This is a UAF but only in the shutdown path because it can ony be triggered via `circuit_free_all()`. In `conflux_pool.c`, we share the resolving streams without never setting it to NULL in the `old_circ`: ```c new_circ->resolving_streams = old_circ->resolving_streams; ``` So the problem shows up in `circuit_free_all()`: ```c while (or_circ->resolving_streams) { edge_connection_t *next_conn; next_conn = or_circ->resolving_streams->next_stream; // UAF here connection_free_(TO_CONN(or_circ->resolving_streams)); or_circ->resolving_streams = next_conn; } ``` Plausible fix is to set to NULL but need more investigation to make sure that the goal here wasn't to indeed share those streams. Also, there might be the same problem with the `n_streams`, `p_streams` and `half_streams`. This is now TROVE-2026-016. /cc @mikeperry