During validation of a document against the W3C schema-for-schemas, an element might be validated against the type named xs:attribute; as a result, this will be the type annotation on the node. Subsequent processing may attempt to retrieve the complex type definition corresponding to this annotation. The attempt to look up this type fails, returning null, which is very likely to cause a NullPointerException. The reason it fails is that xs:attribute is a "built-in" name (one that is given a fixed fingerprint rather than a dynamic one allocated from the NamePool), and Saxon is assuming that a type with a built-in name is a built-in type, which xs:attribute is not. The same problem could occur if other built-in names, for example xsl:version, are used for user-defined types.
A patch to module EnterpriseConfiguration.java (in the Saxonica private code) is being raised.