It appears that CmdUpdate does not persist the BSONObj it uses to make its write_ops batch. This is fine when the CommandInvocation lives as long as the underlying OpMsgRequest, but causes use-after-free when the CommandInvocation can be used off thread. We need to either make a BSONObj member for the actual Invocation or for the batch object. There is a small chance that this is a non-issue and there is some other problem causing terminate style failure when updates are mirrored.