The crash is initially observed on unbound project. Here is the minimal reproducer against glibc-2.33:

```c
/*
    $ gcc a.c -o a
    $ unshare --map-root-user ./a
*/

#include <sys/types.h>
#include <pwd.h>
#include <grp.h>

#include <unistd.h>

int main() {
    // load some NSS modules
    struct passwd * pw = getpwnam("root");

    chdir("/tmp");
    chroot("/tmp");
    chdir("/");
    // access nsswitch.conf in a chroot
    initgroups("root", 0);
}
```

Crash sequence (no root needed):

```
$ unshare --map-root-user strace -f ./a
...
newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=2091, ...}, 0) = 0
newfstatat(AT_FDCWD, "/", {st_mode=S_IFDIR|0755, st_size=3072, ...}, 0) = 0
openat(AT_FDCWD, "/etc/nsswitch.conf", O_RDONLY|O_CLOEXEC) = 3
newfstatat(3, "", {st_mode=S_IFREG|0644, st_size=2091, ...}, AT_EMPTY_PATH) = 0
read(3, "#\n# /etc/nsswitch.conf\n#\n# An ex"..., 1024) = 1024
read(3, "d\t\t\tUse Samba winbind support\n#\t"..., 1024) = 1024
read(3, " files\nshadow:     files\nservice"..., 1024) = 43
read(3, "", 1024)                       = 0
newfstatat(3, "", {st_mode=S_IFREG|0644, st_size=2091, ...}, AT_EMPTY_PATH) = 0
close(3)                                = 0
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
newfstatat(3, "", {st_mode=S_IFREG|0644, st_size=188218, ...}, AT_EMPTY_PATH) = 0
mmap(NULL, 188218, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7fda6f3cc000
close(3)                                = 0
openat(AT_FDCWD, "/lib64/libnss_files.so.2", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\3202\0\0\0\0\0\0"..., 832) = 832
newfstatat(3, "", {st_mode=S_IFREG|0755, st_size=47496, ...}, AT_EMPTY_PATH) = 0
mmap(NULL, 50568, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fda6f201000
mmap(0x7fda6f204000, 24576, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3000) = 0x7fda6f204000
mmap(0x7fda6f20a000, 8192, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x9000) = 0x7fda6f20a000
mmap(0x7fda6f20c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xa000) = 0x7fda6f20c000
close(3)                                = 0
mprotect(0x7fda6f20c000, 4096, PROT_READ) = 0
munmap(0x7fda6f3cc000, 188218)          = 0
openat(AT_FDCWD, "/etc/passwd", O_RDONLY|O_CLOEXEC) = 3
newfstatat(3, "", {st_mode=S_IFREG|0644, st_size=8924, ...}, AT_EMPTY_PATH) = 0
lseek(3, 0, SEEK_SET)                   = 0
read(3, "root:x:0:0:System user; root:/ro"..., 1024) = 1024
close(3)                                = 0
chdir("/tmp")                           = 0
chroot("/tmp")                          = 0
chdir("/")                              = 0
openat(AT_FDCWD, "/proc/sys/kernel/ngroups_max", O_RDONLY|O_CLOEXEC) = -1 ENOENT (Нет такого файла или каталога)
newfstatat(AT_FDCWD, "/etc/nsswitch.conf", 0x7ffca0501a20, 0) = -1 ENOENT (Нет такого файла или каталога)
newfstatat(AT_FDCWD, "/", {st_mode=S_IFDIR|S_ISVTX|0777, st_size=1520, ...}, 0) = 0
--- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0x100} ---
+++ killed by SIGSEGV (core dumped) +++
...

```