This might be a little artificial bug, but I've hit with one of QE's
reproducers.
They have a test pam client that rapidly does auth in a loop, but
evidently never calls the part of NSS responder that would in turn call
sss_dp_send_acct_req(). After sssd_be was killed and sssd_nss reconnected,
it accessed a NULL pointer in handle_requests_after_reconnect()