Zero the wrk->vgz_rx pointer once we have freed it.

bin/varnishd/cache_esi_fetch.c

@@ -304,6 +304,7 @@ vfp_esi_begin(struct sess *sp, size_t estimate)
 	CHECK_OBJ_NOTNULL(sp, SESS_MAGIC);
 	/* XXX: snapshot WS's ? We'll need the space */
 
+	AZ(sp->wrk->vgz_rx);
 	if (sp->wrk->is_gzip && sp->wrk->do_gunzip) {
 		sp->wrk->vgz_rx = VGZ_NewUngzip(sp, "U F E");
 		VEP_Init(sp, NULL);

bin/varnishd/cache_fetch.c

@@ -504,6 +504,7 @@ FetchBody(struct sess *sp, const struct http *hp)
 	 * XXX: Missing:  RFC2616 sec. 4.4 in re 1xx, 204 & 304 responses
 	 */
 
+	AZ(sp->wrk->vgz_rx);
 	AZ(VTAILQ_FIRST(&sp->obj->store));
 	switch (sp->wrk->body_status) {
 	case BS_NONE:
@@ -537,6 +538,7 @@ FetchBody(struct sess *sp, const struct http *hp)
 		INCOMPL();
 	}
 	XXXAZ(sp->wrk->vfp->end(sp));
+	AZ(sp->wrk->vgz_rx);
 	/*
 	 * It is OK for ->end to just leave the last storage segment
 	 * sitting on sp->wrk->storage, we will always call vfp_nop_end()

bin/varnishd/cache_gzip.c

@@ -393,6 +393,7 @@ static void __match_proto__()
 vfp_gunzip_begin(struct sess *sp, size_t estimate)
 {
 	(void)estimate;
+	AZ(sp->wrk->vgz_rx);
 	sp->wrk->vgz_rx = VGZ_NewUngzip(sp, "U F -");
 }
 
@@ -438,6 +439,7 @@ vfp_gunzip_end(struct sess *sp)
 	struct vgz *vg;
 
 	vg = sp->wrk->vgz_rx;
+	sp->wrk->vgz_rx = NULL;
 	CHECK_OBJ_NOTNULL(vg, VGZ_MAGIC);
 	VGZ_Destroy(&vg);
 	sp->obj->gziped = 0;
@@ -462,6 +464,7 @@ vfp_gzip_begin(struct sess *sp, size_t estimate)
 {
 	(void)estimate;
 
+	AZ(sp->wrk->vgz_rx);
 	sp->wrk->vgz_rx = VGZ_NewGzip(sp, "G F -");
 }
 
@@ -507,6 +510,7 @@ vfp_gzip_end(struct sess *sp)
 	int i;
 
 	vg = sp->wrk->vgz_rx;
+	sp->wrk->vgz_rx = NULL;
 	CHECK_OBJ_NOTNULL(vg, VGZ_MAGIC);
 	do {
 		VGZ_Ibuf(vg, "", 0);
@@ -587,6 +591,7 @@ vfp_testgzip_end(struct sess *sp)
 	struct vgz *vg;
 
 	vg = sp->wrk->vgz_rx;
+	sp->wrk->vgz_rx = NULL;
 	CHECK_OBJ_NOTNULL(vg, VGZ_MAGIC);
 	VGZ_UpdateObj(vg, sp->obj);
 	VGZ_Destroy(&vg);