Thanks again Salva. Actually we found a very simple we to reproduce this problem. Inside our modules in a loop (50 times) we create the OpenSSH handle and then delete it (using disconnect as you said or undef it doesn't matter), we see the segmentation fault. here are logs from OpenSSH.pm

# master state jumping from _STATE_AWAITING_MUX to _STATE_RUNNING
# call args: ['/usr/bin/ssh','-O','check','-T','-S','.libnet-openssh-p
+erl/root-10.116.244.112-29033-578444','-l','root','10.116.244.112','-
+-']
# open_ex: ['/usr/bin/ssh','-O','check','-T','-S','.libnet-openssh-per
+l/root-10.116.244.112-29033-578444','-l','root','10.116.244.112','--'
+]
# io3 mloop, cin: 0, cout: 1, cerr: 0
# io3 fast, cin: 0, cout: 1, cerr: 0
# stdout, bytes read: 28 at offset 0
#> 4d 61 73 74 65 72 20 72 75 6e 6e 69 6e 67 20 28 70 69 64 3d 32 39 3
+7 33 35 29 0d 0a             | Master running (pid=29735)..
# io3 fast, cin: 0, cout: 1, cerr: 0
# stdout, bytes read: 0 at offset 28
# leaving _io3()
# _waitpid(29741) => pid: 29741, rc: 0, err:
# sending exit control to master
# call args: ['/usr/bin/ssh','-O','exit','-T','-S','.libnet-openssh-pe
+rl/root-10.116.244.112-29033-578444','-F','/dev/null','10.116.244.112
+','--']
# open_ex: ['/usr/bin/ssh','-O','exit','-T','-S','.libnet-openssh-perl
+/root-10.116.244.112-29033-578444','-F','/dev/null','10.116.244.112',
+'--']
[download]