[tinus_hn]

The assignment merely takes the address of tun and adds a small value. That wouldn’t cause a crash.

The surprise is that the if (!tun) check is optimized sway because if tun is NULL the assignment causes undefined behavior which the compiler does not have to take into account.

[tom_]

No, it fetches it - tun->sk is copied. The address calculation case would be something more like struct sock * * p=&tun->sk.