plymouthd crashed with SIGSEGV in ply_event_loop_process_pending_events()

This is a continuation of the saga in LP: #843432 That bug report already has the lspci and xdpyinfo output attachments.

QEMU with the Cirrus Logic GD 5446 [1013:00b8] video emulation in 24-bit color depth uses 3-bytes not 4 which causes numerous problems.

ProblemType: Crash
DistroRelease: Ubuntu 11.10
Package: plymouth 0.8.2-2ubuntu28
ProcVersionSignature: Ubuntu 3.0.0-12.19-generic 3.0.4
Uname: Linux 3.0.0-12-generic i686
ApportVersion: 1.23-0ubuntu2
Architecture: i386
Date: Thu Sep 29 09:51:18 2011
DefaultPlymouth: /lib/plymouth/themes/ubuntu-logo/ubuntu-logo.plymouth
ExecutablePath: /sbin/plymouthd
InstallationMedia: Ubuntu 11.10 "Oneiric Ocelot" - Beta i386 (20110901)
Lsusb: Error: command ['lsusb'] failed with exit code 1: unable to initialize libusb: -99
MachineType: Bochs Bochs
ProcCmdLine: BOOT_IMAGE=/boot/vmlinuz-3.0.0-12-generic root=UUID=d22d8284-4a76-42af-b1a4-cd27b5a37af5 ro quiet splash vt.handoff=7
ProcCmdline: /sbin/plymouthd --mode=boot --attach-to-session
ProcEnviron: PATH=(custom, no user)
ProcFB: 0 EFI VGA
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-3.0.0-12-generic root=UUID=d22d8284-4a76-42af-b1a4-cd27b5a37af5 ro quiet splash vt.handoff=7
SegvAnalysis:
 Segfault happened at: 0x2755b7 <ply_event_loop_process_pending_events+455>: test %ecx,0x4(%esi)
 PC (0x002755b7) ok
 source "%ecx" ok
 destination "0x4(%esi)" (0x00000004) not located in a known VMA region (needed writable region)!
SegvReason: writing NULL VMA
Signal: 11
SourcePackage: plymouth
StacktraceTop:
 ply_event_loop_process_pending_events () from /lib/libply.so.2
 ply_event_loop_run () from /lib/libply.so.2
 ?? ()
 __libc_start_main () from /lib/i386-linux-gnu/libc.so.6
 ?? ()
TextPlymouth: /lib/plymouth/themes/ubuntu-text/ubuntu-text.plymouth
Title: plymouthd crashed with SIGSEGV in ply_event_loop_process_pending_events()
UpgradeStatus: Upgraded to oneiric on 2011-09-14 (15 days ago)
UserGroups:

dmi.bios.date: 01/01/2007
dmi.bios.vendor: Bochs
dmi.bios.version: Bochs
dmi.chassis.type: 1
dmi.chassis.vendor: Bochs
dmi.modalias: dmi:bvnBochs:bvrBochs:bd01/01/2007:svnBochs:pnBochs:pvr:cvnBochs:ct1:cvr:
dmi.product.name: Bochs
dmi.sys.vendor: Bochs