Thanks for the tip. From the comments in that bug I should be able to test that
patch in the 4.3+ kernels. I'm rolling my own build so I can try that out as
soon as I have some spare time. I'll also try mesa 11.0.4 when it will be
available in portage (which should be shortly after release).

I'd also like to do another experiment: traces gathered with apitrace always
end up with the seg-faulting command and always work fine when repeating them -
possibly because the last command needs to be fully executed to cause the
problem. I'll try gathering a much longer trace using the software render and
then try to replay that one with apitrace to see if I can trigger the bug.
Alternatively this might be a race condition of some sort (I can see in the
trace that there's at least 4 threads calling GL commands); possibly
re-executing the trace a lot of times might trigger it sooner or later.

I'll report back if I find anything useful.