Running the following command (don't ask ;) makes troff reproducibly segfault: zcat -f /usr/share/man/man4/ptmx.4.gz | nroff --legacy ISO-8859-1 This is groff-1.18.1.1-3 on FC3. Backtrace attached.
Created attachment 107918 [details] gdb backtrace
Manpage ptmx.4 includes man4/pts.4 therefore the command has to be run in /usr/share/man directory. Otherwise groff will not find the file and abort.
Aborting or erroring out is ok, crashing is not. But anyway, it no longer crashes in FC-4 and Rawhide so I don't care that much (nor can I any more test with FC-3).
Oops, it seems to crash in FC-4 (1.18.1.1-5) and Rawhide (1.18.1.1-7) still after all -> reopening. A graceful exit with an error message would be much more acceptable than a silent core dump.
Ok, there was a problem with assertion failure. Fixed in rawhide.