The MovePrimarySourceManager calls cleanupOnError in a ScopeGuard in a few places, and in this method it wraps a call to ShardingCatalogCatalogClientImpl::logChange with uassertStatusOK inside a try catch statement that only catches NotMaster errors. If the CSRS is unreachable, the log could fail with an error other than NotMaster (like a network or read preference error), which would lead to std::terminate.