Inside vkCreateDevice the overlay layer gets a pointer to the next layer like:
PFN_vkCreateDevice fpCreateDevice = (PFN_vkCreateDevice)fpGetInstanceProcAddr(NULL, "vkCreateDevice");
The Vulkan spec here states that calling vkGetInstanceProcAddr with a NULL instance must return NULL for all but a few functions listed out in the spec. As such, a conforming implementation is required to return null here (though no implementation actually does).
The fix is to look up the correct VkInstance handle associate with the VkPhysicalDevice handle that is passed by this function and to pass that instance handle to vkGetInstanceProcAddr.