Turns out share_mode_traverse_fn() is not initializing the leases pointer in the share_mode_entry to point to the leases array entry at index lease_idx.
Created attachment 11494 [details]
git-am fix for 4.3.next, 4.2.next.
Cherry-picked from master.
Re-assigning to Karolin for inclusion in 4.3.next, 4.2.next.
Pushed to autobuild-v4-[2|3]-test.
(In reply to Karolin Seeger from comment #3)
Pushed to both branches.
Closing out bug report.