a segmentation fault in the Item_func_not::fix_fields function located in item_cmpfunc.cc at line 6634.

MariaDB crashes with a segmentation fault in the Item_func_not::fix_fields function located in item_cmpfunc.cc at line 6634. This vulnerability is caused by a null pointer dereference when the function attempts to assign and call fix_fields() on a nullptr reference (ref = 0x0). The crash occurs during the query optimization phase, specifically when pushing down HAVING conditions into the WHERE clause via st_select_lex::pushdown_from_having_into_where.