Return the old hit-for-miss object so we can expire it.

Partial fix for #2654 and #2754

bin/varnishd/cache/cache_hash.c

@@ -447,23 +447,25 @@ HSH_Lookup(struct req *req, struct objcore **ocp, struct objcore **bocp,
 				VSLb(req->vsl, SLT_HitPass, "%u %.6f",
 				    ObjGetXID(wrk, oc), EXP_Dttl(req, oc));
 				oc = NULL;
+				retval = HSH_MISS;
 			} else if (oc->flags & OC_F_PASS) {
 				wrk->stats->cache_hitmiss++;
 				VSLb(req->vsl, SLT_HitMiss, "%u %.6f",
 				    ObjGetXID(wrk, oc), EXP_Dttl(req, oc));
-				oc = NULL;
 				*bocp = hsh_insert_busyobj(wrk, oh);
+				oc->refcnt++;
+				retval = HSH_MISS;
 			} else {
 				oc->refcnt++;
 				if (oc->hits < LONG_MAX)
 					oc->hits++;
+				retval = HSH_HIT;
 			}
 			Lck_Unlock(&oh->mtx);
-			if (oc == NULL)
-				return (HSH_MISS);
-			assert(HSH_DerefObjHead(wrk, &oh));
 			*ocp = oc;
-			return (HSH_HIT);
+			if (retval == HSH_HIT)
+				assert(HSH_DerefObjHead(wrk, &oh));
+			return (retval);
 		}
 		if (EXP_Ttl(NULL, oc) < req->t_req && /* ignore req.ttl */
 		    oc->t_origin > exp_t_origin) {