[Fix] Dereference after free in sta_remove_callback()