.. and more embarrassingly, it's attributed to me, although I'm pretty sure it wasn't buggy when I sent it out.
The code in builtin-fetch-pack.c now reads
if (commit->object.parsed) parse_commit(commit);
which is obviously totally insane. There's a '!' missing.
Linus