Comment # 5 on bug 928749 from Bernhard Voelker

Sure, nice riddle for the weekend.
Quick search: crash in (downstream-patched) sort.c:4619:
  free (buf.buf);