When an existing user is patched with a phone number that's not already in the list a null reference exception will occur.

This checks if the phone number already exists, if not then the SingleOrDefault() will assign null to phoneNumber.

A few lines later (after retrieving the value of the patch operation) the phone number is updated while phoneNumber is null.

The same structure is used for patching email adresses, roles, addresses etc.

The patch body looked like this:

{
    "schemas": [
        "urn:ietf:params:scim:api:messages:2.0:PatchOp"
    ],
    "Operations": [
        {
            "op": "Add",
            "path": "phoneNumbers[type eq \"work\"].value",
            "value": "1120"
        }
    ]
}

Phone numbers did exist but not of type 'work'.