Problem with rtems_task_variable_delete

[Dieter Schaefer]

Hello,

trying to get telnetd to work (powerpc, rtems-4.6.0pre5) I experienced 
the following problem ...
trying various commands everything seems to work Ok, until I try to 
logoff from the telnet session. The system crashes, mean end up 
in the BSP panic handler.
Digging into the problem, it seems to be related with deleting a task variable.
If the task variable contains a pointer to malloc'ed memory and 'free' is 
passed to rtems_task_variable_add it will crash on deleting the task. 
Background: telnetd uses shell, and shell creates a 'user environment' 
after issuing a 'logoff', shell tries to execute a 
rtems_task_delete( RTEMS_SELF );  
which in turn, at some point calls 
rtems_task_variable_delete(RTEMS_SELF, ... ); 

The same behavior can be reproduces with a slightly modified version 
of 'ticker test'  
Adding a task variable pointing to malloc'ed space, assign different values 
etc. and deleting this space manually after 'rtems_task_variable_delete' 
everything works Ok. Passing 'free' to automatically delete this space, it 
ends up in the BSP panic handler.

Did anybody experienced the same/similar problem? Or, even better, 
has a fix or work-around? 

Any information or hint is appreciated.

Thanks
Dieter Schaefer

PS: FTP and Web-Server runs all day long even under heavy load and 
with continuous ping on FEC and SCCx.