This in mdssvc.c's slrpc_open_query() should probably say sl_cnids_t rather than sl_array_t: cnids = dalloc_value_for_key(query, "DALLOC_CTX", 0, "DALLOC_CTX", 1, "kMDQueryItemArray", "sl_array_t"); if (cnids) { ok = sort_cnids(slq, cnids->ca_cnids); If the client passes a sl_array_t (rather than nothing), sort_cnids() may crash when it tries to dereference cnids->ca_cnids: Program received signal SIGBUS, Bus error. Object-specific hardware error. 0x000000fc49f2de68 in dalloc_size (d=0x7a7a7a7a7a7a7a7a) at ../../source3/rpc_server/mdssvc/dalloc.c:82 82 return talloc_array_length(d->dd_talloc_array); (gdb) where #0 0x000000fc49f2de68 in dalloc_size (d=0x7a7a7a7a7a7a7a7a) at ../../source3/rpc_server/mdssvc/dalloc.c:82 #1 0x000000fc49f1c569 in sort_cnids (slq=0x104b35d2cc0, d=0x7a7a7a7a7a7a7a7a) at ../../source3/rpc_server/mdssvc/mdssvc.c:235 #2 0x000000fc49f19e44 in slrpc_open_query (mds_ctx=0x104b35ae820, query=0x104b35cdce0, reply=0x104b35cdd70) at ../../source3/rpc_server/mdssvc/mdssvc.c:1030 #3 0x000000fc49f188b8 in mds_dispatch (mds_ctx=0x104b35ae820, request_blob=0x104b35ccd20, response_blob=0x104b35cdbc0, max_fragment_size=512) at ../../source3/rpc_server/mdssvc/mdssvc.c:1880 #4 0x000000fc49f1dad8 in _mdssvc_cmd (p=0x104b359ee48, r=0x104b35ccd00) at ../../source3/rpc_server/mdssvc/srv_mdssvc_nt.c:239 The above crash was produced by a client mds cmd request that contained this blob passed by mds_dispatch() to sl_unpack(): (gdb) x/784xb request_blob->spotlight_blob 0x3c0696b551f0: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x3c0696b551f8: 0x61 0x00 0x00 0x00 0x41 0x00 0x00 0x00 0x3c0696b55200: 0x01 0x00 0x00 0x02 0x01 0x00 0x00 0x00 0x3c0696b55208: 0x01 0x00 0x00 0x02 0x02 0x00 0x00 0x00 0x3c0696b55210: 0x01 0x00 0x00 0x02 0x03 0x00 0x00 0x00 0x3c0696b55218: 0x05 0x00 0x00 0x00 0x1f 0x00 0x00 0x00 0x3c0696b55220: 0x6f 0x70 0x65 0x6e 0x51 0x75 0x65 0x72 0x3c0696b55228: 0x79 0x57 0x69 0x74 0x68 0x50 0x61 0x72 0x3c0696b55230: 0x61 0x6d 0x73 0x3a 0x66 0x6f 0x72 0x43 0x3c0696b55238: 0x6f 0x6e 0x74 0x65 0x78 0x74 0x3a 0x00 0x3c0696b55240: 0x02 0x00 0x00 0x84 0x01 0x00 0x00 0x00 0x3c0696b55248: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x3c0696b55250: 0x02 0x00 0x00 0x84 0x01 0x00 0x00 0x00 0x3c0696b55258: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x3c0696b55260: 0x01 0x00 0x00 0x02 0x04 0x00 0x00 0x00 0x3c0696b55268: 0x01 0x00 0x00 0x02 0x05 0x00 0x00 0x00 0x3c0696b55270: 0x03 0x00 0x00 0x00 0x0e 0x00 0x00 0x00 0x3c0696b55278: 0x6b 0x4d 0x44 0x51 0x75 0x65 0x72 0x79 0x3c0696b55280: 0x53 0x74 0x72 0x69 0x6e 0x67 0x00 0x00 0x3c0696b55288: 0x01 0x00 0x00 0x02 0x06 0x00 0x00 0x00 0x3c0696b55290: 0x04 0x00 0x00 0x00 0x12 0x00 0x00 0x00 0x3c0696b55298: 0x21 0x40 0x23 0x24 0x25 0x5e 0x26 0x2a 0x3c0696b552a0: 0x28 0x29 0x3a 0x7b 0x7d 0x27 0x5b 0x5d 0x3c0696b552a8: 0x7c 0x5c 0x00 0x00 0x00 0x00 0x00 0x00 0x3c0696b552b0: 0x01 0x00 0x00 0x02 0x07 0x00 0x00 0x00 0x3c0696b552b8: 0x03 0x00 0x00 0x00 0x0d 0x00 0x00 0x00 0x3c0696b552c0: 0x6b 0x4d 0x44 0x53 0x63 0x6f 0x70 0x65 0x3c0696b552c8: 0x41 0x72 0x72 0x61 0x79 0x00 0x00 0x00 0x3c0696b552d0: 0x01 0x00 0x00 0x02 0x08 0x00 0x00 0x00 0x3c0696b552d8: 0x01 0x00 0x00 0x02 0x09 0x00 0x00 0x00 0x3c0696b552e0: 0x02 0x00 0x00 0x00 0x03 0x00 0x00 0x00 0x3c0696b552e8: 0x78 0x79 0x7a 0x00 0x00 0x00 0x00 0x00 0x3c0696b552f0: 0x01 0x00 0x00 0x02 0x0a 0x00 0x00 0x00 0x3c0696b552f8: 0x04 0x00 0x00 0x00 0x11 0x00 0x00 0x00 0x3c0696b55300: 0x6b 0x4d 0x44 0x41 0x74 0x74 0x72 0x69 0x3c0696b55308: 0x62 0x75 0x74 0x65 0x41 0x72 0x72 0x61 0x3c0696b55310: 0x79 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x3c0696b55318: 0x01 0x00 0x00 0x02 0x0b 0x00 0x00 0x00 0x3c0696b55320: 0x01 0x00 0x00 0x02 0x0c 0x00 0x00 0x00 0x3c0696b55328: 0x02 0x00 0x00 0x00 0x01 0x00 0x00 0x00 0x3c0696b55330: 0x61 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x3c0696b55338: 0x01 0x00 0x00 0x02 0x0d 0x00 0x00 0x00 0x3c0696b55340: 0x02 0x00 0x00 0x00 0x01 0x00 0x00 0x00 0x3c0696b55348: 0x62 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x3c0696b55350: 0x01 0x00 0x00 0x02 0x0e 0x00 0x00 0x00 0x3c0696b55358: 0x04 0x00 0x00 0x00 0x11 0x00 0x00 0x00 0x3c0696b55360: 0x6b 0x4d 0x44 0x51 0x75 0x65 0x72 0x79 0x3c0696b55368: 0x49 0x74 0x65 0x6d 0x41 0x72 0x72 0x61 0x3c0696b55370: 0x79 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x3c0696b55378: 0x01 0x00 0x00 0x02 0x0f 0x00 0x00 0x00 0x3c0696b55380: 0x01 0x00 0x00 0x02 0x10 0x00 0x00 0x00 0x3c0696b55388: 0x02 0x00 0x00 0x00 0x01 0x00 0x00 0x00 0x3c0696b55390: 0x61 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x3c0696b55398: 0x01 0x00 0x00 0x02 0x11 0x00 0x00 0x00 0x3c0696b553a0: 0x02 0x00 0x00 0x00 0x01 0x00 0x00 0x00 0x3c0696b553a8: 0x62 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x3c0696b553b0: 0x01 0x00 0x00 0x01 0x01 0x00 0x00 0x00 0x3c0696b553b8: 0x01 0x00 0x00 0x01 0x01 0x00 0x00 0x00 0x3c0696b553c0: 0x01 0x00 0x00 0x01 0x01 0x00 0x00 0x00 0x3c0696b553c8: 0x01 0x00 0x00 0x01 0x01 0x00 0x00 0x00 0x3c0696b553d0: 0x01 0x00 0x00 0x01 0x01 0x00 0x00 0x00 0x3c0696b553d8: 0x01 0x00 0x00 0x01 0x01 0x00 0x00 0x00 0x3c0696b553e0: 0x01 0x00 0x00 0x01 0x01 0x00 0x00 0x00 0x3c0696b553e8: 0x01 0x00 0x00 0x01 0x01 0x00 0x00 0x00 0x3c0696b553f0: 0x01 0x00 0x00 0x01 0x01 0x00 0x00 0x00 0x3c0696b553f8: 0x01 0x00 0x00 0x01 0x01 0x00 0x00 0x00 0x3c0696b55400: 0x01 0x00 0x00 0x88 0x00 0x00 0x00 0x00 0x3c0696b55408: 0x01 0x00 0x00 0x0a 0x02 0x00 0x00 0x00 0x3c0696b55410: 0x01 0x00 0x00 0x0a 0x03 0x00 0x00 0x00 0x3c0696b55418: 0x01 0x00 0x00 0x0c 0x01 0x00 0x00 0x00 0x3c0696b55420: 0x01 0x00 0x00 0x0a 0x08 0x00 0x00 0x00 0x3c0696b55428: 0x01 0x00 0x00 0x0c 0x01 0x00 0x00 0x00 0x3c0696b55430: 0x01 0x00 0x00 0x0c 0x01 0x00 0x00 0x00 0x3c0696b55438: 0x01 0x00 0x00 0x0c 0x01 0x00 0x00 0x00 0x3c0696b55440: 0x01 0x00 0x00 0x0a 0x01 0x00 0x00 0x00 0x3c0696b55448: 0x01 0x00 0x00 0x0c 0x01 0x00 0x00 0x00 0x3c0696b55450: 0x01 0x00 0x00 0x0c 0x01 0x00 0x00 0x00 0x3c0696b55458: 0x01 0x00 0x00 0x0a 0x02 0x00 0x00 0x00 0x3c0696b55460: 0x01 0x00 0x00 0x0c 0x01 0x00 0x00 0x00 0x3c0696b55468: 0x01 0x00 0x00 0x0c 0x01 0x00 0x00 0x00 0x3c0696b55470: 0x01 0x00 0x00 0x0c 0x01 0x00 0x00 0x00 0x3c0696b55478: 0x01 0x00 0x00 0x0a 0x02 0x00 0x00 0x00 0x3c0696b55480: 0x01 0x00 0x00 0x0c 0x01 0x00 0x00 0x00 0x3c0696b55488: 0x01 0x00 0x00 0x0c 0x01 0x00 0x00 0x00 0x3c0696b55490: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x3c0696b55498: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x3c0696b554a0: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x3c0696b554a8: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x3c0696b554b0: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x3c0696b554b8: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x3c0696b554c0: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x3c0696b554c8: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x3c0696b554d0: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x3c0696b554d8: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x3c0696b554e0: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x3c0696b554e8: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x3c0696b554f0: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x3c0696b554f8: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 In more readable form; it's the second "a" and "b" that cnids ends up pointing to: DALLOC_CTX(#1): { sl_array_t(#2): { sl_array_t(#3): { string: openQueryWithParams:forContext: uint64_t: 0x0000 uint64_t: 0x0000 } sl_array_t(#8): { string: kMDQueryString string: !@#$%^&*():{}'[]|\ string: kMDScopeArray sl_array_t(#1): { string: xyz } string: kMDAttributeArray sl_array_t(#2): { string: a string: b } string: kMDQueryItemArray sl_array_t(#2): { string: a string: b } } } }