If the active TLS session has a pending dedicated ACK packet, tls_multi_process sets to_link to ks->ack_write_buf. If in the same execution of tls_multi_process, the initializing session reaches the authenticated stage, the active session will be freed which leaves to_link.data pointing to freed memory.