Found a number of core dumps from smbd 4.15.7 on one of my servers in vfs_fsync_done() -> talloc_chunk_from_ptr().  

Active vfs objects from smb.conf:

   vfs objects = shadow_copy2 zfsacl full_audit



(gdb) bt
#0  0x0000000804cb669a in thr_kill () from /lib/libc.so.7
#1  0x0000000804cb4af4 in raise () from /lib/libc.so.7
#2  0x0000000804c2a719 in abort () from /lib/libc.so.7
#3  0x0000000802e7ce98 in dump_core () at ../../source3/lib/dumpcore.c:338
#4  0x0000000802e8b6ee in smb_panic_s3 (why=<optimized out>) at ../../source3/lib/util.c:704
#5  0x0000000801d66680 in smb_panic (why=0x8021e7450 "Bad talloc magic value - access after free") at ../../lib/util/fault.c:197
#6  0x00000008021e36c6 in talloc_abort (reason=reason@entry=0x8021e7450 "Bad talloc magic value - access after free") at ../../lib/talloc/talloc.c:509
#7  0x00000008021e36e1 in talloc_abort_access_after_free () at ../../lib/talloc/talloc.c:514
#8  0x00000008021e4c16 in talloc_chunk_from_ptr (ptr=0x810159180) at ../../lib/talloc/talloc.c:531
#9  __talloc_get_name (ptr=0x810159180) at ../../lib/talloc/talloc.c:1562
#10 _talloc_get_type_abort (ptr=0x810159180, name=name@entry=0x801857420 "struct tevent_req", location=location@entry=0x8018f35b8 "../../source3/modules/vfs_default.c:1154")
    at ../../lib/talloc/talloc.c:1619
#11 0x000000080180b8e2 in vfs_fsync_done (subreq=0x815349080) at ../../source3/modules/vfs_default.c:1154
#12 0x000000080282550c in _tevent_req_notify_callback (req=req@entry=0x815349080, location=location@entry=0x805f315d0 "../../lib/pthreadpool/pthreadpool_tevent.c:422")
    at ../../lib/tevent/tevent_req.c:141
#13 0x00000008028255b9 in tevent_req_finish (req=0x815349080, state=state@entry=TEVENT_REQ_DONE, 
    location=location@entry=0x805f315d0 "../../lib/pthreadpool/pthreadpool_tevent.c:422") at ../../lib/tevent/tevent_req.c:193
#14 0x00000008028255d3 in _tevent_req_done (req=<optimized out>, location=location@entry=0x805f315d0 "../../lib/pthreadpool/pthreadpool_tevent.c:422")
    at ../../lib/tevent/tevent_req.c:199
#15 0x0000000805f2fc0f in pthreadpool_tevent_job_done (ctx=ctx@entry=0x810150060, im=im@entry=0x8153492e0, private_data=private_data@entry=0x815349240)
    at ../../lib/pthreadpool/pthreadpool_tevent.c:422
#16 0x0000000802824d7c in tevent_common_invoke_immediate_handler (im=0x8153492e0, removed=removed@entry=0x0) at ../../lib/tevent/tevent_immediate.c:190
#17 0x0000000802824da5 in tevent_common_loop_immediate (ev=ev@entry=0x810150060) at ../../lib/tevent/tevent_immediate.c:236
#18 0x0000000802826ab1 in poll_event_loop_once (ev=0x810150060, location=<optimized out>) at ../../lib/tevent/tevent_poll.c:617
#19 0x0000000802823de4 in _tevent_loop_once (ev=ev@entry=0x810150060, location=location@entry=0x801882438 "../../source3/smbd/process.c:4247") at ../../lib/tevent/tevent.c:790
#20 0x0000000802823fd7 in tevent_common_loop_wait (ev=0x810150060, location=0x801882438 "../../source3/smbd/process.c:4247") at ../../lib/tevent/tevent.c:913
#21 0x0000000802824039 in _tevent_loop_wait (ev=ev@entry=0x810150060, location=location@entry=0x801882438 "../../source3/smbd/process.c:4247") at ../../lib/tevent/tevent.c:932
#22 0x0000000801738cf5 in smbd_process (ev_ctx=ev_ctx@entry=0x810150060, msg_ctx=msg_ctx@entry=0x8100d7220, dce_ctx=dce_ctx@entry=0x810107da0, sock_fd=sock_fd@entry=51, 
    interactive=interactive@entry=false) at ../../source3/smbd/process.c:4247
#23 0x000000000102ea77 in smbd_accept_connection (ev=0x810150060, fde=<optimized out>, flags=<optimized out>, private_data=<optimized out>) at ../../source3/smbd/server.c:1022
#24 0x000000080282482d in tevent_common_invoke_fd_handler (fde=fde@entry=0x8100db580, flags=<optimized out>, removed=removed@entry=0x0) at ../../lib/tevent/tevent_fd.c:142
#25 0x000000080282700f in poll_event_loop_poll (tvalp=0x7fffffffe6a0, ev=0x810150060) at ../../lib/tevent/tevent_poll.c:569
#26 poll_event_loop_once (ev=0x810150060, location=<optimized out>) at ../../lib/tevent/tevent_poll.c:626
#27 0x0000000802823de4 in _tevent_loop_once (ev=ev@entry=0x810150060, location=location@entry=0x1037248 "../../source3/smbd/server.c:1366") at ../../lib/tevent/tevent.c:790
#28 0x0000000802823fd7 in tevent_common_loop_wait (ev=0x810150060, location=0x1037248 "../../source3/smbd/server.c:1366") at ../../lib/tevent/tevent.c:913
#29 0x0000000802824039 in _tevent_loop_wait (ev=ev@entry=0x810150060, location=location@entry=0x1037248 "../../source3/smbd/server.c:1366") at ../../lib/tevent/tevent.c:932
#30 0x0000000001030673 in smbd_parent_loop (parent=<optimized out>, ev_ctx=0x810150060) at ../../source3/smbd/server.c:1366
#31 main (argc=<optimized out>, argv=<optimized out>) at ../../source3/smbd/server.c:2186


(gdb) frame 11
#11 0x000000080180b8e2 in vfs_fsync_done (subreq=0x815349080) at ../../source3/modules/vfs_default.c:1154
1154	../../source3/modules/vfs_default.c: No such file or directory.

(gdb) print *subreq
$1 = {async = {fn = 0x80180b8b9 <vfs_fsync_done>, private_data = 0x810159180}, data = 0x815349240, private_print = 0x0, private_cancel = 0x0, private_cleanup = {fn = 0x0, 
    state = TEVENT_REQ_INIT}, internal = {private_type = 0x805f314e8 "struct pthreadpool_tevent_job_state", 
    create_location = 0x805f31630 "../../lib/pthreadpool/pthreadpool_tevent.c:299", finish_location = 0x805f315d0 "../../lib/pthreadpool/pthreadpool_tevent.c:422", 
    cancel_location = 0x0, state = TEVENT_REQ_DONE, error = 0, trigger = 0x815349170, defer_callback_ev = 0x0, timer = 0x0, profile = 0x0}}


(gdb) frame 12
#12 0x000000080282550c in _tevent_req_notify_callback (req=req@entry=0x815349080, location=location@entry=0x805f315d0 "../../lib/pthreadpool/pthreadpool_tevent.c:422")
    at ../../lib/tevent/tevent_req.c:141
141	../../lib/tevent/tevent_req.c: No such file or directory.
(gdb) print *req
$2 = {async = {fn = 0x80180b8b9 <vfs_fsync_done>, private_data = 0x810159180}, data = 0x815349240, private_print = 0x0, private_cancel = 0x0, private_cleanup = {fn = 0x0, 
    state = TEVENT_REQ_INIT}, internal = {private_type = 0x805f314e8 "struct pthreadpool_tevent_job_state", 
    create_location = 0x805f31630 "../../lib/pthreadpool/pthreadpool_tevent.c:299", finish_location = 0x805f315d0 "../../lib/pthreadpool/pthreadpool_tevent.c:422", 
    cancel_location = 0x0, state = TEVENT_REQ_DONE, error = 0, trigger = 0x815349170, defer_callback_ev = 0x0, timer = 0x0, profile = 0x0}}
(gdb) print location
$9 = 0x805f315d0 "../../lib/pthreadpool/pthreadpool_tevent.c:422"