macho null dereference read The main problem here was not returning -1 from canonicalize_symtab on an error, leaving the vector of relocs only partly initialised and one with a null sym_ptr_ptr. * mach-o.c (bfd_mach_o_canonicalize_symtab): Return -1 on error, not 0. (bfd_mach_o_pre_canonicalize_one_reloc): Init sym_ptr_ptr to undefined section sym.