I tried to look into this using dbx, but couldn't understand what was
going on. 

Use "list <start_line_num> <end_line_num>" to see sections of code, in case
you don't remember how to use dbx.

Here is a full stack trace when system seg faults in final `reclaim':

(dbx) where
=>[1] disconnect_free_list(zone = 0x9011d24, i = 71U), line 3327 in "malloc.c"
  [2] coalesc(zone = 0x900e0e0), line 3146 in "malloc.c"
  [3] xfreeblock(zone = 0x900e0e0, r = 2281716792U), line 2700 in "malloc.c"
  [4] eif_rt_xfree(ptr = 0x900e0ec), line 2624 in "malloc.c"
  [5] explode_scavenge_zone(sc = 0x900d8e0), line 3888 in "malloc.c"
  [6] sc_stop(), line 3937 in "malloc.c"
  [7] reclaim(), line 1329 in "garcol.c"
  [8] main(0x1, 0x8047458, 0x8047460, 0x804744c), at 0x8e0a3ea 

Value of `r' in `coalesc' when crashes:

(dbx) print r
r = 32768U