Hey Sean, I assigned this bug to you. After initial analysis, it appears to be a librdmacm issue. I think the rdma-cm passed up an event with a garbage or already-freed cm_id. Its readily reproducible. I've added some debug info to the bug for you. Let me know if I can help. Steve.