Prerequisites

• Write a descriptive title.
• Make sure you are able to repro it on the latest released version
• Search the existing issues.
• Refer to the FAQ.
• Refer to Differences between Windows PowerShell 5.1 and PowerShell.

Steps to reproduce

$cred=[PSCredential]::New('user',(ConvertTo-SecureString 'password' -AsPlainText -Force))
$session = New-PSSession -Credential $cred
Copy-Item PathToLocalFile_10MB RemotePath -ToSession $session

Expected behavior

No crash

Actual behavior

Pwsh terminated due to unhandled NullReferenceException 
 System.Management.Automation.Remoting.PrioritySendDataCollection.ReadOrRegisterCallback(OnDataAvailableCallback callback, DataPriorityType& priorityType)
at System.Management.Automation.Remoting.Client.WSManClientCommandTransportManager.SendOneItem()
at System.Management.Automation.Remoting.Client.WSManClientCommandTransportManager.OnRemoteCmdSendCompleted(IntPtr operationContext, Int32 flags, IntPtr error, IntPtr shellOperationHandle, IntPtr commandOperationHandle, IntPtr operationHandle, IntPtr data)

Error details

No response

Environment data

Name                           Value
----                           -----
PSVersion                      7.1.4
PSEdition                      Core
GitCommitId                    7.1.4
OS                             Microsoft Windows 10.0.19042
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

Visuals

Race condition in threads

Dereference the member variable _dataToBeSent[1] when it has been cleared by the different thread that called Clear() method.
https://github.com/PowerShell/PowerShell/blob/master/src/System.Management.Automation/engine/remoting/fanin/PriorityCollection.cs#L217-L226

The stack of thread that cleared _dataToBeSent[1] member.

Simple Fix:
Insert lock and null check before dereferencing at line 226
https://github.com/PowerShell/PowerShell/blob/master/src/System.Management.Automation/engine/remoting/fanin/PriorityCollection.cs#L226

            lock (_dataSyncObjects[promptResponseIndex])
            {
                if (_dataToBeSent[promptResponseIndex] != null)