The crash happened because `bNodeSocket.runtime` was a nullptr. That was because the struct pointer was passed instead of the resolved pointer. Passing the resolved pointer into `BKE_animsys_nla_remap_keyframe_values` fixes the issue Pull Request: https://projects.blender.org/blender/blender/pulls/132012