In src/include/serial_inline.h, __wt_update_serial dereferences upd before checking whether it's null:

prev_upd_ts = WT_TS_NONE;
prev_upd_ts = upd->prev_durable_ts;

Seems like it should be prev_upd_ts = (upd == NULL) ? WT_TS_NONE : upd->prev_durable_ts;.

Marking as minor since the two call sites seem to do appropriate checks.