maybe the crash is not always present and you would need something like Asan? is it explicitly a null deref?