haproxy 1.6.4 segfault in logging (I think) (2 replies)

Attempting to upgrade from 1.5 to 1.6.4. Haproxy will run for a few
seconds to minutes and then will segfault.

dmesg
[9010697.311045] haproxy[31405]: segfault at b8 ip 00000000004131c7 sp
00007ffde49436c0 error 4 in haproxy[400000+ce000]
[9010699.783167] haproxy[31469]: segfault at b8 ip 00000000004131c7 sp
00007ffdc385ce60 error 4 in haproxy[400000+ce000]
[9010748.623894] haproxy[31696]: segfault at b8 ip 00000000004131c7 sp
00007fffd91e3b90 error 4 in haproxy[400000+ce000]
[9010759.271240] haproxy[31864]: segfault at b8 ip 00000000004131c7 sp
00007ffe8fc7ad30 error 4 in haproxy[400000+ce000]

addr2line -e /usr/bin/haproxy 00000000004131c7
/home/dtorgo/haproxy-1.6.4/src/log.c:1526
1525 case LOG_FMT_STATUS: // %ST
1526 ret = ltoa_o(txn->status, tmplog,
dst + maxsize - tmplog);
1527 if (ret == NULL)
1528 goto out;
1529 tmplog = ret;
1530 last_isspace = 0;
1531 break;

Haproxy config (relevant parts)
global
log rsyslog1:514 local2 debug info
log rsyslog1:514 local3 notice emerg
log-send-hostname
defaults
mode http
retries 3
option redispatch
maxconn 65000
timeout connect 5000
timeout client 300000
timeout server 300000
option allbackups
option dontlognull
option log-health-checks
option forceclose
log-format
±{"flw":"%ID","lb":"%H","cip":"%ci","lbnfo":"%f/%b/%si","tm":"%Tq/%Tw/%Tc/%Tr","tt":%Tt,"stts":"%ST","bytc":%U,"byts":%B,"trmstt":"%ts","cn":"%ac/%fc/%bc/%sc","rtry":%rc,"q":"%bq/%sq","rqst":"%r","hdrs":"%hr"}
frontend splat.lucidchart.com_https
mode http
log global
bind :27001 accept-proxy
capture request header Host len 120
capture request header Origin len 120
capture request header X-Forwarded-For len 32
capture request header Referer len 120
capture request header Host len 16
http-response set-header Requested_Host %[capture.req.hdr(0)]
http-response set-header Requested_Origin %[capture.req.hdr(1)]
http-response set-header X-Original-Request %r
http-request set-header X-Lucid-Flow-Id
%ci|%[capture.req.hdr(4)]|%ms%sc if !{ hdr(X-Lucid-Flow-Id) -m found }
unique-id-format %[hdr(X-Lucid-Flow-Id)]

../haproxy -vv
HA-Proxy version 1.6.4 2016/03/13
Copyright 2000-2016 Willy Tarreau <willy@haproxy.org>

Build options :
TARGET = linux2628
CPU = native
CC = gcc
CFLAGS = -O2 -march=native -g -fno-strict-aliasing
-Wdeclaration-after-statement
OPTIONS = USE_OPENSSL=1 USE_PCRE=1

Default settings :
maxconn = 2000, bufsize = 16384, maxrewrite = 1024, maxpollevents = 200

Encrypted password support via crypt(3): yes
Built without compression support (neither USE_ZLIB nor USE_SLZ are set)
Compression algorithms supported : identity("identity")
Built with OpenSSL version : OpenSSL 1.0.1f 6 Jan 2014
Running on OpenSSL version : OpenSSL 1.0.2d 9 Jul 2015 (VERSIONS DIFFER!)
OpenSSL library supports TLS extensions : yes
OpenSSL library supports SNI : yes
OpenSSL library supports prefer-server-ciphers : yes
Built with PCRE version : 8.38 2015-11-23
PCRE library supports JIT : no (USE_PCRE_JIT not set)
Built without Lua support
Built with transparent proxy support using: IP_TRANSPARENT
IPV6_TRANSPARENT IP_FREEBIND

Available polling systems :
epoll : pref=300, test result OK
poll : pref=200, test result OK
select : pref=150, test result OK
Total: 3 (3 usable), will use epoll.