It appears that rpm is giving out corrupted/broken headers from queries, causing
later operations on said headers to crash.  I have the following backtrace:

#0  0x0000002a95970a42 in indexCmp (avp=0x7fbfffefd0, bvp=0x480) at header.c:263
#1  0x000000359182fe6c in bsearch () from /lib64/tls/libc.so.6
#2  0x0000002a95971535 in findEntry (h=0x2023010, tag=1003, type=0) at header.c:916
#3  0x0000002a959721d6 in intGetEntry (h=0x2023010, tag=1152, type=0x7fbffff0ac,
p=0x7fbffff098,
    c=0x7fbffff0a8, minMem=0) at header.c:1684

The header was obtained with:

mi = rpmtsInitIterator (rpmts, RPMDBI_LABEL, "blah", 0);
while ((header = rpmman->rpmdbNextIterator (mi))) {
    /* do stuff with header */
}

It's difficult to reproduce this, and I have not seen this behavior in the rpm
command line tool.  I'm still looking into it, however, and expect to have more
information soon.