fix csne destroy

servers/slapd/backend.c

@@ -486,11 +486,13 @@ int backend_destroy(void)
 		if ( bd->be_pending_csn_list ) {
 			csne = LDAP_TAILQ_FIRST( bd->be_pending_csn_list );
 			while ( csne ) {
+				struct slap_csn_entry *tmp_csne = csne;
+
 				LDAP_TAILQ_REMOVE( bd->be_pending_csn_list, csne, ce_csn_link );
 				ch_free( csne->ce_csn->bv_val );
 				ch_free( csne->ce_csn );
 				csne = LDAP_TAILQ_NEXT( csne, ce_csn_link );
-				ch_free( csne );
+				ch_free( tmp_csne );
 			}
 		}