While debugging an infinite loop in gdb I found it occurred here:

value_struct_elt:

    while (TYPE_CODE (t) == TYPE_CODE_PTR || TYPE_CODE (t) == TYPE_CODE_REF)
      {
        *argp = value_ind (*argp);
        /* Don't coerce fn pointer to fn and then back again!  */
        if (TYPE_CODE (value_type (*argp)) != TYPE_CODE_FUNC)
          *argp = coerce_array (*argp);
        t = check_typedef (value_type (*argp));
      }

The comment for value_struct_elt says:

 /* Given *ARGP, a value of type (pointer to a)* structure/union,

There's no suggestion of *ARGP being a pointer to a pointer to a pointer to ... a pointer to a struct/union.
If this is an ease of use feature for the user, this seems like too low a level a routine to implement this feature.

One possibility is that the loop is just a simple way to handle ptr->ref, with ptr->ptr->ptr->... being accidental fallout.

IWBN to clarify this.

The TYPE_CODE (value_type (*argp)) needs a call to check_typedef.

Another related bug is why is there a check for a function inside the loop?
We're only interested in structs/unions here.
I suspect it's because coerce_array is misnamed/confusing: it also coerces functions to be pointer to functions.  And if we didn't do the check we would be stuck in an infinite loop.  Alas we still are in an infinite loop if *argp is ptr->typedef->func.