Fix state descriptor null-dereference

This happens if the client sends us SDL blobs coded with a STATEDESC we don't know about.