Sander, first, thank you very much for your configuration, I could reproduce the issue here. It's not 100% reproducible due to address randomization, but common enough to get the issue.
The issue comes from the use of user-lists which are implied by stats auth. User lists are resolved during parsing. They start with a string holding the name of the user list, and are later resolved to point to the userlist itself. The issue is that during exit, we try to free everything before leaving (well, it's mostly to save valgrind from shouting at those who use it). And when ACL params are freed, the userlist names are freed too. But when the pointer has already been resolved, it points to a userlist and not its name, and this list has already been resolved. I've tried doing an ugly hack to confirm I can work on a solution. Right now I don't want to release it, it's too hackish. I prefer that you keep seeing the glibc's error message for now on, until I get a real and solid fix. I will recontact you as soon as I have something clean. Thank you again for the report and for providing the useful configuration. Willy
