domain_search_list_len is unsigned, and the post-decrement runs on the final test too. When the length reaches 0 the condition is false but the decrement has already wrapped it to UINT_MAX, so the field is left corrupted. The next reset then does

o->domain_search_list[UINT_MAX] = NULL

and walks far out of bounds, writing NULL through each slot. A server can drive this reset path against a client with PUSH_UPDATE, so on Windows and Android this is a remotely reachable out-of-bounds write.

NOTE: Fixed by: https://github.com/OpenVPN/openvpn/commit/d586f8ad9bfc582cc7984fcd482dc7cfacc940e2 (v2.7.8)