I think the issue is that dirent pointer can be freed in mdc_lookup_uncached (when there is an existing non-matching stale entry ) , making the local dirent pointer in mdc_readdir_chunked stale. Further distillation of the logs above: nfs3_readdirplus.c:307 :nfs3_readdirplus :NFS READDIR :DEBUG :Readdirplus3 -> Call to fsal_readdir, cookie=0 Readdir for directory -- 0x80cb4d0 mdcache_handle.c:557 :mdcache_readdir :NFS READDIR :DEBUG :NFS READDIR: DEBUG: Calling mdcache_readdir_chunked whence=0 mdcache_helpers.c:2778 :mdcache_readdir_chunked :NFS READDIR :F_DBG :NFS READDIR: FULLDEBUG: Starting chunked READDIR for 0x80cb4d0, MDCACHE_TRUST_CONTENT true, MDCACHE_TRUST_DIR_CHUNKS true mdcache_helpers.c:2812 :mdcache_readdir_chunked :NFS READDIR :F_DBG :NFS READDIR: FULLDEBUG: Readdir chunked next_ck=0x0 look_ck=1bec77 Found the dirent 0x39c62a80 in cache for the first file in the 0x80cb4d0 -- key-file-5m-0 mdcache_helpers.c:2969 :mdcache_readdir_chunked :NFS READDIR :F_DBG :NFS READDIR: FULLDEBUG: found dirent in cached chunk 0x6f70300 dirent 0x39c62a80 key-file-5m-0 mdcache_helpers.c:2977 :mdcache_readdir_chunked :NFS READDIR :F_DBG :NFS READDIR: FULLDEBUG: About to read directory=0x80cb4d0 cookie=0 Find the real entry using lookup by key mdcache_helpers.c:892 :mdcache_find_keyed_reason :INODE :F_DBG :Looking for hk=39db57ea4d9d4b74 fsal=0x7fa690762d20 key=0x74ec1b00000000000100 mdcache_helpers.c:3007 :mdcache_readdir_chunked :NFS READDIR :F_DBG :NFS READDIR: FULLDEBUG: Lookup by key for key-file-5m-0 failed, lookup by name now mdcache_helpers.c:2812 :mdcache_readdir_chunked :NFS READDIR :F_DBG :NFS READDIR: FULLDEBUG: Readdir chunked next_ck=0x0 look_ck=1bec77 mdcache_helpers.c:2969 :mdcache_readdir_chunked :NFS READDIR :F_DBG :NFS READDIR: FULLDEBUG: found dirent in cached chunk 0x6f70300 dirent 0x39c62a80 key-file-5m-0 mdcache_helpers.c:2977 :mdcache_readdir_chunked :NFS READDIR :F_DBG :NFS READDIR: FULLDEBUG: About to read directory=0x80cb4d0 cookie=0 mdcache_helpers.c:892 :mdcache_find_keyed_reason :INODE :F_DBG :Looking for hk=39db57ea4d9d4b74 fsal=0x7fa690762d20 key=0x74ec1b00000000000100 mdcache_helpers.c:3007 :mdcache_readdir_chunked :NFS READDIR :F_DBG :NFS READDIR: FULLDEBUG: Lookup by key for key-file-5m-0 failed, lookup by name now mdcache_helpers.c:892 :mdcache_find_keyed_reason :INODE :F_DBG :Looking for hk=3d259480a5e679c3 fsal=0x7fa690762d20 key=0x076fbf00000000000100 Lookup by dirent->key failed for the actual entry. Call mdc_lookup_uncached to lookup by name -- key-file-5m-0 mdcache_lru.c:558 :mdcache_lru_clean :INODE :F_DBG :Trusting op_ctx export id 1 mdcache_helpers.c:662 :mdcache_new_entry :INODE :DEBUG :Adding a REGULAR_FILE, entry=0x1d6b4a10 mdcache_helpers.c:757 :mdcache_new_entry :INODE :F_DBG :New entry 0x1d6b4a10 added with fh_hk.key hk=3d259480a5e679c3 fsal=0x7fa690762d20 key=0x076fbf00000000000100 mdcache_handle.c:112 :mdcache_alloc_and_check_handle :INODE :F_DBG :lookup Created entry 0x1d6b4a10 FSAL FOO for key-file-5m-0 mdcache_helpers.c:1446 :mdcache_dirent_add :INODE :F_DBG :Add dir entry key-file-5m-0 mdcache_avl.c:323 :mdcache_avl_insert :NFS READDIR :F_DBG :NFS READDIR: FULLDEBUG: Insert dir entry 0x39cec330 key-file-5m-0 mdcache_avl.c:381 :mdcache_avl_insert :NFS READDIR :DEBUG :NFS READDIR: DEBUG: Already existent when inserting new dirent on entry=0x80cb4d0 name=key-file-5m-0 New entry created 0x1d6b4a10, new dir entry: 0x39cec330 key-file-5m-0 mdcache_avl.c:402 :mdcache_avl_insert :NFS READDIR :F_DBG :NFS READDIR: FULLDEBUG: Keys for key-file-5m-0 don't match v=hk=3d259480a5e679c3 fsal=0x7fa690762d20 key=0x076fbf00000000000100 v2=hk=39db57ea4d9d4b74 fsal=0x7fa690762d20 key=0x74ec1b00000000000100 mdcache_avl.c:167 :unchunk_dirent :NFS READDIR :F_DBG :NFS READDIR: FULLDEBUG: Unchunking 0x39c62a80 key-file-5m-0 mdcache_avl.c:245 :mdcache_avl_remove :NFS READDIR :F_DBG :NFS READDIR: FULLDEBUG: Just freed dirent 0x39c62a80 from chunk 0x6f70300 parent 0x80cb4d0 mdcache_avl.c:369 :mdcache_avl_insert :NFS READDIR :F_DBG :NFS READDIR: FULLDEBUG: Inserted dirent key-file-5m-0 with ckey hk=3d259480a5e679c3 fsal=0x7fa690762d20 key=0x076fbf00000000000100 dirent 0x39c62a80 freed, new 0x39cec330 added mdcache_helpers.c:1702 :place_new_dirent :NFS READDIR :F_DBG :NFS READDIR: FULLDEBUG: Could not add key-file-5m-0 to chunk for directory 0x80cb4d0, compute_readdir_cookie failed mdcache_helpers.c:2049 :place_new_dirent :NFS READDIR :F_DBG :NFS READDIR: FULLDEBUG: Entry 0x80cb4d0 clearing MDCACHE_DIR_POPULATED, MDCACHE_TRUST_DIR_CHUNKS Back to readdir_chunked -- local dirent pointer still is 0x39c62a80, but it has been freed from the chunk. mdcache_helpers.c:3112 :mdcache_readdir_chunked :NFS READDIR :F_DBG :NFS READDIR: FULLDEBUG: Setting next_ck=1bec77 nfs3_readdirplus.c:436 :nfs3_readdirplus_callback :NFS READDIR :DEBUG :Callback for key-file-5m-0 cookie 1830007 mdcache_helpers.c:3151 :mdcache_readdir_chunked :NFS READDIR :F_DBG :NFS READDIR: FULLDEBUG: dirent = 0x39c62a80 key-file-5m-0, cb_result = DIR_CONTINUE, eod = false