BT for FR3, segfault on "update proxy-reply" in an eap inner tunnel

gistfile1.txt

#0  radius_pairmove (request=0x96da50, to=0x70, from=0x8586e0) at src/main/evaluate.c:829
        i = <optimized out>
        j = <optimized out>
        count = <optimized out>
        from_count = <optimized out>
        to_count = <optimized out>
        tailto = <optimized out>
        vp = <optimized out>
        next = <optimized out>
        last = <optimized out>
        from_list = 0x83cb30
        to_list = <optimized out>
        edited = 0x0
#1  0x00000000004395de in radius_update_attrlist (request=0x96da50, cs=<optimized out>, input_vps=<optimized out>, name=0x69a7df "proxy-reply") at src/main/evaluate.c:1232
        list = <optimized out>
        ci = 0x0
        newlist = 0x8586e0
        vp = 0x0
        output_vps = 0x70
        request_name = <optimized out>
        update_request = 0x96da50
#2  0x0000000000422d3a in modcall (component=1, c=0x82b090, request=<optimized out>) at src/main/modcall.c:499
        rcode = <optimized out>
        myresult = 6
        stack = {pointer = 3, priority = {<optimized out> <repeats 32 times>}, result = {<optimized out> <repeats 32 times>}, children = {<optimized out> <repeats 32 times>}, start = {<optimized out> <repeats 32 times>}}
        parent = 0x8df8a0
        child = 0x8d9a90
        if_taken = 1
        was_if = 1
#3  0x0000000000421976 in indexed_modcall (comp=1, idx=0, request=0x96da50) at src/main/modules.c:793
        rcode = <optimized out>
        list = 0x82b090
        server = <optimized out>
#4  0x000000000040de88 in rad_authenticate (request=0x96da50) at src/main/auth.c:444
        namepair = <optimized out>
        check_item = <optimized out>
        auth_item = 0x0
        module_msg = <optimized out>
        tmp = <optimized out>
        result = <optimized out>
        password = 0x447318 ""
        autz_retry = 0 '\000'
        autz_type = 0
#5  0x000000000040e4fb in rad_virtual_server (request=0x96da50) at src/main/auth.c:685
        vp = <optimized out>
        result = <optimized out>
#6  0x00007ffff4ad0719 in eappeap_process (handler=<optimized out>, tls_session=0x948c60) at src/modules/rlm_eap/types/rlm_eap_peap/peap.c:1033
        t = <optimized out>
        fake = 0x96da50
        vp = <optimized out>
        rcode = 0
        data = 0x94cd9c "\032\002\b"
        data_len = 76
        request = <optimized out>
        eap_ds = 0x851480
#7  0x00007ffff4ace935 in eappeap_authenticate (arg=0x8290d0, handler=0x947ad0) at src/modules/rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c:382
        rcode = <optimized out>
        status = FR_TLS_OK
        inst = 0x8290d0
        tls_session = 0x948c60
        peap = 0x959470
        request = 0x9473a0
#8  0x00007ffff54ece7c in eaptype_call (atype=0x829fc0, handler=0x947ad0) at src/modules/rlm_eap/eap.c:184
        rcode = 1
        request = 0x9473a0
        module = 0x8064a0 "eap"
#9  0x00007ffff54ed233 in eaptype_select (inst=0x807370, handler=<optimized out>) at src/modules/rlm_eap/eap.c:403
        i = <optimized out>
        default_eap_type = 25
        eaptype = 0x947bb8
        vp = <optimized out>
        namebuf = "\260\200\222\000\000\000\000\000\200\024\205\000\000\000\000\000\240s\224\000\000\000\000\000H\323\377\377\377\177\000\000ps\200\000\000\000\000\000?B\000\000\000\000\000ps\200\000\000\000\000\000N\345N\365\377\177\000
"
        eaptype_name = 0x7ffff52e628f "peap"
        request = 0x9473a0
#10 0x00007ffff54ec920 in eap_authenticate (request=0x9473a0, instance=0x807370) at src/modules/rlm_eap/rlm_eap.c:317
        handler = 0x947ad0
        eap_packet = 0x0
        rcode = <optimized out>
#11 eap_authenticate (instance=0x807370, request=0x9473a0) at src/modules/rlm_eap/rlm_eap.c:279
        inst = 0x807370
        rcode = RLM_MODULE_FAIL
#12 0x0000000000423552 in call_modsingle (request=0x9473a0, component=0, sp=<optimized out>) at src/main/modcall.c:305
        myresult = <optimized out>
        blocked = <optimized out>
#13 modcall (component=0, c=0x9280b0, request=<optimized out>) at src/main/modcall.c:796
        myresult = <optimized out>
        stack = {pointer = 1, priority = {<optimized out> <repeats 32 times>}, result = {<optimized out> <repeats 32 times>}, children = {<optimized out> <repeats 32 times>}, start = {<optimized out> <repeats 32 times>}}
        parent = 0x9280b0
        child = 0x928020
        if_taken = 0
        was_if = 0
#14 0x0000000000421976 in indexed_modcall (comp=0, idx=6, request=0x9473a0) at src/main/modules.c:793
        rcode = <optimized out>
        list = 0x9280b0
        server = <optimized out>
#15 0x000000000040e2aa in rad_check_password (request=0x9473a0) at src/main/auth.c:253
        auth_type_pair = 0x0
        cur_config_item = <optimized out>
        auth_type = 6
        auth_type_count = 1
        result = 0
#16 rad_authenticate (request=0x9473a0) at src/main/auth.c:530
        namepair = 0x9688b0
        check_item = <optimized out>
        auth_item = 0x0
        module_msg = <optimized out>
        tmp = <optimized out>
        result = <optimized out>
        password = 0x447318 ""
        autz_retry = <optimized out>
        autz_type = <optimized out>
#17 0x0000000000432cfd in request_running (action=1, request=0x9473a0) at src/main/process.c:1180
No locals.
#18 request_running (request=0x9473a0, action=1) at src/main/process.c:1149
No locals.
#19 0x00000000004314fb in request_queue_or_run (request=0x9473a0, process=0x432b90 <request_running>) at src/main/process.c:824
        when = {tv_sec = 1359288173, tv_usec = 772412}
#20 0x0000000000432657 in request_insert (listener=0x946050, packet=0x96dc20, client=0x7ffd80, fun=0x40db90 <rad_authenticate>, pnow=0x7fffffffe1e0) at src/main/process.c:1437
        request = 0x9473a0
#21 0x00000000004327d7 in request_receive (listener=0x946050, packet=0x96dc20, client=0x7ffd80, fun=0x40db90 <rad_authenticate>) at src/main/process.c:1332
        count = <optimized out>
        packet_p = <optimized out>
        request = 0x0
        now = {tv_sec = 1359288173, tv_usec = 439071}
        sock = 0x946120
#22 0x000000000041ccab in auth_socket_recv (listener=0x946050) at src/main/listen.c:1468
        rcode = <optimized out>
        code = 1
        src_port = 1814
        packet = 0x96dc20
        fun = <optimized out>
        client = 0x7ffd80
        src_ipaddr = {af = 2, ipaddr = {ip4addr = {s_addr = 235712707}, ip6addr = {__in6_u = {__u6_addr8 = "ð\f\016\333?\367\377\177\000\000\211qy\005", __u6_addr16 = {45251, 3596, 55515, 63418, 32767, 0, 29065, 1401}, __u6_addr32 = {
                  235712707, 4156217563, 32767, 91845001}}}}, scope = 0}
#23 0x000000000042f480 in event_socket_handler (xel=<optimized out>, fd=<optimized out>, ctx=<optimized out>) at src/main/process.c:3424
        listener = <optimized out>
#24 0x00007ffff7bc63de in fr_event_loop (el=0x9300f0) at src/lib/event.c:415
        ef = 0x930138
        i = <optimized out>
        rcode = <optimized out>
        maxfd = 26
        when = {tv_sec = 1359288173, tv_usec = 682883}
        wake = <optimized out>
        read_fds = {fds_bits = {16777216, 0 <repeats 15 times>}}
        master_fds = {fds_bits = {125829120, 0 <repeats 15 times>}}
#25 0x000000000040d0f4 in main (argc=<optimized out>, argv=<optimized out>) at src/main/radiusd.c:415
        rcode = <optimized out>
        argval = <optimized out>
        spawn_flag = 0
        dont_fork = 1
        flag = 0
        act = {__sigaction_handler = {sa_handler = 0x4253b0 <sig_fatal>, sa_sigaction = 0x4253b0 <sig_fatal>}, sa_mask = {__val = {0 <repeats 16 times>}}, sa_flags = 0, sa_restorer = 0}