On 6.14-rc3, any of your patches (dabbd325b25e, or the one you attached here) will fix the issue and on 6.14-rc4, there is already a patch that fixes the issue. Also, since dabbd325b25e, the node indeed should be kept while the driver is used. So even though the issue reported here is fixed by another patch, both are likely needed. That being said, I'm not sure I completely understand why that extra line fixes the issue. Is the __free() attribute smart enough to know that the pointer has been copied and not free it at the end of scope ? > I will officially post the patch to ML, but want to confirm it before it. > > Thank you for your help !! Thank you for looking into this too :) Detlev.