Maybe this helps in tracing the bug:
(gdb) up 10
#10 0x0892a025 in fs_read_list_info (fpe=0x8bcf350, blockrec=0x8d65198)
at fserve.c:2376
2376 in fserve.c
(gdb) p *pi
$1 = {num_offsets = 4, data_len = 134654824}
so it seems pi->data_len is fairly huge, maybe it is not initialized
earlier?
---david