In struct datahead, there are two fields that control validity of the cache entry, timeout and usable.  These are not updated atomically at the same time, yet in prune_cache, we have this code:

	  /* Check whether the entry timed out.  */
	  if (dh->timeout < now)
	    {
…
	    }
	  else
	    {
	      assert (dh->usable);
	      next_timeout = MIN (next_timeout, dh->timeout);
	    }

This assumes that if an entry has not timed out yet, it is always usable. The precise conditions under which entries become marked as not usable is still a bit mysterious to me. One such source of invalidation is the pass through the cache after start, to re-validate entries which have expired. If the date associated with a key has changed, the old entry is marked as not usable.

I terminated nscd immediately after an entry was marked as unusable and set the clock backwards, so that the timeout on the entry had no longer lapsed (but not by an hour, so that nscd would still consider the cache file valid). This was sufficient to trigger the assertion failure during the next time nscd started. That's why I think we have a real bug here.