The MQTT-SN client keepalive handler processping() in subsys/net/lib/mqttsn/mqttsn.c removes the gateway record after PINGREQ retries are exhausted. It invoked SYSSLISTPEEKHEADCONTAINER(&client->gateways, gw, next) but discarded the result. That macro is a pure expression that does not assign to gw, so gw retained its NULL initializer regardless of the list contents.

The code then dereferences the NULL gw (gw->gwid) and passes it to mqttsngwdestroy(), reaching kmemslabfree(&gateways, NULL). With CONFIGMEMSLABPOINTERVALIDATE enabled this triggers kpanic(); in the default configuration it performs a write through the NULL pointer ((char )mem = slab->freelist;) and corrupts the slab free list. The outcome is a crash/kernel panic or, on targets where address 0 is writable, silent memory-allocator corruption.

The vulnerable branch runs whenever the connected MQTT-SN gateway fails to answer keepalive PINGREQs for the configured number of retries. This condition is controlled by the remote peer: a malicious or compromised gateway, or an on-path/adjacent attacker that advertises itself as a gateway and then stops responding (or blackholes the real gateway's PINGRESPs), forces the client into the defect. MQTT-SN runs over UDP and no authentication is required.

The impact is a remotely triggerable denial of service (availability) of the affected MQTT-SN client; there is no attacker-controlled data written. The sibling remover processadvertise() uses SYSSLISTFOREACHCONTAINERSAFE and is not affected. The fix assigns the macro's return value to gw.