These are maybe similar to the less-interesting issue of namerefs pointing to array subscripts, but are triggered by relatively normal assignments: ------------------------------
This one is really strange: declare -n re=xxdeclare re[4]=78901234567890123456789012echo ${!re*} Segmentation fault: 11 The assignment expression can use different subscripts/values, but the total length has to be at least 32 bytes to trigger the segfault. The last command can also be unset xx, unset re, or anything that uses the full variable list like export, readonly : ${!foo*}, etc ------------------------------ Assignments longer than 16 bytes just don’t work: declare -n re=xxdeclare re[4]=7890123456declare -p xx declare -a xx=() ------------------------------ Some random memory(?) is assigned to a variable in this pathological case: declare -n re=xx[0]declare re[45678901234]=declare -p xx declare -a xx=([0]=$'\260\213@\342\365\177')