Additional debug info
I hope it will help you
If any additional info is needed ask please
It's still urgent for us
Thanks

static zval **cluster_shuffle_seeds(HashTable *seeds, int *len) {
    zval **z_seeds;
    int *map, i, count, index=0;

    /* How many */
    count = zend_hash_num_elements(seeds);

    /* Allocate our return value and map */
    z_seeds = ecalloc(count, sizeof(zval*));
    map = emalloc(sizeof(int)*count);

    /* Fill in and shuffle our map */
    for (i = 0; i < count; i++) map[i] = i;
    fyshuffle(map, count);

    /* Iterate over our source array and use our map to create a random list */
    for (zend_hash_internal_pointer_reset(seeds);
         zend_hash_has_more_elements(seeds) == SUCCESS;
         zend_hash_move_forward(seeds))
    {
        z_seeds[map[index++]] = zend_hash_get_current_data(seeds);
    }

    efree(map);

    *len = count;
    return z_seeds;
}

(gdb) p z_seeds[map[index++]]
Cannot access memory at address 0x7ffc418c28c8

(gdb) p count
$13 = 7

(gdb) p index
$4 = 8

(gdb) p *map@9
$6 = {0, 3, 6, 5, 4, 1, 2, -16747776, 0}

(gdb) p *seeds
$34 = {gc = {refcount = 2, u = {v = {type = 7 '\a', flags = 2 '\002', gc_info = 0}, type_info = 519}}, u = {v = {flags = 28 '\034', nApplyCount = 0 '\000', nIteratorsCount = 0 '\000', reserve = 0 '\000'}, flags = 28},
nTableMask = 4294967294, arData = 0x7f6322877388, nNumUsed = 7, nNumOfElements = 7, nTableSize = 8, nInternalPointer = 4294967295, nNextFreeElement = 7, pDestructor = 0x55f8c218dca0 <_zval_ptr_dtor>}

(gdb) p *z_seeds@9
$10 = {0x7f6322877388, 0x7f6322877408, 0x7f6322877428, 0x7f63228773a8, 0x7f63228773e8, >0x7f63228773e8, 0x7f63228773c8, 0x700000001, 0xfffffffe00000012}

Some investigation and workaround

Sometimes function zend_hash_has_more_elements(seeds) returns SUCCESS when no more elements are defined (or available). Unfortunately we have no resources and time to find the main reason.

Small patch.
We tested it and it's seems we didn't lose any functionality, all redis nodes are used, segfaults disappeared.

*** ./1/redis-3.0.0/cluster_library.c   2016-06-10 20:08:21.000000000 +0000
--- ./redis-3.0.0/cluster_library.c 2016-11-11 12:36:01.376468711 +0000
***************
*** 859,866 ****
--- 859,868 ----
           zend_hash_has_more_elements(seeds) == SUCCESS;
           zend_hash_move_forward(seeds))
      {
          z_seeds[map[index++]] = zend_hash_get_current_data(seeds);
+ 
+   if ( index == count ) break;
      }

      efree(map);

@vkirovskiy, could you try this code?

-    for (zend_hash_internal_pointer_reset(seeds);
-         zend_hash_has_more_elements(seeds) == SUCCESS;
-         zend_hash_move_forward(seeds))
-    {
-        z_seeds[map[index++]] = zend_hash_get_current_data(seeds);
-    }
+    ZEND_HASH_FOREACH_VAL(seeds, z_ele) {
+        z_seeds[map[index++]] = z_ele;
+    } ZEND_HASH_FOREACH_END();

@yatsukhnenko sure! thanks for the answer.
Will compile and test it today

@vkirovskiy BTW develop brunch is also support php7 and some of bugs already fixed

@yatsukhnenko Hi. Good patch, segfaults didn't appear after stress testing.
All nodes are used.
I found a bit failure connections, about 10 of 65000 connections was lost, but i guess it's cause of high connection rate.
Thank you for resolving this issue!