For now I assume that the btManifoldPoint pointer in BulletContact became stale. I checked in fix which replaces the pointer by a concrete object. Since btManifoldPoint is not 16-bit aligned I had to replace the pvector by a btAlignedObjectArray. Well, let’s see if this fixed the Linux crashes.