Ok, with some help from mterry who is able to reproduce this quite easily, it looks like we've determined that what happens is something in set_disable_w_typing() writes 0x0 to the %ebx register and doesn't restore its original contents (%ebx must be preserved by the callee as per the SysV i386 ABI).
As %ebx is used to hold the base address of the GOT on i386, the next call which goes via the PLT (which happens to be gdk_device_manager_list_devices) crashes when trying to read the address to jump to
Ok, with some help from mterry who is able to reproduce this quite easily, it looks like we've determined that what happens is something in set_disable_ w_typing( ) writes 0x0 to the %ebx register and doesn't restore its original contents (%ebx must be preserved by the callee as per the SysV i386 ABI).
As %ebx is used to hold the base address of the GOT on i386, the next call which goes via the PLT (which happens to be gdk_device_ manager_ list_devices) crashes when trying to read the address to jump to