_XReply drops the Display lock, so the value of dpy->request may change
before _XReply is called again.

I discovered this by inspection a year or two ago. I'm pretty confident
in the claim, and nobody has come up with an argument for why it's safe
despite appearances.