s3:messages: make the loop in msg_dgm_ref_recv() more robust against stale pointers