docsis_server 3.5 segfault

Im running docsis_server 3.5 on debian 5 (lenny) and have run into an issue.
The server normally runs fine and is provisioning about 50 modems. But when the cmts is reset and all the modems try to get an IP at once the dhcp daemon crashes. This is all I got from gdb the last time it happened:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xb7b9b6b0 (LWP 18113)]
Parse_Modem_Caps (message=0xbfebe001) at dhcpd-options.c:240
240 for (i=14; po->vendor_ident[i]; i += 2 ) {
(gdb) backtrace
#0 Parse_Modem_Caps (message=0xbfebe001) at dhcpd-options.c:240
#1 0x01220101 in ?? ()
#2 0xbfebe001 in ?? ()
#3 0xbfeb261f in ?? ()
#4 0x000000aa in ?? ()
#5 0xbfeb26c9 in ?? ()
#6 0x0805bf7c in ?? ()
#7 0xbfeb311c in ?? ()
#8 0xbfeb3120 in ?? ()
#9 0xbfeb3138 in ?? ()
#10 0xbfeb3140 in ?? ()
#11 0xbfeb3944 in ?? ()
#12 0xbfeb418c in ?? ()
#13 0xbfeb4990 in ?? ()
#14 0xbfeb5198 in ?? ()
#15 0x00000000 in ?? ()

This is the code from dhcpd-options starting at line 240:

for (i=14; po->vendor_ident[i]; i += 2 ) {
c1 = po->vendor_ident[i] - 48;
if (c1 < 0) c1 = 0;
if (c1 > 9) {
if (c1 >= 17 && c1 <= 22) c1 -= 7;
if (c1 >= 49 && c1 <= 54) c1 -= 39;
if (c1 >= 16) c1 = 0;
}
c2 = po->vendor_ident[i + 1] - 48;
if (c2 < 0) c2 = 0;
if (c2 > 9) {
if (c2 >= 17 && c2 <= 22) c2 -= 7;
if (c2 >= 49 && c2 <= 54) c2 -= 39;
if (c2 >= 16) c2 = 0;
}
tmp[j] = (c1 << 4) + c2;
j++;
}

I don't see how this for-loop terminates, which would explain the segfault.
Has anyone else experienced this issue?
Any ideas on what might be happening?

Thanks in advance.