I'm almost embarrassed to say that I submitted the wrong reproducer in my original bug report.
The previous key does trigger the fault, but it is needlessly complex. The attachment to this mail should be considered a saner example, as it still triggers the crash, but it is is significantly shorter. Steve --
rsa1 6