This looks caused by balance recovery. You could skip balance by skip_balance mount option, as a workaround. I'll look into the NULL pointer dereference by reproducing a similar situation.