Howard has me experimenting with moving the lock from cache.c to delete.c. With this experiment in place, I'm getting a failure with test008/back-bdb. Under libumem, the crash is in bdb_search line 752.
I see that rs->sr_un.sru_search.r_entry = 0xbaddcafebaddcafe -- uninitialized per libumem -- is being used as an argument to is_entry_subentry().
Backtrace:
https://www.nbcs.rutgers.edu/~richton/test008-bt-200906181020.txt
-d -1:
https://www.nbcs.rutgers.edu/~richton/test008-slapdlog-200906181020.txt