Found by Coverity scan for GRUB. hol_entry_help dereferences state parameter without checking for NULL:
if (first_long_opt || uparams.dup_args) arg (real, "=%s", "[=%s]", state->root_argp->argp_domain, stream); It is called in several places where "state" is explicitly checked for being NULL before calling hol_entry_help.