I couldn't reproduce just to add some safety checks. Maybe the coredump was from another process, because the msg pointer changes its value without being touched in the first frames.
If you can reproduce it, enable core file per process, reopen this and add the backtraces from all core files.