VPP was connected to an interface that was using the eth_af_packet driver in DPDK (ie, _not _the host-interface driver in VPP). Had an IP address configured and a fib entry back out that same port.

set int st af_packet0 up
set int ip address af_packet0 192.168.2.2/24
ip route add 192.168.0.0/20 via 192.168.2.1 af_packet0

That port was connect to another VPP node and which in turn has a TAP interface to its host.

A traceroute from that linux host to 192.168.2.2 caused VPP to immediately die:

dev/fdio/vpp/build-data/../vnet/vnet/rewrite.h:148 (_vnet_rewrite_one_header) assertion `h0->data_bytes != 0xfefe' fails

Not currently been able to reproduce and it wasn't running in the debugger at the time.