SPI dumping core on large palloc

I'm having an issue inside a SPI routine that is giving me crashes.
I'm curious if this is a backend problem or something that I am doing
improperly. The following SPI routine dumps core for large, but
reasonable allocations:

/* testing function. just makes bytea a of input len */
Datum _genbytes(PG_FUNCTION_ARGS)
{
int nbytes = PG_GETARG_INT32(0);
bytea* out;

if(SPI_connect() != SPI_OK_CONNECT)
MAKE_PGERROR("SPI_connect");

PG_NEW_BYTEA(out, nbytes); // see below

SPI_finish();
PG_RETURN_BYTEA_P(out);
}

#define PG_NEW_BYTEA(_bytea, _len) do{ \
int __l = (int)(_len) + VARHDRSZ; \
_bytea = (bytea *)palloc(__l); \
SET_VARSIZE(_bytea, __l); \
} while(0)

If SPI connect/finish is not inside the function (this is a reduced
example), I do not get the crash. If the bytea allocation is _before_
SPI connect, no crash, and no crash for small allocations.

I noticed in some of the contrib code that some allocations look like
they are being aligned. Am I doing anything wrong here?

merlin