vpopmail POP: "ERR aac, chiled crashed" after reboot, core dumped

[Chris Shenton]

I support an ISP remotely, which is running FreeBSD-4.2-RELEASE with
vpopmail-4.9.6.  I know they're old, but it would be very difficult to
upgrade now due to the site's remoteness.

The machine was recently rebooted and vpopmail's POP now crashes upon
successful authentication (names changed for privacy, sorry):

  chris at PECTOPAH<104> telnet foo.example.net pop3
  Trying 217.161.116.36...
  Connected to foo.example.net.
  Escape character is '^]'.
  +OK <32620.1063584541 at foo.example.net>
  user chris at email.zz
  +OK 
  pass MyPass
  -ERR aack, child crashed
  Connection closed by foreign host.

If you enter a bogus passwd, it gives auth fail msg, so auth is
working: it only complains about child crash if I use the correct
password.  It's not doing anything fancy like MySQL, just
authenticating from the vpasswd.cdb file.

My system startup file is straight-forward:

  env - PATH="/var/qmail/bin:/usr/local/bin" \
  tcpserver 0 pop3 /var/qmail/bin/qmail-popup foo.example.net \
  /usr/local/vpopmail/bin/vchkpw /var/qmail/bin/qmail-pop3d Maildir &


If I execute the chain of commands from the command line, it works fine:

  foo# /var/qmail/bin/qmail-popup foo.example.net \
  /usr/local/vpopmail/bin/vchkpw /var/qmail/bin/qmail-pop3d Maildir
  +OK <32749.1063585173 at foo.example.net>
  user chris at email.zz
  +OK
  pass MyPass
  +OK
  list
  +OK
  1 776
  2 588
  3 588
  4 666
  .


/var/log/messages shows:

  Sep 15 04:27:58 foo /kernel: pid 32838 (vchkpw), uid 0: exited on signal 11 (core dumped)

It also shows less frequently:

  Sep 15 04:22:50 foo /kernel: pid 32791 (vdelivermail), uid 89: exited on signal 11 (core dumped)


Sure enough, the core file exists, in /usr/local/vpopmail/domains/email.zz:

  -rw-------   1 root      vchkpw  339968 Sep 15 03:17 vchkpw.core

At this point, I'm stuck, I don't know how to track down the problem.
I naively try:

  foo# gdb /usr/local/vpopmail/bin/vchkpw vchkpw.core
  GNU gdb 4.18
  Copyright 1998 Free Software Foundation, Inc.
  GDB is free software, covered by the GNU General Public License, and you are
  welcome to change it and/or distribute copies of it under certain conditions.
  Type "show copying" to see the conditions.
  There is absolutely no warranty for GDB.  Type "show warranty" for details.
  This GDB was configured as "i386-unknown-freebsd"...
  (no debugging symbols found)...
  Core was generated by `vchkpw'.
  Program terminated with signal 11, Segmentation fault.
  Reading symbols from /usr/lib/libcrypt.so.2...(no debugging symbols found)...
  done.
  Reading symbols from /usr/lib/libc.so.4...(no debugging symbols found)...done.
  Reading symbols from /usr/libexec/ld-elf.so.1...(no debugging symbols found)...
  done.
  #0  0x8049e96 in free ()
  (gdb) where
  #0  0x8049e96 in free ()
  #1  0xbfbffb40 in ?? ()
  #2  0x804ca6e in free ()
  #3  0x80497ff in free ()
  #4  0x80492c5 in free ()


Any suggestions as to what's wrong and how to fix it?  I didn't find
anything relevant doing a Google which fits my situation.

Thanks.