Undefined behavior.

[nekonomicon]

On autoload when player is dead(fixed in 932d269):

==10158== Invalid read of size 4
==10158==    at 0x1823B2E2: CWorld::Precache() (world.cpp:631)
==10158==    by 0x18195AE5: DispatchRestore(edict_s*, saverestore_s*, int) (cbase.cpp:379)
==10158==    by 0xEDB9B5B: SV_LoadGameState (sv_save.c:1636)
==10158==    by 0xEF0EEB2: SV_LevelInit (sv_init.c:440)
==10158==    by 0xEF137A2: SV_NewGame (sv_init.c:775)
==10158==    by 0xE6FD402: Host_NewGame (host.c:125)
==10158==    by 0xEDC1B00: SV_LoadGame (sv_save.c:2180)
==10158==    by 0xEF666F8: SV_Load_f (sv_cmds.c:399)
==10158==    by 0xE6775F7: Cmd_ExecuteString (cmd.c:965)
==10158==    by 0xE67633C: Cbuf_Execute (cmd.c:217)
==10158==    by 0xE74F079: Host_InputFrame (input.c:801)
==10158==    by 0xE701470: Host_Frame (host.c:611)
==10158==  Address 0xbfbfc1b7 is not stack'd, malloc'd or (recently) free'd
==10158==
==10158== Invalid read of size 4
==10158==    at 0x709AF41: ??? (in /usr/lib32/libthr.so.3)
==10158==    by 0x709A2EA: ??? (in /usr/lib32/libthr.so.3)
==10158==    by 0x38073939: ??? (in /usr/local/lib/valgrind/memcheck-x86-freebsd)
==10158==    by 0x18195AE5: DispatchRestore(edict_s*, saverestore_s*, int) (cbase.cpp:379)
==10158==    by 0xEDB9B5B: SV_LoadGameState (sv_save.c:1636)
==10158==    by 0xEF0EEB2: SV_LevelInit (sv_init.c:440)
==10158==    by 0xEF137A2: SV_NewGame (sv_init.c:775)
==10158==    by 0xE6FD402: Host_NewGame (host.c:125)
==10158==    by 0xEDC1B00: SV_LoadGame (sv_save.c:2180)
==10158==    by 0xEF666F8: SV_Load_f (sv_cmds.c:399)
==10158==    by 0xE6775F7: Cmd_ExecuteString (cmd.c:965)
==10158==    by 0xE67633C: Cbuf_Execute (cmd.c:217)
==10158==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
==10158==
==10158==
==10158== Process terminating with default action of signal 11 (SIGSEGV): dumping core

Singleplayer on amd64:

==11931== Source and destination overlap in memcpy(0x14ab3b38, 0x14ab3b38, 48)
==11931==    at 0x4C280AC: memcpy (in /usr/local/lib/valgrind/vgpreload_memcheck-amd64-freebsd.so)
==11931==    by 0x12C096CD: CStudioModelRenderer::StudioDrawModel(int) (StudioModelRenderer.cpp:1163)
==11931==    by 0x12BF0400: R_StudioDrawModel(int) (GameStudioModelRenderer.cpp:73)
==11931==    by 0x6463845: R_DrawStudioModelInternal (gl_studio.c:3271)
==11931==    by 0x6464586: R_DrawStudioModel (gl_studio.c:3302)
==11931==    by 0x648DC9B: R_DrawEntitiesOnList (gl_rmain.c:1113)
==11931==    by 0x648E022: R_RenderScene (gl_rmain.c:1218)
==11931==    by 0x648F0B4: R_RenderFrame (gl_rmain.c:1330)
==11931==    by 0x6481780: V_CalcRefDef (cl_view.c:307)
==11931==    by 0x6481893: V_RenderView (cl_view.c:340)
==11931==    by 0x6482AFF: SCR_UpdateScreen (cl_scrn.c:476)
==11931==    by 0x64D95AB: Host_ClientFrame (cl_main.c:1808)
==11931==

==11931== Invalid read of size 4
==11931==    at 0x13FAB148: CGraph::FindNearestNode(Vector const&, int) (nodes.cpp:934)
==11931==    by 0x13F9B790: CBaseMonster::FGetNodeRoute(Vector) (monsters.cpp:2770)
==11931==    by 0x13F9B712: CBaseMonster::BuildRoute(Vector const&, int, CBaseEntity*) (monsters.cpp:1582)
==11931==    by 0x13F9D9F8: CBaseMonster::Move(float) (monsters.cpp:1913)
==11931==    by 0x64F8A26: SV_RunThink (sv_phys.c:205)
==11931==    by 0x64FD797: SV_Physics_Step (sv_phys.c:1655)
==11931==    by 0x64FDC74: SV_Physics_Entity (sv_phys.c:1712)
==11931==    by 0x64FD897: SV_Physics (sv_phys.c:1765)
==11931==    by 0x64EE92B: SV_RunGameFrame (sv_main.c:589)
==11931==    by 0x64EE9B4: Host_ServerFrame (sv_main.c:630)
==11931==    by 0x6599B79: Host_Frame (host.c:615)
==11931==    by 0x659B262: Host_Main (host.c:1121)
==11931==  Address 0x10 is not stack'd, malloc'd or (recently) free'd
==11931==
==11931== Syscall param sigprocmask(set) points to uninitialised byte(s)
==11931==    at 0x52043FA: _sigprocmask (in /lib/libc.so.7)
==11931==    by 0x5B0ADB4: ??? (in /lib/libthr.so.3)
==11931==    by 0x5B0A3AE: ??? (in /lib/libthr.so.3)
==11931==    by 0x38074467: ??? (in /usr/local/lib/valgrind/memcheck-amd64-freebsd)
==11931==    by 0x13F9B790: CBaseMonster::FGetNodeRoute(Vector) (monsters.cpp:2770)
==11931==    by 0x13F9B712: CBaseMonster::BuildRoute(Vector const&, int, CBaseEntity*) (monsters.cpp:1582)
==11931==    by 0x13F9D9F8: CBaseMonster::Move(float) (monsters.cpp:1913)
==11931==    by 0x64F8A26: SV_RunThink (sv_phys.c:205)
==11931==    by 0x64FD797: SV_Physics_Step (sv_phys.c:1655)
==11931==    by 0x64FDC74: SV_Physics_Entity (sv_phys.c:1712)
==11931==    by 0x64FD897: SV_Physics (sv_phys.c:1765)
==11931==    by 0x64EE92B: SV_RunGameFrame (sv_main.c:589)
==11931==  Address 0x7fefff2fc is on thread 1's stack
==11931==  Uninitialised value was created by a stack allocation
==11931==    at 0x644D87C: ??? (in /usr/local/lib/xash3d/libxash.so)
==11931==
Sys_Crash: signal 11, err 0 with code 1 at 0x10

[nekonomicon]

Fixed with latest commits.