> Hmm, state->next refers to two different pointer values on line 1 and line > 2. It may end up being set to NULL on line 1. Am I missing something?
True, lnext(state->next) can set it to NULL. I confused by the below code on the same function doing the steps in reverse order. With this cleared, I have nothing else to say, so I am setting this to ready for committer.