Modification of Apache Scoreboard data, shared by root (uid=0) and www-data process, allows triggering of invalid free in root process during apache shutdown, exploitation seems impossible except for really broken chroot configs.
c4fca211361fbba0c2cbccb0c6f798909ec36dbe33e746db01cba353100298ff