So I did end up finding a reliable reproducer (but quite large: with a specific binary and a specific .py file loaded, `run`, wait about 3 seconds `cr list` (which is a command from the .py), `cr list`, `call (void)cr_gdb_nop_intr()`, `stepi`; I have no idea what it is about that sequence that triggers it).
My #GDB had been compiled with `--enable-source-highlight`; changing that to `--disable-source-highlight` makes the crash go away. But nothing in the stacktrace looked related to that. #gnu