Use the is_valid_subnum() function before using the smb.subnum as an index into (s)cfg.sub[]. Related to the previous committed fix of writemsg(): leaving the global smb.subnum as -1 (INVALID_SUB) after replying to a post via email or netmail, resulting in a crash here.