Some questions from upstream, with my commentary added...
How busy is this sustem? Is it just a simple client or also a server? If server, how busy? From the stack trace, the server side is trying to decode a NTS cookie. Is this box setup as a NTS server? That needs a certificate and key so it takes more than just upgrading from bullseye to bookworm.
It's not, right? We previously established that this is using the stock ntp.conf?
What are the chances that a valid NTP request with NTS arrived at this system? ntpq -c ntsinfo will show counters.
It would be good if you could check this. But if an NTS request is crashing ntpd, you might never see non-zero counters.
The log file from starting up might be helpful.
-- Richard
