GitLab

If circuit_deliver_create_cell() failed Tor still assumes circuit was attached to n_chan and tries to mess with it later. While marking circuit by circuit_mark_for_close() it calls:

  if (circ->n_chan) {
    circuit_clear_cell_queue(circ, circ->n_chan);
    /* Only send destroy if the channel isn't closing anyway */
    if (!(circ->n_chan->state == CHANNEL_STATE_CLOSING ||
          circ->n_chan->state == CHANNEL_STATE_CLOSED ||
          circ->n_chan->state == CHANNEL_STATE_ERROR)) {
      channel_send_destroy(circ->n_circ_id, circ->n_chan, reason);
    }
    circuitmux_detach_circuit(circ->n_chan->cmux, circ);
    circuit_set_n_circid_chan(circ, 0, NULL);
  }

It is useless, at least, or probably corrupting internal structures.