sftp seg faulting

Hi,

In recent builds of 9-CURRENT on amd64 platform I am getting seg
faults that seem related to glob - same vintage works on x86.

Attempting ls of remote directory:

(gdb) run
Starting program: /usr/bin/sftp white
Connecting to white...
Password:
sftp> ls

Program received signal SIGSEGV, Segmentation fault.
0x0000000000000000 in ?? ()
(gdb) bt
#0  0x0000000000000000 in ?? ()
#1  0x0000000800f0f750 in glob2 (pathbuf=0x7fffffff5900,
pathend=0x7fffffff5950,
    pathend_last=0x7fffffff78f8, pattern=Variable "pattern" is not available.
) at /usr/src/lib/libc/gen/glob.c:844
#2  0x0000000800f0fdb2 in glob0 (pattern=0x7fffffffb9c0, pglob=0x7fffffffdb60,
    limit=0x7fffffffd9c0) at /usr/src/lib/libc/gen/glob.c:533
#3  0x0000000800f100e7 in globexp1 (pattern=0x7fffffffb9c0,
pglob=0x7fffffffdb60,
    limit=0x7fffffffd9c0) at /usr/src/lib/libc/gen/glob.c:253
#4  0x0000000800f1049c in glob (pattern=0x801a6804a "", flags=Variable
"flags" is not available.
)
    at /usr/src/lib/libc/gen/glob.c:229
#5  0x00000000004037b2 in do_globbed_ls (conn=0x801a25740,
    path=0x801a68040 "/home/dave", strip_path=0x801a68040 "/home/dave", lflag=8)
    at /usr/src/secure/usr.bin/sftp/../../../crypto/openssh/sftp.c:752
#6  0x0000000000405673 in parse_dispatch_command (conn=0x801a25740,
    cmd=0x7fffffffe1a0 "ls", pwd=0x7fffffffe190, err_abort=0)
    at /usr/src/secure/usr.bin/sftp/../../../crypto/openssh/sftp.c:1328
#7  0x0000000000405b33 in interactive_loop (fd_in=Variable "fd_in" is
not available.
)
    at /usr/src/secure/usr.bin/sftp/../../../crypto/openssh/sftp.c:1594
#8  0x0000000000406111 in main (argc=27279464, argv=0x801a04068)
    at /usr/src/secure/usr.bin/sftp/../../../crypto/openssh/sftp.c:1825
(gdb) frame 1
#1  0x0000000800f0f750 in glob2 (pathbuf=0x7fffffff5900,
pathend=0x7fffffff5950,
    pathend_last=0x7fffffff78f8, pattern=Variable "pattern" is not available.
) at /usr/src/lib/libc/gen/glob.c:844
844                     return((*pglob->gl_lstat)(buf, sb));
(gdb) print pglob
$1 = (glob_t *) 0x7fffffffdb60
(gdb) print *pglob
$2 = {gl_pathc = 0, gl_matchc = 0, gl_offs = 0, gl_flags = 216, gl_pathv = 0x0,
  gl_errfunc = 0, gl_closedir = 0x409180 <fudge_opendir>,
  gl_readdir = 0x4090d0 <fudge_lstat>, gl_opendir = 0x4090a0
<fudge_stat>, gl_lstat = 0,
  gl_stat = 0x7fffffffdca0}
(gdb)


Attempting to put file:

(gdb) run
Starting program: /usr/bin/sftp white
Connecting to white...
Password:
sftp> put testfile

Program received signal SIGSEGV, Segmentation fault.
0x000000000040347c in process_put (conn=0x801a25740, src=0x801a69060
"testfile", dst=Variable "dst" is not available.
)
    at /usr/src/secure/usr.bin/sftp/../../../crypto/openssh/sftp.c:590
590             for (i = 0; g.gl_pathv[i] && !interrupted; i++) {
(gdb) list
585                         tmp_dst);
586                     err = -1;
587                     goto out;
588             }
589
590             for (i = 0; g.gl_pathv[i] && !interrupted; i++) {
591                     if (stat(g.gl_pathv[i], &sb) == -1) {
592                             err = -1;
593                             error("stat %s: %s", g.gl_pathv[i],
strerror(errno));
594                             continue;
(gdb) bt
#0  0x000000000040347c in process_put (conn=0x801a25740,
src=0x801a69060 "testfile", dst=Variable "dst" is not available.

) at /usr/src/secure/usr.bin/sftp/../../../crypto/openssh/sftp.c:590
#1  0x0000000000404c7d in parse_dispatch_command (conn=0x801a25740,
    cmd=0x7fffffffe1a0 "put testfile", pwd=0x7fffffffe190, err_abort=0)
    at /usr/src/secure/usr.bin/sftp/../../../crypto/openssh/sftp.c:1267
#2  0x0000000000405b33 in interactive_loop (fd_in=Variable "fd_in" is
not available.
)
    at /usr/src/secure/usr.bin/sftp/../../../crypto/openssh/sftp.c:1594
#3  0x0000000000406111 in main (argc=27279464, argv=0x801a04068)
    at /usr/src/secure/usr.bin/sftp/../../../crypto/openssh/sftp.c:1825
(gdb) print g
$1 = {gl_pathc = 1, gl_matchc = 0, gl_offs = 1, gl_flags = 0, gl_pathv = 0x0,
  gl_errfunc = 0x10, gl_closedir = 0x801a69070, gl_readdir = 0, gl_opendir = 0,
  gl_lstat = 0, gl_stat = 0}
(gdb)

I'm either unlucky in tracing through glob or haven't been persistent
enough - anyone have any idea what might be going on?

thanks,
dave c