This is a weird one: sbbsecho ran right as I was saving msgs.cnf via
SCFG and it seems like it loaded 0-byte msgs.cnf into memory and this
segfault was a result of trying to print sub[INVALID_SUB]->code.

The use of [f]nopen() with proper share perms should have prevented this
(truncated msgs.cnf read) from happening, so there's something else afoot here.