@@ -254,6 +254,10 @@ internal sealed unsafe class JSTsfnSynchronizationContext : JSSynchronizationCon
     private readonly JSRuntime _runtime;
     private readonly napi_env _env;
     private readonly JSThreadSafeFunction _tsfn;
+
+    // Coordinates in-flight NonBlockingCall invocations with TSFN release during teardown, so that
+    // a poster can never call into the TSFN after (or while) it is being released.
+    private readonly TsfnCallGate _callGate = new();
     private GCHandle _cleanupHandle;
 
     public JSTsfnSynchronizationContext()
@@ -298,6 +302,11 @@ public override void Dispose()
 
         base.Dispose();
 
+        // Prevent any new NonBlockingCall from starting and wait for in-flight calls to finish
+        // before releasing the TSFN. This closes the post-then-release race in which a poster could
+        // call into the TSFN after the environment cleanup hook has released it.
+        _callGate.Close();
+
         // Destroy TSFN by releasing last thread use count.
         // TSFN is deleted after this point and must not be used.
         _tsfn.Release();
@@ -348,9 +357,16 @@ public override void CloseAsyncScope()
 
     public override void Post(SendOrPostCallback callback, object? state)
     {
-        if (IsDisposed) return;
+        if (!_callGate.TryEnter()) return;
 
-        _tsfn.NonBlockingCall(() => callback(state));
+        try
+        {
+            _tsfn.NonBlockingCall(() => callback(state));
+        }
+        finally
+        {
+            _callGate.Exit();
+        }
     }
 
     public override void Send(SendOrPostCallback callback, object? state)
@@ -361,14 +377,25 @@ public override void Send(SendOrPostCallback callback, object? state)
             return;
         }
 
-        if (IsDisposed) return;
-
         using ManualResetEvent syncEvent = new(false);
-        _tsfn.NonBlockingCall(() =>
+
+        // The gate is held only around the native NonBlockingCall, not around the wait below: the
+        // posted callback runs on the JS thread and could otherwise deadlock TSFN release.
+        if (!_callGate.TryEnter()) return;
+
+        try
         {
-            callback(state);
-            syncEvent.Set();
-        });
+            _tsfn.NonBlockingCall(() =>
+            {
+                callback(state);
+                syncEvent.Set();
+            });
+        }
+        finally
+        {
+            _callGate.Exit();
+        }
+
         syncEvent.WaitOne();
     }
 }
 
@@ -0,0 +1,97 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+using System.Threading;
+
+namespace Microsoft.JavaScript.NodeApi.Interop;
+
+/// <summary>
+/// Coordinates in-flight native thread-safe-function (TSFN) calls with TSFN release, so that a
+/// caller cannot invoke the TSFN after (or while) it is being released.
+/// </summary>
+/// <remarks>
+/// <para>
+/// <see cref="JSTsfnSynchronizationContext"/> posts work to the JS thread by calling into a native
+/// TSFN, and releases that TSFN from an environment cleanup hook during teardown. Without
+/// coordination there is a race: a poster can observe the context as not-yet-disposed, then the
+/// cleanup hook can release the TSFN, and then the poster calls into the released TSFN &mdash; a
+/// native use-after-release that a managed <c>try/catch</c> cannot guard.
+/// </para>
+/// <para>
+/// This gate closes that window. A caller wraps each native TSFN call in
+/// <see cref="TryEnter"/>/<see cref="Exit"/>; the owner calls <see cref="Close"/> before releasing
+/// the TSFN. <see cref="Close"/> atomically prevents any further <see cref="TryEnter"/> from
+/// succeeding and then waits for all in-flight calls to finish, guaranteeing that no native call
+/// is in progress and none can start once <see cref="Close"/> returns.
+/// </para>
+/// </remarks>
+internal sealed class TsfnCallGate
+{
+    // High bit marks the gate as closed; the remaining bits count in-flight calls. Because Enter
+    // never increments once the closed bit is set, and Exit is only called after a successful
+    // Enter, the count part never borrows into the closed bit.
+    private const int ClosedFlag = unchecked((int)0x80000000);
+    private const int CountMask = 0x7FFFFFFF;
+
+    private int _state;
+
+    /// <summary>
+    /// Gets a value indicating whether the gate has been closed.
+    /// </summary>
+    public bool IsClosed => (Volatile.Read(ref _state) & ClosedFlag) != 0;
+
+    /// <summary>
+    /// Attempts to enter the gate for a single native call. When this returns true the caller must
+    /// pair it with exactly one call to <see cref="Exit"/> once the native call has returned.
+    /// </summary>
+    /// <returns>True if the call may proceed; false if the gate is closed and the call must be
+    /// skipped.</returns>
+    public bool TryEnter()
+    {
+        int state = Volatile.Read(ref _state);
+        while ((state & ClosedFlag) == 0)
+        {
+            int updated = Interlocked.CompareExchange(ref _state, state + 1, state);
+            if (updated == state)
+            {
+                return true;
+            }
+
+            state = updated;
+        }
+
+        return false;
+    }
+
+    /// <summary>
+    /// Marks completion of a native call previously admitted by <see cref="TryEnter"/>.
+    /// </summary>
+    public void Exit() => Interlocked.Decrement(ref _state);
+
+    /// <summary>
+    /// Closes the gate so that no further calls can enter, then blocks until all in-flight calls
+    /// have exited. After this returns it is safe to release the underlying TSFN. Calling this more
+    /// than once is safe.
+    /// </summary>
+    public void Close()
+    {
+        int state = Volatile.Read(ref _state);
+        while ((state & ClosedFlag) == 0)
+        {
+            int updated = Interlocked.CompareExchange(
+                ref _state, state | ClosedFlag, state);
+            if (updated == state)
+            {
+                break;
+            }
+
+            state = updated;
+        }
+
+        SpinWait spin = default;
+        while ((Volatile.Read(ref _state) & CountMask) != 0)
+        {
+            spin.SpinOnce();
+        }
+    }
+}
@@ -28,6 +28,10 @@
     <PackageReference Include="Microsoft.Bcl.AsyncInterfaces" />
   </ItemGroup>
 
+  <ItemGroup>
+    <InternalsVisibleTo Include="Microsoft.JavaScript.NodeApi.Test" />
+  </ItemGroup>
+
   <Target Name="SetRuntimeConfigValues" BeforeTargets="GenerateBuildRuntimeConfigurationFiles">
     <ItemGroup>
       <RuntimeHostConfigurationOption Include="System.Runtime.InteropServices.EnableConsumingManagedCodeFromNativeHosting" Value="true" />
 
@@ -0,0 +1,121 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.JavaScript.NodeApi.Interop;
+using Xunit;
+
+namespace Microsoft.JavaScript.NodeApi.Test;
+
+public class TsfnCallGateTests
+{
+    [Fact]
+    public void EnterAndExitWhileOpen()
+    {
+        var gate = new TsfnCallGate();
+
+        Assert.True(gate.TryEnter());
+        gate.Exit();
+
+        Assert.False(gate.IsClosed);
+    }
+
+    [Fact]
+    public void CloseRejectsFurtherEntry()
+    {
+        var gate = new TsfnCallGate();
+
+        gate.Close();
+
+        Assert.True(gate.IsClosed);
+        Assert.False(gate.TryEnter());
+    }
+
+    [Fact]
+    public void CloseIsIdempotent()
+    {
+        var gate = new TsfnCallGate();
+
+        gate.Close();
+        gate.Close();
+
+        Assert.True(gate.IsClosed);
+        Assert.False(gate.TryEnter());
+    }
+
+    // Close must not return while a call is in flight: it has to wait for the corresponding Exit,
+    // guaranteeing no native TSFN call is in progress once the TSFN is released.
+    [Fact]
+    public void CloseWaitsForInFlightCallToExit()
+    {
+        var gate = new TsfnCallGate();
+
+        // Simulate an in-flight native call that has entered but not yet exited.
+        Assert.True(gate.TryEnter());
+
+        Task closeTask = Task.Run(() => gate.Close());
+
+        // Close cannot complete while the call is in flight.
+        Assert.False(closeTask.Wait(TimeSpan.FromMilliseconds(200)));
+
+        // Once the in-flight call exits, Close completes.
+        gate.Exit();
+        Assert.True(closeTask.Wait(TimeSpan.FromSeconds(5)));
+
+        // After closing, no further calls are admitted.
+        Assert.False(gate.TryEnter());
+    }
+
+    // Once Close has set the closed flag, an entry that races with it must be rejected, so the
+    // in-flight count cannot rise again after Close begins draining.
+    [Fact]
+    public void EntryDoesNotSucceedAfterCloseFlagSet()
+    {
+        var gate = new TsfnCallGate();
+
+        gate.Close();
+
+        // A burst of concurrent entry attempts after Close must all fail.
+        Parallel.For(0, 1000, _ => Assert.False(gate.TryEnter()));
+    }
+
+    // Stress the gate with concurrent enter/exit callers while another thread closes it, then
+    // assert the invariant that after Close returns no caller is inside the gate and none can
+    // enter.
+    [Fact]
+    public void ConcurrentCallersDrainBeforeCloseCompletes()
+    {
+        var gate = new TsfnCallGate();
+        using var start = new ManualResetEventSlim(false);
+
+        Task[] callers = new Task[8];
+        for (int i = 0; i < callers.Length; i++)
+        {
+            callers[i] = Task.Run(() =>
+            {
+                start.Wait();
+                for (int j = 0; j < 5000; j++)
+                {
+                    if (gate.TryEnter())
+                    {
+                        // Represents a brief native call.
+                        Thread.SpinWait(10);
+                        gate.Exit();
+                    }
+                }
+            });
+        }
+
+        start.Set();
+
+        // Close concurrently with the callers; it must wait for any in-flight call to exit.
+        gate.Close();
+
+        // After Close returns, no caller may enter and the callers finish without error.
+        Assert.False(gate.TryEnter());
+        Assert.True(Task.WaitAll(callers, TimeSpan.FromSeconds(30)));
+        Assert.True(gate.IsClosed);
+    }
+}