This is driving me mad! What is wrong here?
There is no guarantee that the reference hasn't been modified by another thread. Assign the socket to a local variable on creation, modify it, set the property, and release the local variable:
CFSocketRef socket = CFSocketCreateWithNative(...);
if (socket) {
...
self.listeningSocket = socket;
CFRelease(socket);
}