The top crash on crash.corp for dhcpcd involves NULL pointer dereferences in arp_packet():

https://goto.google.com/ossih

		/* Run the conflicts */
		TAILQ_FOREACH_SAFE(astate, &state->arp_states, next, astaten) {
			if (astate->conflicted_cb)
				astate->conflicted_cb(astate, &arm);
		}

Newer versions of dhcpcd have refactored this code and changed |state| from struct dhcp_state to struct iarp_state.  It's not immediately clear to me what is going wrong.


The most *easily reproducible* crash for dhcpcd is triggered by `killall -SEGV shill`.  I think this happens any time shill crashes.  It appears to be a NULL pointer dereference in stop_interface():

Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x0000590500416c23 in stop_interface (ifp=0x792c3b2bcbd8 <main_arena+88>) at dhcpcd.c:334
334		ifp->options->options |= DHCPCD_STOPPING;
(gdb) bt
#0  0x0000590500416c23 in stop_interface (ifp=0x792c3b2bcbd8 <main_arena+88>) at dhcpcd.c:334
#1  0x0000590500417182 in dhcpcd_stop_interfaces (ctx=0x7ffd8140ba08) at dhcpcd.c:1067
#2  0x0000590500453827 in dhcpcd_dbus_filter (conn=0x5905019d0210, msg=0x5905019d1e70, 
    user_data=0x0) at dbus/rpc-dbus.c:674