The file ezradio_receive_plugin.c contains function ezradioHandleReceivePlugin that calls ezradio_fifo_info(EZRADIO_CMD_FIFO_INFO_ARG_FIFO_RX_BIT, NULL).
As we can see the second parameter is NULL. Now let's see the code of the ezradio_fifo_info:
void ezradio_fifo_info(uint8_t fifo, ezradio_cmd_reply_t *ezradioReply)
/* EZRadio command buffer */
ezradioCmd = EZRADIO_CMD_ID_FIFO_INFO;
ezradioCmd = fifo;
ezradioReply->FIFO_INFO.RX_FIFO_COUNT = ezradioCmd;
ezradioReply->FIFO_INFO.TX_FIFO_SPACE = ezradioCmd;
I think it will be better if ezradio_fifo_info will check the ezradioReply for NULL before using.
You're right. It probably didn't crashed, because memory address 0x0 is the flash, and you can't just write it.
Thanks for the report, I informed the developers.