Thanks for looking through this.

> What's the tool?

Sashiko (LLM) reported the issue. The path it reported was based on code
output by print_dump() where since the dump state is zero initialized
struct ynl_dump_state yds = {}, yds.first would be NULL. It then pointed
out that in the call to ynl_exec_dump() that there could be a failure in
ynl_msg_end() or send() that would result in `yds.first` staying as NULL,
and the code going to the free_list label where the dump list free would
get passed NULL. I may be misunderstanding the code, but it seemed
legitimate.

> I guess we can do this but I'd factor it out to a separate check at the
> start of the function. Otherwise it reads as if there could be a NULL on
> the list itself.

Factoring out the NULL to be a separate check makes more sense to me and
better shows the intent of the check. I'll update that in v2.

Thanks,
Thaison