Consider the case that a connection doesn't have a valid socket during OOS

src/or/connection.c

@@ -4587,6 +4587,11 @@ pick_oos_victims, (int n))
     tor_assert(c->type <= CONN_TYPE_MAX_);
     ++(conn_counts_by_type[c->type]);
 
+    /* Skip anything without a socket we can free */
+    if (!(SOCKET_OK(c->s))) {
+      continue;
+    }
+
     /* Skip anything we would count as moribund */
     if (connection_is_moribund(c)) {
       continue;

src/or/main.c

@@ -662,7 +662,7 @@ connection_count_moribund, (void))
    * runs next.
    */
   SMARTLIST_FOREACH_BEGIN(closeable_connection_lst, connection_t *, conn) {
-    if (connection_is_moribund(conn)) ++moribund;
+    if (SOCKET_OK(conn->s) && connection_is_moribund(conn)) ++moribund;
   } SMARTLIST_FOREACH_END(conn);
 
   return moribund;