A bug in introduced 13th of january have a code path wich end in referencing a null pointer.

I expect the following info is precise enough, as it pinpoint the problematic place, but otherwise let me know.

The problem came with commit 88ce2c71e36b0e556dfbd74f6c8c4de7034b2075 and the related commits, which is part of release 3.4.11 and 3.4.12

Check the queue pointer (the NULL argument in the first call) in the following call chain:

source3/libsmb/async_smb.c:
struct tevent_req *cli_session_request_send(TALLOC_CTX *mem_ctx,
                                            struct tevent_context *ev,
                                            int sock,
                                            const struct nmb_name *called,
                                            const struct nmb_name *calling)
{
...
  subreq = writev_send(state, ev, NULL, sock, state->iov, 3);

lib/async_req/async_sock.c:
struct tevent_req *writev_send(TALLOC_CTX *mem_ctx, struct tevent_context *ev,
                               struct tevent_queue *queue, int fd,
                               struct iovec *iov, int count)
{
...
  if (!tevent_queue_add(queue, ev, result, writev_trigger, NULL)) {

lib/tevent/tevent_queue.c:
bool tevent_queue_add(struct tevent_queue *queue,
                      struct tevent_context *ev,
                      struct tevent_req *req,
                      tevent_queue_trigger_fn_t trigger,
                      void *private_data)
{
...
  DLIST_ADD_END(queue->list, e, struct tevent_queue_entry *);