The last arg for a readlink callback is supposed to be a struct stat *, which trace_readlink_cbk receives but fails to propagate when it unwinds the stack.  Patch fragment to fix this is:

-       STACK_UNWIND (frame, op_ret, op_errno, buf);
+       STACK_UNWIND_STRICT (readlink, frame, op_ret, op_errno, buf, stbuf);

I actually found this when I tripped over a similar SEGV in my own create code, and converted from STACK_UNWIND to STACK_UNWIND_STRICT throughout.  When I got an error in my readlink_cbk, I checked trace_readlink_cbk from which it had been derived.