--- nvidia_subr.c.orig	2015-11-09 07:14:41.000000000 +0100
+++ nvidia_subr.c	2016-07-02 12:46:41.264155000 +0200
@@ -489,7 +489,9 @@
     nv_stack_t *sp;
 
     sp = sc->api_sp;
-    rm_free_unused_clients(sp, nv, filep);
+    /* Prevent rm_free_unused_clients from being called with null pointer. */
+    if (sp != NULL)
+        rm_free_unused_clients(sp, nv, filep);
 
     if (--sc->refcnt == 0) {
         NV_UMA_ZONE_FREE_STACK(sc->api_sp);
@@ -594,9 +596,12 @@
 
     sc = nv->os_state;
     sp = sc->api_sp;
+    /* If nvidia_open_dev failed and we're called from nvidia_dev_dtor, we
+     * already released api_sp. */
 
     NV_PCI_CHECK_CONFIG_SPACE(sp, nv, TRUE, TRUE, TRUE);
-    rm_free_unused_clients(sp, nv, filep);
+    if (sp != NULL)
+        rm_free_unused_clients(sp, nv, filep);
 
     if (--sc->refcnt == 0) {
         if (sc->UD_object != NULL)