[Dovecot] Next message unexpectedly lost

Using 1.1.2. I'm getting the above message over and over in the error log. Dovecot drops the connection and the client (Tbird) just keeps retrying in an endless loop.

Using Wireshark to sniff the exchange, it looks like the command that fails looks like this:

5 UID fetch 1:9749,9751:9763,9765:9930,9932,9934:9942 (UID RFC822.SIZE FLAGS BODY.PEEK[HEADER.FIELDS (From To Cc Subject Date Message-ID Priority X-Priority References Newsgroups In-Reply-To Content-Type)])

Dovecot seems to be shutting down after receiving this.

Mulberry doesn't seem to have the problem, presumably because it's sending a different command sequence that doesn't stroke this.

Here's the failing code, in i_stream_raw_mbox_read :

    if (stream->istream.v_offset -
        rstream->hdr_offset + new_pos > rstream->mail_size) {
            /* istream_raw_mbox_set_next_offset() used invalid
               cached next_offset? */
            i_error("Next message unexpectedly lost from %"PRIuUOFF_T,
                    rstream->hdr_offset + rstream->mail_size);
            rstream->eof = TRUE;
            rstream->corrupted = TRUE;
            return -1;
    }

I've tried deleting the associated .imap/folder contents but it must regenerate the same bad data as it happens again.