DACL sets or gets the discretionary access control list. The read value is the internal used DACL. So do not free it directly. Instead set the write value to nil. The write value is copied into a new DACL (using Assign) if the property OwnDACL is false otherwise the given DACL instance is used directly (using ":="). 

If the write value is nil the internal list is freed and set to nil. 

The following code releases an old DACL and copies an existing one into the SD. At the end there are two DACL instances that will contain the same content.

//first release old DACL.
//1. if OwnDACL is true, the DACL is freed
//2. if OwnDACL is false, the DACL is dismissed without freeing it
DACL := nil;
//Set OwnDACL to false, so the DACL will be copied into a brand new  instance.
OwnDACL := false;
DACL := SecurityDescriptor.DACL;
//Now let handle the SD freeing it on destruction.
OwnDACL := true;

The following code can be used if an old DACL must be released and a new one created. The newly created instance will directly become the value of the DACL property. It will not be copied but freed on destruction of the security descriptor instance.

//first release old DACL.
//1. if OwnDACL is true, the DACL is freed
//2. if OwnDACL is false, the DACL is dismissed without freeing it
DACL := nil;
//Set OwnDACL to true, so we get the new instance and use it directly
OwnDACL := true;
DACL := TJwDAccessControlList.Create;
//Now let handle the SD freeing it on destruction.
OwnDACL := true;

TJwSecurityDescriptor Properties