Libbpf.c crash in method

Regarding the function in libbpf.c: void bpf_program__unload(struct bpf_program *prog)

I received a crash on the expression:

for (i = 0; i < prog->instances.nr; i++)
zclose(prog->instances.fds[i]);

I believe prog->instances.nr is not the proper length of prog->instances.fds[], unless my implementation of this method is wrong.

Start in libbpf.c at bpf_program__unload and inspect how prog->instances.nr relates to prog->instances.fds[]. Reproduce or trace the reported crash, then verify the unload path uses the valid instance range without accessing outside the file-descriptor array.

Written by the indexing model from the issue text.