I've attached some stack traces from the problem. I temporarily turned off exception handling on the python end, and ran a script that just calls capnp.load("test.capnp") a hundred times. This still doesn't reproduce the problem reliably, so I run it over and over again in a bash loop until one crashes and then inspect the core dump. I'm still trying to reproduce it in a simpler form, but it's definitely occurring in SchemaParser::parseDiskFile. Below are two different ways I've seen it crash.
#0 0x00007fff96623866 in __pthread_kill ()
#1 0x00007fff95b8f35c in pthread_kill ()
#2 0x00007fff9aa1fbba in abort ()
#3 0x00007fff9a901141 in abort_message ()
#4 0x00007fff9a926aa4 in default_terminate_handler ()
#5 0x00007fff9ae04322 in _objc_terminate ()
#6 0x00007fff9a9243e1 in std::__terminate ()
#7 0x00007fff9a923e6b in __cxa_throw ()
#8 0x000000010977f684 in kj::ExceptionCallback::RootExceptionCallback::onRecoverableException (this=0x1097b2828, exception=@0x7fff5744b690) at src/kj/exception.c++:298
#9 0x000000010977a409 in kj::throwRecoverableException (exception=@0x7fff5744b690) at src/kj/exception.c++:349
#10 0x0000000109781fc7 in kj::_::Debug::Fault::~Fault (this=0x7fff5744b948) at src/kj/debug.c++:201
#11 0x0000000109781f35 in kj::_::Debug::Fault::~Fault (this=0x7fff5744b948) at src/kj/debug.c++:197
#12 0x000000010924fe9d in capnp::_::WireHelpers::readListPointer (segment=0x7fcd60482ed0, ref=0x7fcd608c3428, refTarget=0x7fcd71a36360, defaultValue=0x0, expectedElementSize=capnp::_::INLINE_COMPOSITE, nestingLimit=2147483646) at src/capnp/layout.c++:1903
#13 0x000000010924bfe7 in capnp::_::WireHelpers::readListPointer (segment=0x7fcd60482ed0, ref=0x7fcd608c3428, defaultValue=0x0, expectedElementSize=capnp::_::INLINE_COMPOSITE, nestingLimit=2147483646) at src/capnp/layout.c++:1873
#14 0x0000000109246dd9 in capnp::_::PointerReader::getList (this=0x7fff5744bb30, expectedElementSize=capnp::_::INLINE_COMPOSITE, defaultValue=0x0) at src/capnp/layout.c++:2239
#15 0x0000000108c87683 in capnp::List<capnp::schema::Annotation, (capnp::Kind)3>::getFromPointer (reader=@0x7fff5744bb30, defaultValue=0x0) at list.h:297
#16 0x0000000108c875b6 in capnp::_::PointerHelpers<capnp::List<capnp::schema::Annotation, (capnp::Kind)3>, (capnp::Kind)6>::get (reader={segment = 0x7fcd60482ed0, pointer = 0x7fcd608c3428, nestingLimit = 2147483646}, defaultValue=0x0) at pointer-helpers.h:71
#17 0x0000000108c72b2c in capnp::schema::Node::Reader::getAnnotations (this=0x7fff5744c058) at schema.capnp.h:2888
#18 0x0000000108c6c156 in capnp::compiler::Compiler::Node::traverseNodeDependencies (this=0x7fcd608c6fe8, schemaNode=@0x7fff5744c058, eagerness=1073774593, seen=@0x7fff5744c278, finalLoader=@0x7fcd604b1980) at src/capnp/compiler/compiler.c++:775
#19 0x0000000108c6b9aa in capnp::compiler::Compiler::Node::traverse (this=0x7fcd608c6fe8, eagerness=1073774597, seen=@0x7fff5744c278, finalLoader=@0x7fcd604b1980) at src/capnp/compiler/compiler.c++:707
#20 0x0000000108c6bbdb in capnp::compiler::Compiler::Node::traverse (this=0x7fcd604ccf38, eagerness=1073774597, seen=@0x7fff5744c278, finalLoader=@0x7fcd604b1980) at src/capnp/compiler/compiler.c++:724
#21 0x0000000108c6eeba in capnp::compiler::Compiler::Impl::eagerlyCompile (this=0x7fcd60482e80, id=15350781828677780152, eagerness=1073774597, finalLoader=@0x7fcd604b1980) at src/capnp/compiler/compiler.c++:1070
#22 0x0000000108c6f4ee in capnp::compiler::Compiler::eagerlyCompile (this=0x7fcd604b18a0, id=15350781828677780152, eagerness=1073774597) at src/capnp/compiler/compiler.c++:1113
#23 0x0000000108c88b85 in capnp::SchemaParser::parseFile (this=0x7fcd604a8890, file=@0x7fff5744c6e8) at src/capnp/schema-parser.c++:182
#24 0x0000000108c88a2c in capnp::SchemaParser::parseDiskFile (this=0x7fcd604a8890, displayName={content = {<kj::DisallowConstCopyIfNotConst<const char>> = {<No data fields>}, ptr = 0x108a9cc84 "test.capnp", size_ = 11}}, diskPath={content = {<kj::DisallowConstCopyIfNotConst<const char>> = {<No data fields>}, ptr = 0x108a9cc84 "test.capnp", size_ = 11}}, importPath={<kj::DisallowConstCopyIfNotConst<const kj::StringPtr>> = {<No data fields>}, ptr = 0x7fcd604d1940, size_ = 0}) at src/capnp/schema-parser.c++:176
#25 0x0000000108af591f in __pyx_pw_5capnp_5capnp_12SchemaParser_5_parse_disk_file (__pyx_v_self=0x108992120, __pyx_args=<value temporarily unavailable, due to optimizations>, __pyx_kwds=0x0) at capnp/capnp.cpp:32795
#26 0x00000001087c3f6d in PyObject_Call ()
#27 0x0000000108af643d in __pyx_pw_5capnp_5capnp_12SchemaParser_7load (__pyx_v_self=0x108992120, __pyx_args=<value temporarily unavailable, due to optimizations>, __pyx_kwds=<value temporarily unavailable, due to optimizations>) at capnp/capnp.cpp:33818
#28 0x00000001087c3f6d in PyObject_Call ()
#29 0x0000000108ae9f79 in __pyx_pf_5capnp_5capnp_10load () at /Users/jason/workspace/pycapnp/capnp/capnp.cpp:38704
#30 0x0000000108ae9f79 in __pyx_pw_5capnp_5capnp_11load (__pyx_self=<value temporarily unavailable, due to optimizations>, __pyx_args=<value temporarily unavailable, due to optimizations>, __pyx_kwds=<value temporarily unavailable, due to optimizations>) at capnp/capnp.cpp:38633
#31 0x000000010883c656 in PyEval_EvalFrameEx ()
#32 0x000000010883a480 in PyEval_EvalCodeEx ()
#33 0x0000000108839e14 in PyEval_EvalCode ()
#34 0x00000001088593c4 in run_mod ()
#35 0x000000010885946b in PyRun_FileExFlags ()
#36 0x0000000108858fb9 in PyRun_SimpleFileExFlags ()
#37 0x0000000108869a67 in Py_Main ()
#38 0x00007fff97f915fd in start ()
#0 0x00007fff96623866 in __pthread_kill ()
#1 0x00007fff95b8f35c in pthread_kill ()
#2 0x00007fff9aa1fbba in abort ()
#3 0x00007fff9a901141 in abort_message ()
#4 0x00007fff9a926aa4 in default_terminate_handler ()
#5 0x00007fff9ae04322 in _objc_terminate ()
#6 0x00007fff9a9243e1 in std::__terminate ()
#7 0x00007fff9a923e6b in __cxa_throw ()
#8 0x0000000108682684 in kj::ExceptionCallback::RootExceptionCallback::onRecoverableException (this=0x1086b5828, exception=@0x7fff58548a30) at src/kj/exception.c++:298
#9 0x0000000107b91d29 in capnp::SchemaFile::DiskSchemaFile::reportError (this=0x7fc6e9d1bcb0, start={byte = 6808, line = 181, column = 7}, end={byte = 6817, line = 181, column = 16}, message={content = {<kj::DisallowConstCopyIfNotConst<const char>> = {<No data fields>}, ptr = 0x7fc6e9e96970 "Internal compiler bug: Schema failed validation:\nsrc/capnp/layout.c++:570: requirement not met: expected boundsCheck(segment, ptr, ptr + ref->structRef.wordSize()); Message contained out-of-bounds str"..., size_ = 412}}) at src/capnp/schema-parser.c++:445
#10 0x0000000107b9294b in capnp::SchemaParser::ModuleImpl::addError (this=0x7fc6e9d1c270, startByte=6808, endByte=6817, message={content = {<kj::DisallowConstCopyIfNotConst<const char>> = {<No data fields>}, ptr = 0x7fc6e9e96970 "Internal compiler bug: Schema failed validation:\nsrc/capnp/layout.c++:570: requirement not met: expected boundsCheck(segment, ptr, ptr + ref->structRef.wordSize()); Message contained out-of-bounds str"..., size_ = 412}}) at src/capnp/schema-parser.c++:123
#11 0x0000000107b6d746 in capnp::compiler::Compiler::Node::addError (this=0x7fc6ea801830, error={content = {<kj::DisallowConstCopyIfNotConst<const char>> = {<No data fields>}, ptr = 0x7fc6e9e96970 "Internal compiler bug: Schema failed validation:\nsrc/capnp/layout.c++:570: requirement not met: expected boundsCheck(segment, ptr, ptr + ref->structRef.wordSize()); Message contained out-of-bounds str"..., size_ = 412}}) at src/capnp/compiler/compiler.c++:826
#12 0x0000000107b6e6f1 in capnp::compiler::Compiler::Node::loadFinalSchema (this=0x7fc6ea801830, loader=@0x7fc6e9cb1980) at src/capnp/compiler/compiler.c++:683
#13 0x0000000107b6e8c4 in capnp::compiler::Compiler::Node::traverse (this=0x7fc6ea801830, eagerness=1073774597, seen=@0x7fff58549278, finalLoader=@0x7fc6e9cb1980) at src/capnp/compiler/compiler.c++:699
#14 0x0000000107b6ebdb in capnp::compiler::Compiler::Node::traverse (this=0x7fc6e9d011e8, eagerness=1073774597, seen=@0x7fff58549278, finalLoader=@0x7fc6e9cb1980) at src/capnp/compiler/compiler.c++:724
#15 0x0000000107b71eba in capnp::compiler::Compiler::Impl::eagerlyCompile (this=0x7fc6e9c82e80, id=15350781828677780152, eagerness=1073774597, finalLoader=@0x7fc6e9cb1980) at src/capnp/compiler/compiler.c++:1070
#16 0x0000000107b724ee in capnp::compiler::Compiler::eagerlyCompile (this=0x7fc6e9cb18a0, id=15350781828677780152, eagerness=1073774597) at src/capnp/compiler/compiler.c++:1113
#17 0x0000000107b8bb85 in capnp::SchemaParser::parseFile (this=0x7fc6e9c3aa50, file=@0x7fff585496e8) at src/capnp/schema-parser.c++:182
#18 0x0000000107b8ba2c in capnp::SchemaParser::parseDiskFile (this=0x7fc6e9c3aa50, displayName={content = {<kj::DisallowConstCopyIfNotConst<const char>> = {<No data fields>}, ptr = 0x10799fc84 "test.capnp", size_ = 11}}, diskPath={content = {<kj::DisallowConstCopyIfNotConst<const char>> = {<No data fields>}, ptr = 0x10799fc84 "test.capnp", size_ = 11}}, importPath={<kj::DisallowConstCopyIfNotConst<const kj::StringPtr>> = {<No data fields>}, ptr = 0x7fc6e9e7b6e0, size_ = 0}) at src/capnp/schema-parser.c++:176
#19 0x00000001079f891f in __pyx_pw_5capnp_5capnp_12SchemaParser_5_parse_disk_file (__pyx_v_self=0x107895120, __pyx_args=<value temporarily unavailable, due to optimizations>, __pyx_kwds=0x0) at capnp/capnp.cpp:32795
#20 0x00000001076c2f6d in PyObject_Call ()
#21 0x00000001079f943d in __pyx_pw_5capnp_5capnp_12SchemaParser_7load (__pyx_v_self=0x107895120, __pyx_args=<value temporarily unavailable, due to optimizations>, __pyx_kwds=<value temporarily unavailable, due to optimizations>) at capnp/capnp.cpp:33818
#22 0x00000001076c2f6d in PyObject_Call ()
#23 0x00000001079ecf79 in __pyx_pf_5capnp_5capnp_10load () at /Users/jason/workspace/pycapnp/capnp/capnp.cpp:38704
#24 0x00000001079ecf79 in __pyx_pw_5capnp_5capnp_11load (__pyx_self=<value temporarily unavailable, due to optimizations>, __pyx_args=<value temporarily unavailable, due to optimizations>, __pyx_kwds=<value temporarily unavailable, due to optimizations>) at capnp/capnp.cpp:38633
#25 0x000000010773b656 in PyEval_EvalFrameEx ()
#26 0x0000000107739480 in PyEval_EvalCodeEx ()
#27 0x0000000107738e14 in PyEval_EvalCode ()
#28 0x00000001077583c4 in run_mod ()
#29 0x000000010775846b in PyRun_FileExFlags ()
#30 0x0000000107757fb9 in PyRun_SimpleFileExFlags ()
#31 0x0000000107768a67 in Py_Main ()
#32 0x00007fff97f915fd in start ()