From 05a17da6fc4d0db8647b98d42983c22c5efdb784 Mon Sep 17 00:00:00 2001
From: David Carlier <devnexen@gmail.com>
Date: Sat, 25 Jul 2026 12:16:55 +0100
Subject: [PATCH] The constructor left it indeterminate, so a non-static timer
 is linked into PalTimer's list with a garbage next pointer that apply_all
 then dereferences. PalNotificationObject already initialises its equivalent.

---
 src/snmalloc/pal/pal_ds.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/snmalloc/pal/pal_ds.h b/src/snmalloc/pal/pal_ds.h
index 59976b881..1c087110f 100644
--- a/src/snmalloc/pal/pal_ds.h
+++ b/src/snmalloc/pal/pal_ds.h
@@ -103,7 +103,7 @@ namespace snmalloc
     template<typename T>
     friend class PalList;
 
-    stl::Atomic<PalTimerObject*> pal_next;
+    stl::Atomic<PalTimerObject*> pal_next{nullptr};
 
     void (*pal_notify)(PalTimerObject* self);