Let see to syncprov_matchops() in syncprov.c: lines 1233-1235 (begin of the loop): ldap_pvt_thread_mutex_lock( &si->si_ops_mutex ); for (ss = si->si_ops, sprev = (syncops *)&si->si_ops; ss; sprev = ss, ss=snext) lines 1273-1275: ss = sprev; continue; } and 1347 (near from end of the loop): syncprov_free_syncop( ss ); Seems that syncops which is freed on 1347 could be referenced by 1273 on a next iteration of the loop. Leonid.