When a transaction is committed, C Xenstored checks the quota is correct before attempting to commit any nodes. It is possible that accounting is temporarily negative if a node has been removed outside of the transaction. Unfortunately, some versions of C Xenstored assume that the quota cannot be negative and use assert() to confirm it, leading to a crash when tools are built without -DNDEBUG (this is the default).