push_xattr_blob_tdb_raw() has a use-after-free on the error path when posix_eadb_add_list() fails. The error handler frees mem_ctx, then falls through via goto done where tdb_chainunlock() dereferences tkey.dptr - which was allocated under mem_ctx and is now freed and subsequently calls talloc_free(mem_ctx) again on the dangling pointer.

AddressSanitizer reports the failure as a use-after-free in tdb_chainunlock(). posix_eadb_add_list() can fail due to database, I/O, or disk-full errors, so this is reachable in production.