In __wt_hs_row_search, we use WT_REF instead of the __cursor_page_pinned function to check whether we have a page pinned. And there is a code path that we are not resetting the cursor before return. Fix these issues and see if it they can make WT-6436 go away as well.