In cx18_vapi(), when cx is NULL, it is still used on line 833: CX18_ERR("cx == NULL (cmd=%x)\n", cmd); v4l2_err(&cx->v4l2_dev, fmt , ## args) Thus, a possible null-pointer dereference may occur. This bug is found by a static analysis tool STCheck written by us. I do not know how to correctly fix this bug, so I only report it. Best wishes, Jia-Ju Bai