thomas,
i looked at next_gw and it allocated memory for uri before called
do_action to append the branch and then it free the memory. so i didn't
see anything obvious tha could cause your core dump.
can you start ser something like
ser -u root -g root -w /tmp
so that it produces a core dump. then run
gdb /usr/sbin/ser /tmp/core
and give it "where" command and send me the result.
-- juha