mongoc_client_kill_cursor gets a server description from the topology, then continues to access the server description after it has unlocked the topology. In pooled mode, the server description could be freed by a topology change while mongoc_client_kill_cursor holds a reference to it.