I double checked our connchan.c and it is in deed the right file for 4.99.22. Line 694 is the "return success" in NsTclConnChanProc function on our system too.
I believe I have the right executable and core file for it
I found that I can do a 'bt full' with gdb and it gives you the variables as well. It looks like servPtr is set to a memory location that it does not own in the NsTclConnChanProc function.
It looks like gdb is not returning the exact line number of the NsTclConnChanProc function where the servPtr had the problem. But it does look like it has all of the other information correct
#10 0x00007fccc25143ca in Abort (signal=optimized out) at unix.c:1119
No locals.
#11 signal handler called
No locals.
#12 0x00007fccc24b825c in NsTclConnChanProc (UNUSED_sock=optimized out, arg=0x7fcbf581d460, why=1) at connchan.c:694
whenBuffer = "r\000\314\177\000"
servPtr = error reading variable servPtr (Cannot access memory at address 0x646e65732d203140)
cbPtr = 0x7fcbf581d460
success = true
#13 0x00007fccc24e279d in SockCallbackThread (UNUSED_arg=optimized out) at sockcallback.c:531
stop = optimized out
pollTimeout = optimized out
nfds = optimized out
now = {sec = 1632772110, usec = 116003}
diff = {sec = 0, usec = 0}
c = 0 '\000'
when = {32716, 2, 20}
events = {1, 4, 2}
n = optimized out
i = 0
isNew = 0
maxPollfds = 100
cbPtr = 0x7fcbf539f940
nextPtr = optimized out
hPtr = optimized out
search = {tablePtr = 0x7fccc2565640 activeCallbacks, nextIndex = 12, nextEntryPtr = 0x0}
pfds = 0x7fcc640012b0
#14 0x00007fccc2210fd4 in NsThreadMain (arg=optimized out) at thread.c:232
thrPtr = 0x7fcc94f231e0
#15 0x00007fccc221169f in ThreadMain (arg=optimized out) at pthread.c:870
--Type RET for more, q to quit, c to continue without paging--1
No locals.
#16 0x00007fccc1b72609 in start_thread (arg=optimized out) at pthread_create.c:477
ret = optimized out
pd = optimized out
unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140516112963328, 1098100496289630482, 140517183382942, 140517183382943, 140517183383088, 140516112961280, -1106243481039927022,
-1106548523360057070}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}
not_first_call = 0
#17 0x00007fccc238f293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
