Core dump only on debug.level=3 when setting anything via index.html RPC

I’ve noticed a very particular situation where my device core dumps and I’m trying to work out why.
Under normal operation (debug.level=2) it all operates as expected, which is:

  1. Device boots in AP mode with http server enabled
  2. I connect to the device and enter some network credentials
  3. I click “save” which triggers a XMLHttpRequest() that sends wifi.sta data via RPC endpoint
  4. Device reboots and connects to the network

The problem comes when I set debug.level=3. The device core dumps at step 3.

I’ve started with the demo-c project in an attempt to rule out any of the code I’ve added.
main.c is unchanged, mos.yml and index.html changes look like this:

  - ["wifi.ap.pass", ""]
  - ["wifi.ap.enable", true]
  - ["debug.level", 3]
<!DOCTYPE html>
<html>

<body>
  <h1>Hello</h1>
  <button class="scan" id="save">
    Save
  </button>

  <script>
    save.onclick = function () {
      var request = new XMLHttpRequest();
      var data = JSON.stringify({
        config: {
          wifi: {
            sta: {
              "enable": true,
              "ssid": "test",
              "pass": "1234"
            }
          }
        }
      });
      request.open('POST', '/rpc/Config.Set', true);
      request.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded; charset=UTF-8');
      request.send(data);
      request.onload = function () {
        alert(request.status);
      }
    };
  </script>
</body>

</html>

Clicking the save button from the webpage with debug.level=3 results in a core dump with no real info:

mg_rpc.c:499            0x3ffc8960 CHAN OPEN (HTTP 192.168.4.2:40722)
[May  8 20:40:13.593] mg_rpc.c:526            0x3ffc8960 GOT PARSED FRAME: '' -> '' 64109454 args '{"config":{"wifi":{"sta":{"enable":true,"ssid":"test","pass":"1234"}}}}'
[May  8 20:40:13.607] mg_rpc.c:314            Config.Set via HTTP 192.168.4.2:40722
[May  8 20:40:13.613] Guru Meditation Error: Core  1 panic'ed (LoadProhibited). Exception was unhandled.
[May  8 20:40:13.620] 
[May  8 20:40:13.620] Core  1 register dump:

Then debugging the core dump:

Dump contains FreeRTOS task info
Loaded core dump from last snippet in  /core
0x40080400 in ?? ()
Unmapped addr 0xdeadbee3
#0  0x40080400 in ?? ()
(gdb) 

When debug.level=2 everything works as expected:

[May  8 22:29:26.455] main.c:12               Tick uptime: 47.19, RAM: 253320, 162256 free
[May  8 22:29:27.400] mg_rpc.c:314            Config.Set via HTTP 192.168.4.2:42140
[May  8 22:29:27.425] mg_rpc.c:314            Config.Save via HTTP 192.168.4.2:42140
[May  8 22:29:27.454] main.c:12               Tock uptime: 48.19, RAM: 253312, 160696 free

Any ideas??
Thanks