From 9fc4d35cb28f2d7e04b3e0c9ae2ceaefe1cb4a28 Mon Sep 17 00:00:00 2001
From: Jon Shallow <supjps-libcoap@jpshallow.com>
Date: Fri, 13 Mar 2026 13:22:22 +0000
Subject: [PATCH] coap_resource.c: Fix reference to deleted Observe after
 transmit failure

---
 src/coap_resource.c | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/src/coap_resource.c b/src/coap_resource.c
index 25013bd5..6293c107 100644
--- a/src/coap_resource.c
+++ b/src/coap_resource.c
@@ -1357,10 +1357,25 @@ coap_notify_observers(coap_context_t *context, coap_resource_t *r,
 #if COAP_Q_BLOCK_SUPPORT
 finish:
 #endif /* COAP_Q_BLOCK_SUPPORT */
-      if (COAP_INVALID_MID == mid && obs) {
+      if (COAP_INVALID_MID == mid) {
         coap_log_debug("*  %s: coap_check_notify: sending failed, resource stays "
                        "partially dirty\n", coap_session_str(obs_session));
-        obs->dirty = 1;
+        if (obs) {
+          coap_subscription_t *s;
+          /*
+           * obs may have been deleted in coap_send_internal() or
+           * coap_send_q_block2().
+           */
+          LL_FOREACH(r->subscribers, s) {
+            if (s == obs) {
+              break;
+            }
+          }
+          if (s == NULL)
+            obs = NULL;
+        }
+        if (obs)
+          obs->dirty = 1;
         r->partiallydirty = 1;
       }
       goto cleanup;