But I noticed that a savefile that had only a few entries in it (because I aborted it during debugging) does not have the issue. I'm wondering now whether the file get over-written with junk later.
I'll step through the save part once more.
EDIT: debug save results in "vector subscript out of range" in ESM::SavedGame::save()
I backed out gus's suggsted change on page 9 of this thread and that particular issue doesn't happen any more.
I've discovered that the savefile generated inside the prison ship (debug or release version with int changed to uint32_t) does not have "0D0A" for the size of "PLCE". However the release version does have the issue when I save outside the Census office (I can't try the same with debug version due to slaughterfish).
So here is a crazy thing. I go through the chargen process right up to the final door. I then hit F2 and set chargenstate to -1. Save. Go outside the door and save again.
The save from inside is ok but the save from outside is not. (still none of them will load properly)