The problem involves a derived type with a character component declared CHARACTER(NULL()) or CHARACTER(NULL(n)), where mold argument n is an integer pointer.

I might be missing something, but I'm not sure there's a point to having a character variable whose length is the target of a null pointer.  This program, for example,
crashes with a SEGV reported at line 10 (with line 11 deleted, the program runs to completion):

  1 program z
  2 implicit none
  3    integer, target :: k = 0
  4    integer, pointer :: p => k
  5    nullify(p)
  6    call s(p)
  7 contains
  8    subroutine s(n)
  9       integer, pointer :: n
 10       character (len=n) q
 11       q = 'a'
 12    end subroutine
 13 end program

What to do with CHARACTER(NULL([mold])), besides fix the ICE?  It might have been possible to generate code to define a null pointer and generate code to dereference it and get the expected SEGV, but it seemed easier and possibly more productive to treat CHARACTER(NULL(..)) as an error.  I don't know how what the standard has to say about this.  It might have been one of those things its authors never thought about.

Since this problem is detected at different places in the code, the attached test case gives the following errors with the attached patch:

! { dg-do compile }
! PR 67806
! 1. Initialize a variable of derived type with a string component having
!    a length that is the target of the NULL intrinsic.
! 2. Declare a derived type with a string component having a length that is
!    the target of the NULL intrinsic with an integer mold argument.
subroutine s1
   type t
      character(null()) :: c ! { dg-error "is target of NULL pointer" }
                1
Error: Character length of component ‘c’ is target of NULL pointer at (1)
   end type
   type(t) :: x = t('a')
end subroutine

subroutine s2
   integer, pointer :: n
   type t
      character(null(n)) :: c ! { dg-error "is target of NULL pointer" }
                1
Error: Character length is target of NULL pointer at (1)
   end type
end subroutine