This is the back-trace:

#0  internal_find (st=0x300000000, data=data@entry=0x7ffff5ff86f8 <ssl3_ciphers+6552>, ret_val_options=ret_val_options@entry=2) at crypto/stack/stack.c:193
#1  0x00007ffff5ac2b0a in OPENSSL_sk_find (st=<optimized out>, data=data@entry=0x7ffff5ff86f8 <ssl3_ciphers+6552>) at crypto/stack/stack.c:211
#2  0x00007ffff5dccd0e in sk_SSL_CIPHER_find (ptr=0x7ffff5ff86f8 <ssl3_ciphers+6552>, sk=<optimized out>) at include/openssl/ssl.h:826
#3  tls_process_server_hello (s=0xbeafe0, pkt=0x7fffffffdda0) at ssl/statem/statem_clnt.c:1062
#4  0x00007ffff5dcae5f in read_state_machine (s=0xbeafe0) at ssl/statem/statem.c:589
#5  state_machine (s=0xbeafe0, server=0) at ssl/statem/statem.c:385
#6  0x00007ffff5db12da in ssl3_write_bytes (s=0xbeafe0, type=23, buf_=0xf03380, len=2) at ssl/record/rec_layer_s3.c:371
#7  0x00007ffff5dc18d9 in SSL_write (s=<optimized out>, buf=<optimized out>, num=<optimized out>) at ssl/ssl_lib.c:1605
#8  0x00007ffff6045616 in XS_Net__SSLeay_write () from /usr/lib64/perl5/vendor_perl/auto/Net/SSLeay/SSLeay.so
#9  0x00007ffff7abf620 in Perl_pp_entersub (my_perl=0x603010) at pp_hot.c:3987
#10 0x00007ffff7ab7ac6 in Perl_runops_standard (my_perl=0x603010) at run.c:41
#11 0x00007ffff7a37b7e in Perl_call_sv (my_perl=<optimized out>, sv=0xbd4ff8, flags=<optimized out>) at perl.c:2807
#12 0x00007ffff4eca1ff in e_cb () from /usr/lib64/perl5/vendor_perl/auto/EV/EV.so
#13 0x00007ffff4ec5a06 in ev_invoke_pending () from /usr/lib64/perl5/vendor_perl/auto/EV/EV.so
#14 0x00007ffff4edc1cd in ev_run () from /usr/lib64/perl5/vendor_perl/auto/EV/EV.so
#15 0x00007ffff4edd31b in XS_EV_run () from /usr/lib64/perl5/vendor_perl/auto/EV/EV.so
#16 0x00007ffff7abf620 in Perl_pp_entersub (my_perl=0x603010) at pp_hot.c:3987
#17 0x00007ffff7ab7ac6 in Perl_runops_standard (my_perl=0x603010) at run.c:41
#18 0x00007ffff7a3f816 in S_run_body (oldscope=<optimized out>, my_perl=<optimized out>) at perl.c:2483
#19 perl_run (my_perl=0x603010) at perl.c:2406
#20 0x0000000000400c59 in main (argc=<optimized out>, argv=<optimized out>, env=<optimized out>) at perlmain.c:116

The DEFINE_STACK_OF OpenSSL manual notes:

    Care should be taken when accessing stacks in multi-threaded environments.
    Any operation which increases the size of a stack such as sk_TYPE_insert()
    or sk_push() can "grow" the size of an internal array and cause race
    conditions if the same stack is accessed in a different thread. Operations
    such as sk_find() and sk_sort() can also reorder the stack.

I've added a BuildConflict with perl-Net-SSLeay for now, and raised the issue with Net-SSLeay upstream (https://rt.cpan.org/Public/Bug/Display.html?id=118584). Not sure if it's an issue there or with AnyEvent itself really.

This was a bug in AnyEvent::Handle, in sub starttls:

  Net::SSLeay::CTX_set_mode ($tls, 1|2);
should have been:
  Net::SSLeay::set_mode ($tls, 1|2);

Issue diagnosed by Mike McCauley (upstream of Net::SSLeay)

Great. Mike's experience with Rawhide installation is quite disappointing.

I set him up with a VM on my own machine, which I installed using the Fedora Server 25 x86_64 DVD ISO and then switched to Rawhide using dnf system-upgrade. This was not without problems as I had to use --no-gpg-check because not all Rawhide packages are signed with the Fedora 26 key, if at all.