tracing: fix event_subsystem ref counting