What appears to happen here is that NM uses a scheduled callback to perform actions on device objects. however, those device objects are neither refcounted nor are the callbacks cancelled when the device goes down and we end up accessing freed memory in the callback.
What appears to happen here is that NM uses a scheduled callback to perform actions on device objects. however, those device objects are neither refcounted nor are the callbacks cancelled when the device goes down and we end up accessing freed memory in the callback.