DayZ uses libcurl 7.55.1 which released 9 years ago (2017)

libcurl initializes itself lazily inside curl_easy_init, on the REST worker thread of the first request, without a lock.

It sets its "initialized" flag before it loads the SSPI function table. When two or more HTTPS requests are the first REST requests of the client process and start at the same time, one of them reaches the TLS handshake while the SSPI table is still NULL, and the client crashes.

The server is not affected: there the Hive (ADBOnline) calls curl_global_init on the main thread at startup. On the client nothing calls curl_global_init. Plain HTTP is not affected, because SSPI is only used for TLS.

Steps to reproduce

1. Start the client with a mod that sends HTTPS requests through RestApi.

2. Make sure no other REST request has run in this process yet.

3. Start two or more async HTTPS requests in the same frame, for example three RestContext.POST calls to an https:// URL.

4. Repeat from a fresh client start. It is a race, so it does not crash on every launch.

The requests complete without crash.

Consider updating libcurl. 7.55.1 was released in August 2017. Later versions make global initialization thread-safe and include many security fixes.