In RunOnAllShardsCommand::run() (parallel.cpp L144 in master), we check for an error response from each future:

    BSONObj result = res->result();

    if( ! result["errmsg"].eoo() ){
        errors.appendAs(res->result()["errmsg"], res->getServer());
    }

In this code, we access the "errmsg" field in the result object without first checking that the result object is valid/non-empty. If a command fails, we end up with an invalid result object, then assert when trying to access the errmsg field (as it doesn't exist, and the object is likely empty/invalid anyway).

Note that even if one server returns a bad response, this bug will cause all responses to fail, even if successfully executed on the remote server.