Turns out share_mode_traverse_fn() is not initializing the leases pointer in the share_mode_entry to point to the leases array entry at index lease_idx. Patch follows.
Created attachment 11494 [details] git-am fix for 4.3.next, 4.2.next. Cherry-picked from master.
Re-assigning to Karolin for inclusion in 4.3.next, 4.2.next.
Pushed to autobuild-v4-[2|3]-test.
(In reply to Karolin Seeger from comment #3) Pushed to both branches. Closing out bug report. Thanks!