in function get_referred_path tsocket_address_copy gets called with NULL pointer resulting in core dump. Tested on RHEL7 with samba-4.6.2-12.el7_4.x86_64

smb.conf is:

[global]
netbios name = somehost
panic action = /bin/sleep 999999
[dfsshare]
msdfs root = yes
path = /tmp/dfsshare

symlink looks like this:

lrwxrwxrwx 1 root root 41 Apr  6 16:07 /tmp/dfsshare/someshare -> msdfs:someotherhost.example.com/someshare

dfsreferral works as expected:

# smbclient //somehost.example.com/dfsshare/someshare -U % -c showconnect
OS=[Windows 6.1] Server=[Samba 4.6.2]
//someotherhost.example.com/someshare

dfsgetinfo results in core dump of smbd

# rpcclient somehost.example.com -U % -c 'dfsgetinfo \\\\somehost\\dfsshare\\someshare somehost someshare'
result was WERR_NETNAME_DELETED

Backtrace shows 0x0 in call to _tsocket_address_copy:

#0  0x00007efca982edbc in waitpid () from /lib64/libc.so.6
#1  0x00007efca97b1cc2 in do_system () from /lib64/libc.so.6
#2  0x00007efcab11c7e1 in smb_panic_s3 (why=<optimized out>) at ../source3/lib/util.c:804
#3  0x00007efcad1f795f in smb_panic (why=why@entry=0x7efcad23f82a "internal error")
    at ../lib/util/fault.c:166
#4  0x00007efcad1f7b76 in fault_report (sig=<optimized out>) at ../lib/util/fault.c:83
#5  sig_fault (sig=<optimized out>) at ../lib/util/fault.c:94
#6  <signal handler called>
#7  _tsocket_address_copy (addr=0x0, mem_ctx=0x561bb5c3f470, 
    location=0x7efcacef5903 "../source3/smbd/msdfs.c:1091") at ../lib/tsocket/tsocket.c:96
#8  0x00007efcacdabb47 in get_referred_path (ctx=ctx@entry=0x561bb5c3e600, 
    dfs_path=0x561bb5c3e8b0 "\\\\somehost\\dfsshare\\someshare", remote_address=<optimized out>, 
    local_address=0x0, allow_broken_path=allow_broken_path@entry=true, 
    jucn=jucn@entry=0x561bb5c3eed0, consumedcntp=consumedcntp@entry=0x7ffe762d315c, 
    self_referralp=self_referralp@entry=0x7ffe762d315b) at ../source3/smbd/msdfs.c:1091
#9  0x00007efcacce5e1f in _dfs_GetInfo (p=p@entry=0x561bb5c3da60, r=r@entry=0x561bb5c3e660)
    at ../source3/rpc_server/dfs/srv_dfs_nt.c:380
#10 0x00007efcacce8bb4 in api_dfs_GetInfo (p=0x561bb5c3da60)
    at default/librpc/gen_ndr/srv_dfs.c:351
#11 0x00007efcace32f22 in api_rpcTNP (p=p@entry=0x561bb5c3da60, pkt=pkt@entry=0x561bb5c37d70, 
    api_rpc_cmds=<optimized out>, n_cmds=23, syntax=syntax@entry=0x561bb5c3d480)
    at ../source3/rpc_server/srv_pipe.c:1476
#12 0x00007efcace3524c in api_pipe_request (pkt=0x561bb5c37d70, p=0x561bb5c3da60)
    at ../source3/rpc_server/srv_pipe.c:1411
#13 process_request_pdu (pkt=0x561bb5c37d70, p=0x561bb5c3da60)
    at ../source3/rpc_server/srv_pipe.c:1680
#14 process_complete_pdu (p=0x561bb5c3da60, pkt=0x561bb5c37d70)
    at ../source3/rpc_server/srv_pipe.c:1698
#15 0x00007efcaccf3a4d in named_pipe_packet_process (subreq=<optimized out>)
    at ../source3/rpc_server/rpc_server.c:439
#16 0x00007efca5771397 in dcerpc_read_ncacn_packet_done (subreq=0x561bb5c37e80)
    at ../librpc/rpc/dcerpc_util.c:835
#17 0x00007efcaacc50c9 in tstream_readv_pdu_readv_done (subreq=0x561bb5c30ed0)
    at ../lib/tsocket/tsocket_helpers.c:319
#18 0x00007efcaacc3fab in tstream_readv_done (subreq=0x561bb5c311f0)
    at ../lib/tsocket/tsocket.c:604
#19 0x00007efca9b38aba in tevent_common_loop_immediate () from /lib64/libtevent.so.0
#20 0x00007efca9b3dc9d in epoll_event_loop_once () from /lib64/libtevent.so.0
#21 0x00007efca9b3c2a7 in std_event_loop_once () from /lib64/libtevent.so.0
---Type <return> to continue, or q <return> to quit---
#22 0x00007efca9b380cd in _tevent_loop_once () from /lib64/libtevent.so.0
#23 0x00007efca9b382fb in tevent_common_loop_wait () from /lib64/libtevent.so.0
#24 0x00007efca9b3c247 in std_event_loop_wait () from /lib64/libtevent.so.0
#25 0x00007efcacda4fb4 in smbd_process (ev_ctx=ev_ctx@entry=0x561bb5c15910, 
    msg_ctx=msg_ctx@entry=0x561bb5c15d40, sock_fd=sock_fd@entry=41, 
    interactive=interactive@entry=false) at ../source3/smbd/process.c:4126
#26 0x0000561bb40caa74 in smbd_accept_connection (ev=0x561bb5c15910, fde=<optimized out>, 
    flags=<optimized out>, private_data=<optimized out>) at ../source3/smbd/server.c:1017
#27 0x00007efca9b3dedb in epoll_event_loop_once () from /lib64/libtevent.so.0
#28 0x00007efca9b3c2a7 in std_event_loop_once () from /lib64/libtevent.so.0
#29 0x00007efca9b380cd in _tevent_loop_once () from /lib64/libtevent.so.0
#30 0x00007efca9b382fb in tevent_common_loop_wait () from /lib64/libtevent.so.0
#31 0x00007efca9b3c247 in std_event_loop_wait () from /lib64/libtevent.so.0
#32 0x0000561bb40c5a95 in smbd_parent_loop (parent=<optimized out>, ev_ctx=0x561bb5c15910)
    at ../source3/smbd/server.c:1384
#33 main (argc=<optimized out>, argv=<optimized out>) at ../source3/smbd/server.c:2038

Cheers

Heinrich