I can reproduce a crash in dbus-daemon when terminating a master process, that communicates with the session bus, which has several child processes that also communicate with the same bus.

I am running dbus-1.1.2-9.fc8 (standard install of dbus on Fedora 8).

Let me know if there is anything else you need to debug this problem.

[developer@cobra ~]$ gdb -p 3023
....
Program received signal SIGPIPE, Broken pipe.
[Switching to Thread 140547178473344 (LWP 3023)]
0x0000000000e6e923 in __libc_writev (fd=33, vector=0x7fffb8ac69e0,
count=2) at ../sysdeps/unix/sysv/linux/writev.c:46
46        bytes_written = INLINE_SYSCALL (writev, 3, fd, CHECK_N
(vector, count), count);
(gdb) bt
#0  0x0000000000e6e923 in __libc_writev (fd=33, vector=0x7fffb8ac69e0,
count=2) at ../sysdeps/unix/sysv/linux/writev.c:46
#1  0x00007fd3b0aab445 in _dbus_write_two (fd=33, buffer1=<value
optimized out>, start1=<value optimized out>, len1=-32,
   buffer2=0x7fd3b1983cd8, start2=0, len2=45) at dbus-sysdeps-unix.c:415
#2  0x00007fd3b0aa4888 in do_writing (transport=0x7fd3b1965f40) at
dbus-transport-socket.c:597
#3  0x00007fd3b0aa4ac2 in socket_do_iteration
(transport=0x7fd3b1965f40, flags=1, timeout_milliseconds=-1)
   at dbus-transport-socket.c:991
#4  0x00007fd3b0aa36a4 in _dbus_transport_do_iteration
(transport=0x7fd3b1965f40, flags=1, timeout_milliseconds=-1)
   at dbus-transport.c:942
#5  0x00007fd3b0a990ee in _dbus_connection_do_iteration_unlocked
(connection=0x7fd3b1966350, flags=1, timeout_milliseconds=-1)
   at dbus-connection.c:1143
#6  0x00007fd3b0a991a8 in
_dbus_connection_send_preallocated_unlocked_no_update
(connection=0x7fd3b1966350,
   preallocated=0x7fd3b19857d0, message=0x7fd3b1983c90,
client_serial=0x0) at dbus-connection.c:1929
#7  0x00007fd3b0a99b19 in
_dbus_connection_send_preallocated_and_unlock (connection=0x21,
preallocated=0x7fffb8ac69e0,
   message=0x2, client_serial=0xffffffffffffffff) at dbus-connection.c:1948
#8  0x00007fd3b0a8c860 in bus_transaction_execute_and_free
(transaction=0x7fd3b197b0c0) at connection.c:2102
#9  0x00007fd3b0a8df35 in bus_connection_disconnected
(connection=0x7fd3b19271f0) at connection.c:225
#10 0x00007fd3b0a8f312 in bus_dispatch_message_filter
(connection=0x7fd3b19271f0, message=0x7fd3b1955b60,
   user_data=<value optimized out>) at dispatch.c:186
#11 0x00007fd3b0a997b0 in dbus_connection_dispatch
(connection=0x7fd3b19271f0) at dbus-connection.c:4350
#12 0x00007fd3b0aacee8 in _dbus_loop_dispatch (loop=0x7fd3b19146b0) at
dbus-mainloop.c:482
#13 0x00007fd3b0aad283 in _dbus_loop_iterate (loop=0x7fd3b19146b0,
block=1) at dbus-mainloop.c:848
#14 0x00007fd3b0aad4cd in _dbus_loop_run (loop=0x7fd3b19146b0) at
dbus-mainloop.c:874
#15 0x00007fd3b0a96da1 in main (argc=7, argv=<value optimized out>) at
main.c:464

(gdb) p *vector
$2 = {iov_base = 0x7fd3b19a9d00, iov_len = 160}

(gdb) up
(gdb) p *buffer2
$3 = {dummy1 = 0x7fd3b19a3460, dummy2 = 45, dummy3 = 172, dummy4 =
2147483639, dummy5 = 0, dummy6 = 0, dummy7 = 0, dummy8 = 0}

(gdb) up
(gdb) p *transport
$4 = {refcount = 2, vtable = 0x7fd3b0cca9e0, connection =
0x7fd3b1966350, loader = 0x7fd3b1941cd0, auth = 0x7fd3b1966030,
 credentials = 0x7fd3b19661f0, max_live_messages_size = 1000000000,
live_messages_size = 0x7fd3b19661c0, address = 0x0,
 expected_guid = 0x0, unix_user_function = 0x7fd3b0a8da00
<allow_unix_user_function>, unix_user_data = 0x0,
 free_unix_user_data = 0, windows_user_function = 0,
windows_user_data = 0x0, free_windows_user_data = 0, disconnected = 0,
 authenticated = 1, send_credentials_pending = 0,
receive_credentials_pending = 0, is_server = 1, unused_bytes_recovered
= 1,
 allow_anonymous = 0}

(gdb) frame 5
(gdb) p *connection
$5 = {refcount = {value = 1}, mutex = 0xabcdef, dispatch_mutex =
0xabcdef, dispatch_cond = 0xabcdef2, io_path_mutex = 0xabcdef,
 io_path_cond = 0xabcdef2, outgoing_messages = 0x7fd3b19499a8,
incoming_messages = 0x0, message_borrowed = 0x0, n_outgoing = 1,
 n_incoming = 0, outgoing_counter = 0x7fd3b1966460, transport =
0x7fd3b1965f40, watches = 0x7fd3b1966220,
 timeouts = 0x7fd3b1966260, filter_list = 0x7fd3b19b0550, slot_list =
{slots = 0x7fd3b199bf10, n_slots = 1},
 pending_replies = 0x7fd3b19662a0, client_serial = 8,
disconnect_message_link = 0x7fd3b197c250, wakeup_main_function = 0,
 wakeup_main_data = 0x0, free_wakeup_main_data = 0,
dispatch_status_function = 0x7fd3b0a8d9d0 <dispatch_status_function>,
 dispatch_status_data = 0x7fd3b19146b0, free_dispatch_status_data =
0, last_dispatch_status = DBUS_DISPATCH_COMPLETE,
 link_cache = 0x7fd3b194b220, objects = 0x7fd3b1920dc0, server_guid =
0x0, dispatch_acquired = 0, io_path_acquired = 1,
 shareable = 0, exit_on_disconnect = 0, route_peer_messages = 1,
disconnected_message_arrived = 0,
 disconnected_message_processed = 0, have_connection_lock = 1, generation = 1}

(gdb) up
(gdb) p *message
$6 = {refcount = {value = 15}, header = {data = {dummy1 =
0x7fd3b19a9d00, dummy2 = 160, dummy3 = 384, dummy4 = 2147483639,
     dummy5 = 0, dummy6 = 0, dummy7 = 0, dummy8 = 0}, fields =
{{value_pos = -2}, {value_pos = 20}, {value_pos = 52}, {
       value_pos = 84}, {value_pos = -2}, {value_pos = -2},
{value_pos = -2}, {value_pos = 116}, {value_pos = 148}},
   padding = 7, byte_order = 108}, body = {dummy1 = 0x7fd3b19a3460,
dummy2 = 45, dummy3 = 172, dummy4 = 2147483639, dummy5 = 0,
   dummy6 = 0, dummy7 = 0, dummy8 = 0}, byte_order = 108 'l', locked
= 1, in_cache = 0, size_counters = 0x7fd3b194a770,
 size_counter_delta = 205, changed_stamp = 0, slot_list = {slots =
0x0, n_slots = 0}, generation = 1}