[1].getBigInteger(),
@@ -242,7 +248,13 @@
                 new CK_ATTRIBUTE(CKA_SUBPRIME),
                 new CK_ATTRIBUTE(CKA_BASE),
             };
-            token.p11.C_GetAttributeValue(session[0].id(), key.keyID, attributes);
+            key.incNativeKeyRef();
+            try {
+                token.p11.C_GetAttributeValue(session[0].id(), key.keyID,
+                        attributes);
+            } finally {
+                key.decNativeKeyRef();
+            }
             KeySpec spec = new DSAPrivateKeySpec(
                 attributes[0].getBigInteger(),
                 attributes[1].getBigInteger(),