The problem is that back-relay presents slapo-rwm(3) an entry with both REP_ENTRY_MODIFIABLE and REP_ENTRY_MUSTRELEASE flags set. As a consequence, the entry is released (namely, freed) before it is returned by the frontend. As far as I understand, the two flags should be mutually exclusive. As soon as one entry is marked as REP_ENTRY_MODIFIABLE, it is supposed to be a copy of an entry that may need to be released, or an entry created from scratch and thus not stored anywhere. I have a quick fix to your problem, that consists in ignoring REP_ENTRY_MUSTRELEASE when REP_ENTRY_MODIFIABLE is also set. However, a better fix would consist in tracking where the issue occurs. Unless I track it, I'll commit the quick fix.
p.