You're looking at 'func', the error is in 'walk'. Here is the top of 'walk': walk: push rbx mov rbx, rdi test esi, esi je .L3 mov rdi, QW

You're looking at 'func', the error is in 'walk'. Here is the top of 'walk': walk: push rbx mov rbx, rdi test esi, esi je .L3 mov rdi, QWORD PTR [rdi] call walk Note that esi = cleanup = 1 so the branch to .L3 is not taken, and the recursive call to 'walk' is taken. The crash will occur on the instruction before the call, mov rdi, QWORD PTR [rdi] Because rdi = 0 on the second call to 'walk'.