hp_try_record() takes a pointer to a pointer, casts it to void **, and then passes it to _h_t_r_impl(). So far so good. hp_record() takes a pointer to a pointer, but dereferences it when calling hp_try_record(). That seems odd to me. Let's say we have a structure foo_t, and a pointer to it, foo_p. Then hp_record((void **)&foo_p, hp) => hp_try_record(*p, hp) // p is pointer to pointer to foo_s => _h_t_r_impl((void **)p, hp) // p is a pointer to foo_s, cast as (void **) => tmp = READ_ONCE(*p) // reading from the first bytes of foo_s as an address I also tried building the example route_hazard.c such that it uses hp_record() instead of hp_try_record(), and it crashes as I expected. Am I missing something? --Elad