[quote="Maxim Dounin"]
You are using nonexitant enumerated captures here as they are
gone as soon as you execute another regexp while server rewrite
directives (including "set") are re-executed after internal
redirects.

General rule is: never use enumerated captures from server_name
regexp as long as you have other regexps in server block in
question. Or, better: never use enumerated captures from
server_name.

This particular problem with malloc(-2) should be fixed 0.8.*.
Also in 0.8.* you may use named captures in server_name instead of
enumerated, they will survive internal redirects.

For 0.7.* just avoid using captures in server_name. If you really
have to set something based on Host header - use

if ($http_host ~ "^(.)(.)(.).*$") {
set $host_1 $1;
set $host_2 $2;
set $host_3 $3;
}

at server level instead.
[/quote]

Perfect, that fixed it. Many thanks for the quick response!