sftp_new_channel creates an sftp_session without sftp_session->read_packet being initialized.
I work around that doing the following:
s=sftp_new_channel(...);
s->read_packet=calloc(1, sizeof(struct sftp_packet_struct);
s->read_packet->payload = ssh_buffer_new();
Thank you for the report. The read_packet buffer is initialized in sftp_new().
Looks like a leftover from some refactoring in 79a3fcac72fb513b1759fe30348db7b71dba68ae which introduced this member of sftp structure.
Would you like to submit a merge request on https://gitlab.com/libssh/libssh-mirror ? Ideally also with some basic test as this function is not covered by any automated test.