Let see to syncprov_matchops() in syncprov.c:

lines 1233-1235 (begin of the loop): ldap_pvt_thread_mutex_lock( &si->si_ops_mutex ); for (ss = si->si_ops, sprev = (syncops *)&si->si_ops; ss; sprev = ss, ss=snext)

lines 1273-1275: ss = sprev; continue; }

and 1347 (near from end of the loop): syncprov_free_syncop( ss );

Seems that syncops which is freed on 1347 could be referenced by 1273 on a next iteration of the loop.

Leonid.