I've managed to isolate the 1) by:

* setting the pointer value to 0 at the end of m_pd.c pd_free() with memset(&x, 0, sizeof(x));

* and checking if x is NULL and returning at the beginning of pd_typedmess()

As suggested before, this seems to indicate that the menuclose frees the canvas object while pd_typedmess() is checking for receive objects. I have no issue opening & closing patches without receive objects.