dovecot - Aug 2008 - Next message unexpectedly lost

Using 1.1.2. I'm getting the above message over and over in the error log. 
Dovecot drops the connection and the client (Tbird) just keeps retrying in 
an endless loop.

Using Wireshark to sniff the exchange, it looks like the command that fails 
looks like this:

5 UID fetch 1:9749,9751:9763,9765:9930,9932,9934:9942 (UID RFC822.SIZE 
FLAGS BODY.PEEK[HEADER.FIELDS (From To Cc Subject Date Message-ID Priority 
X-Priority References Newsgroups In-Reply-To Content-Type)])

Dovecot seems to be shutting down after receiving this.

Mulberry doesn't seem to have the problem, presumably because it's
sending
a different command sequence that doesn't stroke this.

Here's the failing code, in i_stream_raw_mbox_read :

        if (stream->istream.v_offset -
            rstream->hdr_offset + new_pos > rstream->mail_size) {
                /* istream_raw_mbox_set_next_offset() used invalid
                   cached next_offset? */
                i_error("Next message unexpectedly lost from
%"PRIuUOFF_T,
                        rstream->hdr_offset + rstream->mail_size);
                rstream->eof = TRUE;
                rstream->corrupted = TRUE;
                return -1;
        }

I've tried deleting the associated .imap/folder contents but it must 
regenerate the same bad data as it happens again.