Setting a hazard pointer consists of:

1. reading ref->page and setting hp->page
2. full barrier
3. reading ref->page checking it is still equal to hp->page
4. checking ref->state == WT_REF_MEM.

However, if eviction cannot evict all of the changes on a page and decides to replace the page, there is a window where ref->page == NULL. If the page replacement completes in between steps 3 and 4 above, the call to __wt_hazard_set can report success but publish a NULL hazard pointer.