There is use-after-free bug in AsyncRPCRunnerImpl::_sendCommand.

• The lambda captures the raw
  opCtx pointer
• but the OperationContext can be destroyed before the async lambda executes.

This is especially true in ShardingDDLCoordinators, where we create a new OperationContext for every phase.
When the lambda runs and creates a RemoteCommandRequest , it calls _updateTimeoutFromOpCtxDeadline() with the invalid pointer, causing a segfault when calling opCtx->getRemainingMaxTimeMillis().

Note that in spite have already a check here  it has been still observed a SEGFAULT in the mentioned call. This suggest the opCtx can become invalid at any moment once the request runs asynchrnously, even right after the check.

A solution could probably be to have these values copied  when calling the _sendCommand, where we still have the guarantee for the opCtx to be valid