The hash table that is used to cache netgroups is allocated with low-level hash_create() and the freed in a destructor. The entries themselves are talloc pointers with destructors which results in a funky behaviour during shutdown, often a segfault.
I think the correct thing to do is just use sss_hash_create() so that the table is deallocated when the responder goes away.