When running with debug_enable, the non-release assert in HttpSM::handle_server_setup_error sometimes goes off.
ink_assert(server_entry->read_vio == data);
In the crash case, the data corresponds to server_entry->write_vio. Reviewing the function, I don't see why it is bad that this function is called with the write vio. The actual IO operations are performed against server_entry->read_vio and server_entry->write_io instead of the parameter vio directly.