Hard to reproduce - I hit this only due to a buggy patch I was working on but seems legit:
During shutdown qdr_core_free() cleans up any outstanding endpoint clients. This results in any outstanding core client RPC calls to be cancelled by invoking the "free request" logic which invokes the "request done" client handler with the error parameter set to "link detach".
In the case of the edge router client address lookup module, the error is ignored and the client assumes the request was successful. At this point it attempts to process the request which results in a segfault.
We need to audit all the core client "request done" callbacks to make sure the error flag is being checked and properly handled.
See backtrace in attachment