Did you mean `f` or `tl` in the **"we had some crashes where fl was null"**?
Probably the `tl` should not be null, because its value (pointer) should be copied in the timer process list. But its content depends on each module that adds items to the timer list. So tl in timer list should be a non-null value, but can end up pointing to an address which is no longer a timer_ln struct.