On Wed,  5 Aug 2026 13:14:54 +0000 Thaison Phan wrote:
> Thanks for looking through this.
> 
> > What's the tool?  
> 
> Sashiko (LLM) reported the issue. The path it reported was based on code
> output by print_dump() where since the dump state is zero initialized
> struct ynl_dump_state yds = {}, yds.first would be NULL. It then pointed
> out that in the call to ynl_exec_dump() that there could be a failure in
> ynl_msg_end() or send() that would result in `yds.first` staying as NULL,
> and the code going to the free_list label where the dump list free would
> get passed NULL. I may be misunderstanding the code, but it seemed
> legitimate.

I see it now, you're right. Plumbing the END markers in the list
construction would be a PITA.

> > I guess we can do this but I'd factor it out to a separate check at the
> > start of the function. Otherwise it reads as if there could be a NULL on
> > the list itself.  
> 
> Factoring out the NULL to be a separate check makes more sense to me and
> better shows the intent of the check. I'll update that in v2.
> 
> Thanks,
> Thaison