lws_client_connect_3_connect()
....
try_next_dns_result:
lws_sul_cancel(&wsi->sul_connect_timeout);
....
I suggest considering whether all execution paths before these lines guarantee that there will be a valid list->owner pointer inside wsi->sul_connect_timeout. It seems to me that not all paths guarantee this. I don't know for sure and I would like to discuss it.