It's bug in nodeAgg.c on lines 241, 242:

                null_array = malloc(nagg);
                for (i=0;i<nagg;i++)
                    null_array[i] = 'n';
                oneTuple = heap_formtuple(tupType, tupValue, null_array);

- your query has not only aggregates but also 'group by-ed' fields and so
null_array should contain tupType->natts elements (tupType->natts > nagg in
your case).

Patch follows and it's very simple.

VAdim