rand would be the address of rand() function and never NULL. The previous version could have crashed on invalid AKA-AUTS command. Though, these commands are only from hostapd which sends valid requests and as such, the actual issue did not show up.