Why does this crash in release but not debug?

gistfile1.m

struct __attribute__((__packed__)) EOSObjectAddedInfoEx {
    uint32_t handle;
    uint32_t storage_id;
    uint32_t unknown2;
    uint32_t unknown3;
    uint32_t object_format;
    uint32_t size;
    uint32_t parent_id;
    uint32_t unknown4;
};
 
// Before. This worked in debug, crashed in release. I never got a sensible crash report.

// packet.payload returns an NSData object.
 
-(void)handleObjectAddedWithPacket:(DKPTPIPPacket *)packet {
 
    const void *payload = packet.payload.bytes;
    uint32_t packet_length = packet.payload.length;
 
    if (packet_length >= sizeof(struct EOSObjectInfoEx)) {
 
        struct EOSObjectAddedInfoEx addedInfo;
        memset(&addedInfo, 0, sizeof(struct EOSObjectAddedInfoEx));
        memcpy(&addedInfo, payload, sizeof(struct EOSObjectInfoEx));
 
        NSString *name = [NSString stringWithUTF8String:payload + sizeof(struct EOSObjectAddedInfoEx)];
        // ^ BAD_ACCESS at this line as far as I can tell.
 
        DKEOSFileStorage *storage = self.storageStore[@(addedInfo.storage_id)];
        if (storage != nil) {
            [storage handleObjectAddedEventWithObjectInfo:&addedInfo name:name];
        } else {
            DDLogWarn(@"%@: Got object added event with unknown storage ID (%@).", THIS_FILE, @(addedInfo.storage_id));
        }
    } else {
        DDLogWarn(@"%@: Got object added event with payload of unexpected structure.", THIS_FILE);
    }
}
 
// After. This works all the time.
 
-(void)handleObjectAddedWithPacket:(DKPTPIPPacket *)packet {
 
    const void *payload = packet.payload.bytes;
    size_t structLength = sizeof(struct EOSObjectAddedInfoEx);
 
    if (packet.payload.length >= structLength) {
 
        struct EOSObjectAddedInfoEx addedInfo;
        memset(&addedInfo, 0, structLength);
        memcpy(&addedInfo, payload, structLength);
 
        NSData *nameData = [packet.payload subdataWithRange:NSMakeRange(structLength, packet.payload.length - structLength)];
        NSString *name = [[NSString alloc] initWithUTF8String:nameData.bytes];
 
        DKEOSFileStorage *storage = self.storageStore[@(addedInfo.storage_id)];
        if (storage != nil) {
            [storage handleObjectAddedEventWithObjectInfo:&addedInfo name:name];
        } else {
            DDLogWarn(@"%@: Got object added event with unknown storage ID (%@).", THIS_FILE, @(addedInfo.storage_id));
        }
    } else {
        DDLogWarn(@"%@: Got object added event with payload of unexpected structure.", THIS_FILE);
    }
}

The main difference between the two is that instead of traversing the void * array C-style, I use -[NSData subdataWithRange:].