I see the same crashes on FreeBSD. Turning off ACL makes the crashes disappear.

I'm getting a different backtrace though and it doesn't seem to be related to ACL:

Core was generated by `imap-login'. Program terminated with signal 11, Segmentation fault. Reading symbols from /usr/lib/dovecot/libdovecot-login.so.0...done. Loaded symbols for /usr/lib/dovecot/libdovecot-login.so.0 Reading symbols from /usr/lib/dovecot/libdovecot.so.0...done. Loaded symbols for /usr/lib/dovecot/libdovecot.so.0 Reading symbols from /lib/libc.so.7...done. Loaded symbols for /lib/libc.so.7 Reading symbols from /usr/local/lib/libssl.so.8...done. Loaded symbols for /usr/local/lib/libssl.so.8 Reading symbols from /usr/local/lib/libcrypto.so.8...done. Loaded symbols for /usr/local/lib/libcrypto.so.8 Reading symbols from /usr/lib/librt.so.1...done. Loaded symbols for /usr/lib/librt.so.1 Reading symbols from /lib/libthr.so.3...done. Loaded symbols for /lib/libthr.so.3 Reading symbols from /usr/lib/libz.so...done. Loaded symbols for /usr/lib/libz.so Reading symbols from /libexec/ld-elf.so.1...done. Loaded symbols for /libexec/ld-elf.so.1 #0 0x00000000104b99a6 in hash_table_destroy (_table=0x28) at _ctype.h:143 143 return (_c < 0 || _c >= __mb_sb_limit) ? _c : [New Thread 10e041c0 (LWP 103332/initial thread)] (gdb) bt full #0 0x00000000104b99a6 in hash_table_destroy (_table=0x28) at _ctype.h:143 table = (struct hash_table *) 0x10e29700 #1 0x0000000010478cf1 in settings_parser_deinit (_ctx=0x10e29778) at array.h:197 ctx = (struct setting_parser_context *) 0x0 #2 0x00000000104ac4ea in master_service_settings_cache_deinit (_cache=0x1045da08) at master-service-settings-cache.c:81 cache = (struct master_service_settings_cache *) 0x10e2e040 entry = (struct settings_entry *) 0x10e29740 next = (struct settings_entry *) 0x0 __FUNCTION__ = "master_service_settings_cache_deinit" #3 0x000000001044d1df in login_settings_deinit () at login-settings.c:129 No locals. #4 0x000000001044dd7e in main_deinit () at main.c:62 No locals. #5 0x000000001044df5c in login_binary_run (binary=0x4051c0, argc=2, argv=0x7fffffffebd8) at main.c:62 service_flags = 72 set_pool = 0x10e2d020 allow_core_dumps = true login_socket = 0x10457491 "login" c = -1 #6 0x00000000004036ee in main (argc=2, argv=0x7fffffffebd8) at client.c:40 No locals.

Cheers,

Olivier