Forgot to initialise ssh->portfwds to NULL. Unusually, this was