Segfault in lcb2.3 in connmgr invoke_request()

Customer running lcb2.3 (on top of Python SDK) and reported:

<quote>
TimeoutError: <Key=u'DEV_509075a7b22c93664cc9d853ca7f7a722100c3e1', RC=0x17[Client-Side timeout exceeded for operation. Inspect network conditions or increase the timeout], Operational Error, Results=1, C Source=(src/multiresult.c,148)>

And then it crashed with core dumps.
</quote>

I dug into this a little bit, and I see essentially the same backtrace on both core files:

(gdb) bt 5
#0 invoke_request (req=0x7ffaa84792c0) at src/connmgr.c:126
#1 0x00007ffb2993de0f in connection_available (he=0x7ffab402c700) at src/connmgr.c:163
#2 0x00007ffb2994cb5b in timer_callback (sock=<value optimized out>, which=<value optimized out>, arg=0x7ffab4008d40) at src/timer.c:45
#3 0x00007ffb26b81b44 in ?? ()
#4 0x00007ffb26d940e0 in ?? ()

The `conn` field looks garbage:

(gdb) p *req
$9 = {llnode =

{next = 0x0, prev = 0x0}

, callback = 0x7ffb29949bb0 <socket_connected>, key = "inbox-31:11210", '\000' <repeats 1035 times>, he = 0x7ffab402c700, timer = 0x7ffaa8c13530, state = 1, conn = 0x18, err = LCB_SUCCESS, data = 0x7ffaa872fd80}

Digging further, this came from the he->idle list with is supposedly empty, but has size ==1 :

(gdb) p he->ll_idle
$11 =

{next = 0x7ffab402c700, prev = 0x7ffab402c700, size = 1}