Crash with owhere (realloc)

I did "owhere Parchment" and got a crash:

#0  0x0083f88b in _int_free () from /lib/libc.so.6
#1  0x008415fe in _int_realloc () from /lib/libc.so.6
#2  0x00843605 in realloc () from /lib/libc.so.6
#3  0x0084395b in realloc_hook_ini () from /lib/libc.so.6
#4  0x0084354f in realloc () from /lib/libc.so.6
#5  0x080c6249 in write_to_buffer (d=0x9197120, txt=0x8216b60 " 33    61 A Rolled Up Parchm   821 Southeast Path     \n\r",
    length=56) at comm.c:2069
#6  0x080c0ee7 in color_send_to_desc (txt=0xbfbffc7c " 33    61 A Rolled Up Parchm   821 Southeast Path     \n\r",
    d=0x9197120) at color.c:1481
#7  0x080c0f51 in send_to_pager (txt=0xbfbffc7c " 33    61 A Rolled Up Parchm   821 Southeast Path     \n\r", ch=0x9198568)
    at color.c:1517
#8  0x081790e2 in do_owhere (ch=0x9198568, argument=0xbfc0291b "Parchment") at grub.c:104
#9  0x080f9d95 in interpret (ch=0x9198568, argument=0xbfc0291b "Parchment") at interp.c:594
#10 0x080cb1f5 in game_loop () at comm.c:1257
#11 0x080cce05 in main (argc=Cannot access memory at address 0x0
) at comm.c:606

Frame 5:

(gdb) f 5
#5  0x080c6249 in write_to_buffer (d=0x9197120, txt=0x8216b60 " 33    61 A Rolled Up Parchm   821 Southeast Path     \n\r",
    length=56) at comm.c:2069
2069            RECREATE( d->outbuf, char, d->outsize );
(gdb) p d
$1 = (DESCRIPTOR_DATA *) 0x9197120
(gdb) p d->outbuf
$2 = 0x9197d90 "    Vnum  Short Desc        Vnum  Room/Char          Vnum  Container\n\r  1    61 A Rolled Up Parchm   833 A Leopard          \n\r  2    61 A Rolled Up Parchm  2152 \033[1;36mUpon a bridge\033[0m\033[1;36m  \n\r  3 "...
(gdb) p d->outsize
$3 = 4000

I'm a bit lost here. Any ideas what could have caused this?

Uh, another crash which seems to be the same. Doing practice:

#0  0x007be402 in __kernel_vsyscall ()
#1  0x00804069 in raise () from /lib/libc.so.6
#2  0x00805671 in abort () from /lib/libc.so.6
#3  0x00838a4b in __libc_message () from /lib/libc.so.6
#4  0x0083fdd7 in _int_free () from /lib/libc.so.6
#5  0x008415fe in _int_realloc () from /lib/libc.so.6
#6  0x00843605 in realloc () from /lib/libc.so.6
#7  0x080c6249 in write_to_buffer (d=0x98a02f8,
    txt=0x98a6878 "0;33m]", '-' <repeats 34 times>, "\n\r\033[1;30m", ' ' <repeats 17 times>, "aid \033[1;34m[\033[1;36m  0\033[0;36m%\033[1;34m]\033[0;32m \033[1;30m", ' ' <repeats 13 times>, "bakudou \033[1;34m[\033[1;36m  0\033[0;36m%\033[1;34m]\033[0;32m \033[1;30m", ' ' <repeats 11 times>..., length=4139)
    at comm.c:2069
#8  0x080ca252 in flush_buffer (d=0x98ad758, fPrompt=1 '\001') at comm.c:1993
#9  0x080cb2d0 in game_loop () at comm.c:1300
#10 0x080cce05 in main (argc=Cannot access memory at address 0x36ce
) at comm.c:606

And another, doing mstat:

#0  0x007be402 in __kernel_vsyscall ()
#1  0x00804069 in raise () from /lib/libc.so.6
#2  0x00805671 in abort () from /lib/libc.so.6
#3  0x00838a4b in __libc_message () from /lib/libc.so.6
#4  0x0083fdd7 in _int_free () from /lib/libc.so.6
#5  0x008415fe in _int_realloc () from /lib/libc.so.6
#6  0x00843605 in realloc () from /lib/libc.so.6
#7  0x080c6249 in write_to_buffer (d=0x8d5b3a8,
    txt=0x8216b60 "\033[0;36mGlyphs: \033[0;37m0 0 0 0   \033[0;36mSubState: \033[0;37m0\n\r", length=59) at comm.c:2069
#8  0x080c0ee7 in color_send_to_desc (txt=0xbf8fbcc4 "&cGlyphs: &w0 0 0 0   &cSubState: &w0\n\r", d=0x8d5b3a8)
    at color.c:1481
#9  0x080c0f51 in send_to_pager (txt=0xbf8fbcc4 "&cGlyphs: &w0 0 0 0   &cSubState: &w0\n\r", ch=0x8d5c7f0) at color.c:1517
#10 0x080c0fe0 in pager_printf_color (ch=0x8d5c7f0, fmt=0x81bed5c "&cGlyphs: &w%d %d %d %d   &cSubState: &w%d\n\r")
    at color.c:1577
#11 0x08088eef in do_mstat (ch=0x8d5c7f0, argument=0xbf903e1a "buyo") at act_wiz.c:2199
#12 0x080f9d95 in interpret (ch=0x8d5c7f0, argument=0xbf903e1a "buyo") at interp.c:594
#13 0x080cb1f5 in game_loop () at comm.c:1257
#14 0x080cce05 in main (argc=Cannot access memory at address 0x3a53

These all appear to be RECREATE related... This is only happening on the dev port, and the only thing I've done is install that aquest snippet.