The issue was the SysTick timer, which was configured by the bootloader to
blink the backlight LEDs, but was not de-configured before booting to the
application.

Without the SysTick timer de-configured, the FreeRTOS tick timer, which relies
on the SysTick timer, fired before FreeRTOS could be properly configured. Since
the FreeRTOS SysTick handler contains some OS-specific functions and data, the
fact that these were not initialized probably led to a segfault.

This issue was fixed in boot.c, by de-configuring the SysTick timer.