@kkusson, I just looked into this. I can't figure it out either. This is not related to any crash I've seen before. But, I'll tell you what I figured out.
You are crashing trying to execute an instruction at 34E40A. That's in the middle of an instruction starting at 34E409, so it shouldn't do that. The CPU should only execute the start of an instruction.
This is at the end of a recursive function (you can see the same address on the stack 7 times). The instruction at 34E409 is supposed to jump to a leaf handler for 0-7 items. Based on the register rax in the dump, I can see that you had 3 items, so it should jump to the 3-item handler.
The easiest way to execute the wrong instruction is for code to clobber the return address on the stack. However, I can tell that all the return addresses still on the stack are valid. In particular, the next return address is valid, so I can see what function that called. That should be the current function, and the crashing address is in there, even though it's in the middle of an instruction. Then, for return address corruption, the current function would have had to call another function that corrupted its return address. But the current function was actually reached by a recursive call, meaning the function called itself. In fact, the only function it calls is itself, and I see no way this code could corrupt a return address on the stack.
If you have more copies of apex_crash.txt from other crashes, that could be useful. Otherwise, I unfortunately don't see anything else I can do.
