diff --git a/src/hush.h b/src/hush.h
index 64a4c4064..4863547d7 100644
--- a/src/hush.h
+++ b/src/hush.h
@@ -510,7 +510,9 @@ int32_t hush_validate_chain(uint256 srchash,int32_t notarized_height)
         return(0);
     if ( IsInitialBlockDownload() == 0 && ((pindex= hush_getblockindex(srchash)) == 0 || pindex->GetHeight() != notarized_height) )
     {
-        fprintf(stderr,"%s: Not in IBD, height=%d\n", __func__, pindex->GetHeight() );
+        // SECURITY (null-deref crash DoS): this branch is entered when pindex==0 (srchash, taken
+        // from an attacker-controlled notarization OP_RETURN, is not a known block). Guard the deref.
+        fprintf(stderr,"%s: Not in IBD, height=%d\n", __func__, pindex != 0 ? pindex->GetHeight() : -1 );
         if ( sp->NOTARIZED_HEIGHT > 0 && sp->NOTARIZED_HEIGHT < notarized_height )
             rewindtarget = sp->NOTARIZED_HEIGHT - 1;
         else if ( notarized_height > 101 )