easy to reproduce:
Using separate remap processor is a hidden option, and I enable it by accident.. (Does anyone use it in prod?)
I noticed HttpSM::do_http_server_open is always executed by the remap processer ethread (because of action.continuation->handleEvent(EVENT_REMAP_COMPLETE, NULL), correct me if wrong). While the remap thread was not initialized as ET_NET and has no l1_hash, server session lookup in this ET_REMAP thread will crash.
I didn't find a quick way to make HttpSM handling EVENT_REMAP_COMPLETE on ET_NET. So a fast workaround would be falling back to global server connection when use_remap_processor.