The metacard list isn't guaranteed to be non-null, however a method earlier on in create() checks for a null or empty list and will throw an uncaught exception if found, so it would be redundant to check for null here. There is another spot that is potentially at risk though (line 641) because a log processes the CreateRequest before that vaildate method is called, so I'll go ahead and put another commit up that validates the CreateRequest beforehand.