segfault in proton transport.c:1374 when using link routing

Using standalone reproducer script from https://bugzilla.redhat.com/show_bug.cgi?id=1358948 (just the python script but against Satellite's qdrouterd - unable to repro on standalone qdrouterd+qpidd so far), I get routerd segfault due to proton sigsegv with backtrace:

#0 0x00007f1318281058 in pn_do_flow (transport=0x7f1304011b80, frame_type=<optimized out>, channel=<optimized out>, args=<optimized out>, payload=<optimized out>)
at /usr/src/debug/qpid-proton-0.9/proton-c/src/transport/transport.c:1374
#1 0x00007f131827bf7b in pni_dispatch_action (payload=0x7ffff55c5bd0, args=0x7f1304011d70, channel=<optimized out>, frame_type=0 '\000', lcode=<optimized out>, transport=0x7f1304011b80)
at /usr/src/debug/qpid-proton-0.9/proton-c/src/dispatcher/dispatcher.c:74
#2 pni_dispatch_frame (args=0x7f1304011d70, transport=0x7f1304011b80, frame=...) at /usr/src/debug/qpid-proton-0.9/proton-c/src/dispatcher/dispatcher.c:116
#3 pn_dispatcher_input (transport=transport@entry=0x7f1304011b80, bytes=0x7f1304028710 "", available=0, batch=batch@entry=true, halt=halt@entry=0x7f1304011d02)
at /usr/src/debug/qpid-proton-0.9/proton-c/src/dispatcher/dispatcher.c:135
#4 0x00007f1318283f7c in pn_input_read_amqp (transport=0x7f1304011b80, layer=<optimized out>, bytes=<optimized out>, available=<optimized out>)
at /usr/src/debug/qpid-proton-0.9/proton-c/src/transport/transport.c:1672
#5 0x00007f13182919f1 in process_input_ssl (transport=0x7f1304011b80, layer=0,
input_data=0x7f1304018d44 "\372\206\332A\n\316\300\206:(b\033\334\320K!\271Tu\226ͼ<<\250\220D\214\370\344t\251:\235\314rz\310\303k\250~\324\342;\336\265\214\271\b\220o%f5V\245\243\273-\360:\314\352\345Z\"\346c\266\216\377p7\345\265Y\201\337\342\375\226l\212\a1\342Nɢ\364\243>\322cv/\256\324>\366\036\212a\341\204\023/\b\222\341\376\070G\203\022?8\366(\006\366\342\345\202\315\304M\021\376;\213|\347w\b\242\n9^\250\062nj\225ݹ\244\\b/\021L\006\t\341\004\v\023\vSomeOrgUnit1301\006\003U\004\003\023*pmoravec-sat61-rh"..., available=0)
at /usr/src/debug/qpid-proton-0.9/proton-c/src/ssl/openssl.c:934
#6 0x00007f131828403a in transport_consume (transport=transport@entry=0x7f1304011b80) at /usr/src/debug/qpid-proton-0.9/proton-c/src/transport/transport.c:1604
#7 0x00007f1318285452 in pn_transport_process (transport=0x7f1304011b80, size=<optimized out>) at /usr/src/debug/qpid-proton-0.9/proton-c/src/transport/transport.c:2690
#8 0x00007f13184c7d73 in qdpn_connector_process () from /lib64/libqpid-dispatch.so.0
#9 0x00007f13184d1b4c in thread_run () from /lib64/libqpid-dispatch.so.0
#10 0x00007f13184d27b0 in qd_server_run () from /lib64/libqpid-dispatch.so.0
#11 0x0000000000401cd8 in main_process ()
#12 0x0000000000401950 in main ()

cause:

(gdb) list
1369 if (err) return err;
1370
1371 pn_session_t *ssn = pn_channel_state(transport, channel);
1372
1373 if (inext_init)

{ 1374 ssn->state.remote_incoming_window = inext + iwin - ssn->state.outgoing_transfer_count; 1375 }

else

{ 1376 ssn->state.remote_incoming_window = iwin; 1377 }

1378
(gdb) p ssn
$1 = (pn_session_t *) 0x0
(gdb)

Core attached