Encoder crash for EVS-compatible Stereo Dmx at 96/128 kbps SWB/FB

There is an encoder crash for the Stereo Dmx condition when coding one (rather unusual) item - which I probably can't share directly here on Gitlab - at bitrates 96 and 128 kbps SWB and FB. The encoder at some point runs into the following assert:

IVAS_cod: lib_enc/vlpc_1st_cod.c:159: vlpc_1st_cod: Assertion 'hit > 0' failed.

I investigated a bit where this crash originates from and the reason for hitting the assert in vlpc_1st_cod() is that the LSF buffer only contains uninitialized values. Going further back, it seems that the call to function a2lsp_stab() in core_signal_analysis_high_rate() (line 439 of ext_sig_ana.c) doesn't return proper LSP values. This happens in the second subframe iteration of a TCX10 frame.

In this specific case where the encoder crashes a condition at the end of a2lsp_stab() (if ( nf < M )) is hit that overwrites lsp_new with st->lspold_enc which itself only contains uninitizialized values. What is really strange here is that st->lspold_enc is set to lsp_new at the end of the first subframe iteration. However, lsp_new (== lsp[0]) isn't actually written in the first subframe and therefore uninitialized. Instead, lsp_mid (== lsp[1]) is written in the first iteration and lsp_new only in the second.

Shouldn't st->lspold_enc, therefore, be set to lsp_mid for the first TCX10 subframe and to lsp_new in the second?

I'm not familiar with this part of the code, so maybe I'm overlooking something, but this looks like a bug to me. Could someone with more familiarity with this code have a look and confirm this?