but I'm still not sure why it would happen and I can't reproduce it. Hm.

You didn't happen to get a core dump? No, sorry. And I would not like to provoke the panic again.

I'd really like to know what "p *file" and "p *file.buffer" says in gdb. Sorry.

Any details of our installation that might help? Maildirs on NFS, indexes local. mail_nfs_storage = yes

Further digging the logs reveals that for both panics, I have earlier errors:

Sep 7 10:06:12 xxx dovecot: IMAP(aaa): Broken file /import/mail/aaa/.yyyyyy/dovecot-uidlist line 6071: UIDs not ordered (6146 >= 6146) Sep 7 10:10:12 xxx dovecot: IMAP(aaa): Panic: file mail-transaction-log-append.c: line 88 (log_buffer_move_to_memory): assertion failed: (file->buffer_offset + file->buffer->used == file->sync_offset)

Sep 7 10:08:19 xxx dovecot: IMAP(bbb): Corrupted transaction log file (in-memory index).log seq 4: Transaction log corrupted unexpectedly at 8200: Invalid size 0 (type=1) (sync_offset=10344) Sep 7 10:08:19 xxx dovecot: IMAP(bbb): fscking index file (in-memory index) Sep 7 10:15:33 xxx dovecot: IMAP(bbb): Panic: file mail-transaction-log-append.c: line 88 (log_buffer_move_to_memory): assertion failed: (file->buffer_offset + file->buffer->used == file->sync_offset )

Does this help? I can send uncensored logs if needed.