Signal 11 dumps in telnetd (freebsd 10.3 release)

[Rustam]

I got a couple of dozen dumps in /usr/libexec/telnetd (signal 11), and I'm
wondering what those could be.

FreeBSD 10.3-RELEASE, built from source.

Dump stack trace:
  telrcv+333
  ttloop+7C
  doit+1687
  main+64D

Dump is at address 0x0000000000404713:

.text:0004046E2 loc_4046E2:
.text:0004046E2         test    byte ptr cs:diagnostic, 10h ; jumptable
0004046DB cases 11,12
.text:0004046E9         jz      short loc_4046F7
.text:0004046EB         mov     edi, offset fmt ; "td: recv IAC"
.text:0004046F0         mov     esi, ebx        ; option
.text:0004046F2         call    printoption
.text:0004046F7 loc_4046F7:
.text:0004046F7         call    ptyflush
.text:0004046FC         call    init_termbuf
.text:000404701         cmp     ebx, 0F7h
.text:000404707         mov     eax, 6199D8h
.text:00040470C         cmovz   rax, r14
.text:000404710         mov     rax, [rax]
.text:000404713         mov     al, [rax]      ; <========== Signal 11 HERE
.text:000404715         cmp     al, 0FFh
.text:000404717         jz      loc_40495A      ; jumptable 0004046DB
default case
.text:00040471D         mov     rcx, cs:pfrontp
.text:000404724         lea     rdx, [rcx+1]
.text:000404728         mov     cs:pfrontp, rdx
.text:00040472F         mov     [rcx], al
.text:000404731         mov     cs:telrcv_state, 0
.text:00040473B         jmp     loc_4049A0


Regards,

Rustam