Ran the thing in gdb. The sigsegv occurs because some delete operator somewhere is passing a bad pointer to free(). I found a post via a google search where someone else had seen the same syndrome but the segv went away when the compiled without -O2 (the distribution .spec file seems to specify -O2). Sometimes things like this _are_ caused by optimizer bugs, and I'm using gcc 2.96 which is know to contain optimizer bugs.

I'll post here if I ever get the issue completely debugged. I suspect it's a side effect of the process exiting with some error, which it doesn't get time to report before the segv trips it up.