bin/60422: ldd, rtld: crash inside assertion if needed object not found

>Number:         60422
>Category:       bin
>Synopsis:       ldd, rtld: crash inside assertion if needed object not found
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Jul 07 13:40:01 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11
>Organization:
The NetLDD Notfoundandcrashed, Inc.
>Environment:
>Description:
	assert((*needed)->obj == NULL);
	(*needed)->obj = _rtld_load_library(name, obj, flags, mask);
	assert((*needed)->obj->refcount > 0);
	return ((*needed)->obj != NULL);

(*needed)->obj may be null at the point we dereference it.
>How-To-Repeat:
mv /usr/lib/libroken.so.20 /usr/lib/libroken.so.20.hidden
ldd /usr/bin/kinit
>Fix:
--- src/libexec/ld.elf_so/load.c
+++ src/libexec/ld.elf_so/load.c
@@ -338,7 +338,7 @@
 
 	assert((*needed)->obj == NULL);
 	(*needed)->obj = _rtld_load_library(name, obj, flags, mask);
-	assert((*needed)->obj->refcount > 0);
+	assert((*needed)->obj == NULL || (*needed)->obj->refcount > 0);
 	return ((*needed)->obj != NULL);
 }