I think the use of the lock CKeyStore::cs_mapKeys on CKeyStore::mapKeys should be better documented and a little checked.
CKeyStore::GetPrivKey and CKeyStore::HaveKey should have a comment “// requires cs_mapKeys lock” (and I would add it directly to the CKeyStore::mapKeys, because it’s used by CScript)
And in general, should access to CKeyStore::mapKeys always be prodected by a lock to CKeyStore::cs_mapKeys? At this time CKeyStore::GetPrivKey and CKeyStore::HaveKey don’t use a lock, and the same happens with Wallet::LoadWallet, but CKeyStore::GetPrivKey is always called by methods that have the lock, and LoadWallet is called only during startup. So only CKeyStore::HaveKey seems to be “unprotected” (I’ve tried looking at the call stack and I wasn’t able to see the lock. For example (in reverse order): CKeyStore::HaveKey, ::ExtractPubKey, CWalletTx::GetAmounts, ::getbalance, ::ThreadRPCServer2)