bin/59635: mailx(1) regularly dumps core when changing mail folders

[jgw%sdf.org@localhost]

>Number:         59635
>Category:       bin
>Synopsis:       mailx(1) regularly dumps core when changing mail folders
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Sep 07 00:55:00 +0000 2025
>Originator:     Jeff
>Release:        11.0_Beta
>Organization:
N/A
>Environment:
NetBSD beastie 11.0_BETA NetBSD 11.0_BETA (GENERIC) #0: Fri Sep  5 09:21:53 UTC 2025  mkrepro%mkrepro.NetBSD.org@localhost:/usr/src/sys/arch/i386/compile/GENERIC i386
>Description:
The native mailx(1) MUA regularly dumps core when changing mail folders via the 'fi <folder_name>' command.  It's not 100% of the time but well over 50% of the time.  There is an older bug report correlating this with threading being active but it still occurs even with 'set hidethreads' and 'unset recursive-commands' in ~/,mailrc

Error message:
assertion "message_array.t_head == message" failed: file "/usr/src/usr.bin/mail/thread.c", line 497, function "thread_fix_new_links"
Abort (core dumped)
>How-To-Repeat:
Setup:
$ echo 'set folder=mail' > ~/.mailrc
$ echo 'set record=+sent' >> ~/.mailrc
$ mkdir ~/mail

Testing:
$ echo 'this is test' |mailx -s 'mailx test' jgw

$ mailx
Mail version 9.1alpha 2009-02-25.  Type ? for help.
"/var/mail/jgw": 1 message 1 new
>N  1 jgw@beastie.localdom  Sat Sep  6 18:23   3/464   "mailx test"

& folders
sent
& fi +sent
Held 1 message in /var/mail/jgw
"+sent": 1 message 1 new
>N  1 jgw                   Sat Sep  6 18:23   3/78    "mailx test"
& 1
Message 1:
From jgw Sat Sep  6 18:23:58 2025
To: jgw
Subject: mailx test

this is test.
& r
To: jgw@beastie.localdomain jgw@beastie.localdomain
Subject: Re: mailx test

~m
Interpolating: 1
(continue)

this is reply
.
EOT
& folders
sent
& fi +sent
"/var/mail/jgw" complete
assertion "message_array.t_head == message" failed: \
  file "/usr/src/usr.bin/mail/thread.c", line 497, function "thread_fix_new_links"
Abort (core dumped)

>Fix:
Sorry, this is beyond my skill set.