native mailx client on 11.x dumps core

[beaker%sdf.org@localhost (beaker)]

Does anyone know what's going on with the native mailx(1) client
on 11.x?  It is consistently dumping core on mail folder changes.

Below is my test setup:
#   $ uname -a
#   NetBSD lenovo 11.0_RC4 NetBSD 11.0_RC4 (GENERIC) #0: Mon May 18 17:09:16 UTC 2026...
#   $ mkdir mail
#   $ echo 'set folder=mail' > .mailrc
#   $ echo 'set record=+sent' >> .mailrc
#   $ echo 'this is a test.' |mailx -s 'test' beaker
#   $ mailx
#   Mail version 9.1alpha 2009-02-25.  Type ? for help.
#   "/var/mail/beaker": 1 message 1 new
#   >N  1 beaker@localhost  Thu Jun 11 13:09   3/448   "test"
#   & folders
#   sent
#   & fi +sent                         # change to ~/mail/sent
#   Saved 1 message in mbox
#   "+sent": 1 message 1 new
#   >N  1 beaker                   Thu Jun 11 13:09   3/74    "test"
#   & fi #                             # change back to /var/mail/beaker
#   "/home/beaker/mail/sent" complete
#   assertion "message_array.t_head == message" failed: file "/usr/src/usr.bin/mail/thread.c",\
#      line 497, function "thread_fix_new_links"
#   Abort (core dumped)

This isn't just a system folder issue; the same thing happens when
moving between folders under ~/mail/, i.e. +sent <-> +saved.

On 10.x this all works fine; surely something must have changed,
likely in that ../usr.bin/mail/thread.c file referenced in the dump
message.  I actually do use mailx pretty regularly so I'm wondering
if there's some user-level tweak to work-around this issue?

-b