Crash, when server answers with `EXPUNGE 1` directly after greeting.
This is the trace, which leads to a crash:
S: * OK [CAPABILITY IMAP4REV1 STARTTLS LOGINDISABLED] IMAP server ready.\r\n S: * 1 EXPUNGE\r\n * 2 EXPUNGE\r\n * 3 EXPUNGE\r\n C: 5 StartTLS\r\n S: 5 OK begin TLS now.\r\n
I am very sorry, that I didn't provide more information. I can take a closer look in a week or so. However, I guess this should be very easy for you to reproduce and find the cause of it.
I havn't looked into the source of balsa, but I strongly recommend, that all untagged responses are just discarded before STARTTLS.