As far as I can tell, waiting_for_ready only gets freed up in tp_connection_manager_ready_or_failed(). That function is called when the TpCM gets information from the CM or from a .manager file, or when the CM's name goes away. If TpCM is disposed while introspection is in progress (or before the idle in which the manager file is read fires), I don't think they'll get called.

(Also, the currently-running method call is not cancelled, so I think it'll probably crash too.)

This is not as simple as putting a call to tp_connection_manager_ready_or_failed() into _dispose(). On that path lies madness:

 * Application makes a TpCM, calls call_when_ready() on it;
 * User does something, the application decides it no longer cares about the TpCM, and unrefs it;
 * The application's callback fires;
 * If the application developer wasn't very careful to move its pointer to the TpCM out of the way before unreffing it, the callback will probably go wrong and crash.

(That said: if you have multiple different bits of your application setting up call_when_ready callbacks, it's already scary if one of them unref()s the TpCM because the callback might fire later. Argh.)