avl_find null pointer dereference on a broken pool

gistfile1.txt

[12804.765044] Oops: 0000 [#1] SMP PTI
[12804.768934] CPU: 2 PID: 4670 Comm: txg_sync Tainted: P           O      5.3.0-19-generic #20-Ubuntu
[12804.779028] Hardware name: Intel Corporation S1200RP/S1200RP, BIOS S1200RP.86B.01.04.0002.011020141517 01/10/2014
[12804.790523] RIP: 0010:dle_enqueue_subobj.isra.0+0x25/0x110 [zfs]
[12804.797234] Code: 0f 1f 44 00 00 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 4d 89 c6 41 55 49 89 cd 41 54 49 89 fc 53 48 89 d3 48 83 ec 10 48 8b 3f <4c> 8b 7a 58 48 89 75 d0 e8 9e b3 fd ff 4c 8d
 43 20 4c 3b b8 40 01
[12804.818189] RSP: 0018:ffffaf8f43fb74e0 EFLAGS: 00010282
[12804.824018] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000008e009
[12804.831978] RDX: 0000000000000000 RSI: ffffa01be6d4a978 RDI: ffffa01ce3f6d000
[12804.839944] RBP: ffffaf8f43fb7518 R08: ffffa01af1bc99c0 R09: 0000000000000000
[12804.847905] R10: ffffa01cdf1db510 R11: 0000008000000000 R12: ffffa01be6d4a970
[12804.855866] R13: 000000000008e009 R14: ffffa01af1bc99c0 R15: 0000000000082216
[12804.863826] FS:  0000000000000000(0000) GS:ffffa01cef880000(0000) knlGS:0000000000000000
[12804.872853] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[12804.879262] CR2: 0000000000000058 CR3: 00000001fe80a006 CR4: 00000000001606e0
[12804.887224] Call Trace:
[12804.889951]  ? avl_find+0x5f/0x90 [zavl]
[12804.894364]  dsl_deadlist_insert_bpobj+0x10e/0x1a0 [zfs]
[12804.900323]  ? RW_WRITE_HELD+0xd/0x30 [zfs]
[12804.905020]  ? zap_cursor_retrieve+0x178/0x280 [zfs]
[12804.910588]  ? zap_remove+0x13/0x20 [zfs]
[12804.915081]  ? zap_remove_int+0x55/0x80 [zfs]
[12804.919954]  dsl_deadlist_merge+0xda/0x2e0 [zfs]
[12804.925122]  ? do_raw_spin_unlock+0x9/0x10 [zfs]
[12804.930287]  ? __raw_spin_unlock+0x9/0x10 [zfs]
[12804.935357]  ? dmu_buf_will_dirty_impl+0x8f/0x120 [zfs]
[12804.941234]  ? parent_delta+0x3d/0x90 [zfs]
[12804.945921]  ? do_raw_spin_unlock+0x9/0x10 [zfs]
[12804.951093]  ? __raw_spin_unlock+0x9/0x10 [zfs]
[12804.956168]  ? dsl_dir_diduse_space+0x117/0x190 [zfs]
[12804.961826]  ? dsl_dir_diduse_space+0x15c/0x190 [zfs]
[12804.967493]  dsl_destroy_snapshot_sync_impl+0x2f4/0xb40 [zfs]
[12804.973937]  dsl_destroy_snapshot_sync+0x62/0xb0 [zfs]
[12804.979703]  ? dsl_destroy_snapshot_check_impl+0x140/0x140 [zfs]
[12804.986436]  zcp_sync_task+0x62/0xd0 [zfs]
[12804.991037]  ? dsl_destroy_snapshot_check+0xa0/0xa0 [zfs]
[12804.997091]  zcp_synctask_destroy+0x8b/0x110 [zfs]
[12805.002467]  zcp_synctask_wrapper+0xa6/0x180 [zfs]
[12805.007842]  ? dsl_dir_phys.isra.0+0x10/0x10 [zfs]
[12805.013201]  luaD_precall+0xdb/0x280 [zlua]
[12805.017868]  luaV_execute+0xd8d/0x13b0 [zlua]
[12805.022728]  luaD_call+0xa7/0xc0 [zlua]
[12805.027006]  f_call+0x16/0x20 [zlua]
[12805.030993]  luaD_rawrunprotected+0x65/0xa0 [zlua]
[12805.036337]  ? lua_setmetatable+0x100/0x100 [zlua]
[12805.041682]  ? luaD_rawrunprotected+0x50/0xa0 [zlua]
[12805.047220]  luaD_pcall+0x3a/0xa0 [zlua]
[12805.051594]  lua_pcallk+0x7b/0x130 [zlua]
[12805.056098]  zcp_eval_impl+0x13d/0x410 [zfs]
[12805.060895]  zcp_eval_sync+0x58/0x60 [zfs]
[12805.065489]  dsl_sync_task_sync+0xbc/0x110 [zfs]
[12805.070662]  dsl_pool_sync+0x37b/0x410 [zfs]
[12805.075453]  spa_sync_iterate_to_convergence+0xe0/0x1c0 [zfs]
[12805.081893]  spa_sync+0x312/0x5b0 [zfs]
[12805.086202]  txg_sync_thread+0x279/0x310 [zfs]
[12805.091198]  ? txg_dispatch_callbacks+0x100/0x100 [zfs]
[12805.097031]  thread_generic_wrapper+0x83/0xa0 [spl]
[12805.102464]  kthread+0x104/0x140
[12805.106063]  ? clear_bit+0x20/0x20 [spl]
[12805.110438]  ? kthread_park+0x80/0x80
[12805.114523]  ret_from_fork+0x35/0x40