## Environment

  - OS: Windows 10 x64 (10.0.26200)

  - .NET SDK: 9.0.310

  - EF Core: 9.0.11

  - Devart.Data.Oracle.EFCore: 11.0.0.9

  - Provider: Devart dotConnect for Oracle

  ## Database

  Oracle database with existing tables:

  - Items (Id, OwnerId)

  - Itemsub (Id, Com, StringValue)

  ## Steps to reproduce

  1. Open the attached minimal repro project.

  2. Update the Oracle connection string in Program.cs.

  3. Run:

  dotnet run

  ## Code (key part)

  ```csharp

  var query1 = from item in context.Items

   join it in context.Itemsub.Where(e => e.Com > 0) on item.Id equals it.Com

   select new ItemDto { Id = item.Id, OwnerId = item.OwnerId, StringValue = it.StringValue };

  var query2 = from item in context.Itemsub

   join it in context.Items.Where(e => e.OwnerId == "zh") on item.Com equals it.Id

   select new ItemDto { Id = item.Id, OwnerId = it.OwnerId, StringValue = item.StringValue };

  query2.Skip(0).Take(10).ToList(); // ok

  query1.Skip(0).Take(10).ToList(); // throws NRE

  ## Expected behavior

  Both queries should execute successfully.

  ## Actual behavior

  query1 throws:

  System.NullReferenceException

     at Microsoft.EntityFrameworkCore.Query.SqlExpressions.SelectExpression.PushdownIntoSubqueryInternal(Boolean liftOrderings)

     at Microsoft.EntityFrameworkCore.Query.SqlExpressions.SelectExpression.PushdownIntoSubquery()

     at Devart.Data.Oracle.Entity.ClassicPagingVisitor...

     ...

  ## Notes

  - The failure happens during query translation (before materialization).

  - The issue only occurs when paging (Skip/Take) is applied.

  - Two workarounds in the repro code:

      1. Move WHERE after JOIN: query1_where_after_join

      2. Force Itemsub.Id usage to prevent projection pruning: query1_keep_subquery_id