OK, that was sort of embarrasing: Allocate enough space for *both*

the two sess-> suckaddrs.

bin/varnishd/cache/cache_session.c

@@ -464,7 +464,7 @@ SES_NewPool(struct pool *wp, unsigned pool_no)
 	pp->mpl_req = MPL_New(nb, &cache_param->req_pool,
 	    &cache_param->workspace_client);
 	bprintf(nb, "sess%u", pool_no);
-	ses_size = sizeof (struct sess) + vsa_suckaddr_len;
+	ses_size = sizeof (struct sess) + vsa_suckaddr_len * 2;
 	pp->mpl_sess = MPL_New(nb, &cache_param->sess_pool, &ses_size);
 	return (pp);
 }