In nftablesupdtable, if nftablestableenable returns an error, nfttransdestroy is called to free the transaction object. nfttransdestroy() calls listdel(), but the transaction was never placed on a list -- the list head is all zeroes, this results in a NULL pointer dereference.