In SERVER-52846, helpers were added to the dbdirect client to perform inserts, updates, and deletes more easily. In SERVER-81246 a writeConcernError was added to the WriteCommandReplyBase (which is included as part of the reply types of the dbDirectClient helpers. The writeConcernError is a bson object, and so when the dbDirectClient helpers parse the insert/delete/update reply, they are not taking ownership of the writeConcernError sub-object. This means that as soon as the insert/update/delete functions in the dbdirect client return, the writeConcernError is already out of scope, and any caller who attempts to check the write concern error will be accessing freed memory.