
Bitcoin v22.0, tested on both self compiled and official release
First of all, this happens on **regtest** only.

How to reproduce: 
- run regtest instance of btc
```
$ bitcoin-cli -named createwallet wallet_name=wallet descriptors=true blank=true
$ cat regtest-descriptors.txt
[
  {
    "desc": "tr([e4445899/49'/1'/0']tprv8ZgxMBicQKsPd8jCeBWsYLEoWxbVgzJDatJ7XkwQ6G3uF4FsHuaziHQ5JZAW4K515nj6kVVwPaNWZSMEcR7aFCwL4tQqTcaoprMKTTtm6Zg/1/*)#mr3llm7f",
    "timestamp": 1634652324,
    "active": true,
    "internal": true,
    "range": [
      0,
      999
    ],
    "next": 0
  }
]
$ bitcoin-cli importdescriptors "$(cat regtest-descriptors.txt)"
``` 

gdb log:
```
Starting program: /usr/local/bin/bitcoind > debug.log
warning: Error disabling address space randomization: Operation not permitted
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[New Thread 0x7f111c182700 (LWP 2672)]
[New Thread 0x7f111b981700 (LWP 2673)]
[New Thread 0x7f111b180700 (LWP 2674)]
[New Thread 0x7f111a97f700 (LWP 2675)]
[New Thread 0x7f111a17e700 (LWP 2676)]
[New Thread 0x7f111997d700 (LWP 2677)]
[New Thread 0x7f111917c700 (LWP 2678)]
[New Thread 0x7f111897b700 (LWP 2679)]
[New Thread 0x7f10fbfff700 (LWP 2680)]
[New Thread 0x7f10fb7fe700 (LWP 2681)]
[New Thread 0x7f10faffd700 (LWP 2682)]
[New Thread 0x7f10fa7fc700 (LWP 2683)]
[New Thread 0x7f10f9ffb700 (LWP 2684)]
[New Thread 0x7f10f96be700 (LWP 2685)]
[Thread 0x7f10f96be700 (LWP 2685) exited]
[New Thread 0x7f10f8ebd700 (LWP 2686)]
[New Thread 0x7f10dffff700 (LWP 2687)]
[New Thread 0x7f10df7fe700 (LWP 2688)]
[Thread 0x7f10dffff700 (LWP 2687) exited]
[New Thread 0x7f10deffd700 (LWP 2689)]
[New Thread 0x7f10de7fc700 (LWP 2690)]

Thread 13 "b-httpworker.2" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7f10fa7fc700 (LWP 2683)]
CWallet::KeypoolCountExternalKeys (this=0x7f10e0024040) at wallet/wallet.cpp:2104
2104    wallet/wallet.cpp: No such file or directory.
#0  CWallet::KeypoolCountExternalKeys (this=0x7f10e0024040) at wallet/wallet.cpp:2104
#1  0x0000563a086e76a3 in <lambda(const RPCHelpMan&, const JSONRPCRequest&)>::operator()(const JSONRPCRequest &, const RPCHelpMan &) (request=..., self=..., __closure=<optimized out>)
    at /usr/include/c++/8/bits/shared_ptr_base.h:1018
#2  0x0000563a086e8464 in std::_Function_handler<UniValue(const RPCHelpMan&, const JSONRPCRequest&), getwalletinfo()::<lambda(const RPCHelpMan&, const JSONRPCRequest&)> >::_M_invoke(const std::_Any_data &, const RPCHelpMan &, const JSONRPCRequest &) (__functor=..., __args#0=..., __args#1=...) at /usr/include/c++/8/bits/std_function.h:88
#3  0x0000563a0880a352 in std::function<UniValue (RPCHelpMan const&, JSONRPCRequest const&)>::operator()(RPCHelpMan const&, JSONRPCRequest const&) const (__args#1=..., __args#0=..., 
    this=0x7f10fa7fa700) at /usr/include/c++/8/bits/std_function.h:682
#4  RPCHelpMan::HandleRequest (this=this@entry=0x7f10fa7fa6e0, request=...) at rpc/util.cpp:575
#5  0x0000563a084ecf4e in CRPCCommand::CRPCCommand(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, RPCHelpMan (*)())::{lambda(JSONRPCRequest const&, UniValue&, bool)#1}::operator()(JSONRPCRequest const&, UniValue&, bool) const (__closure=<optimized out>, request=..., result=...) at ./rpc/server.h:110
#6  0x0000563a086726f8 in std::function<bool (JSONRPCRequest const&, UniValue&, bool)>::operator()(JSONRPCRequest const&, UniValue&, bool) const (__args#2=<optimized out>, __args#1=..., 
    __args#0=..., this=<optimized out>) at /usr/include/c++/8/bits/std_function.h:682
#7  wallet::(anonymous namespace)::WalletClientImpl::<lambda(const JSONRPCRequest&, UniValue&, bool)>::operator()(const JSONRPCRequest &, UniValue &, bool) const (
    __closure=0x563a0a0ed950, request=..., result=..., last_handler=<optimized out>) at wallet/interfaces.cpp:516
#8  0x0000563a0846fdf3 in std::function<bool (JSONRPCRequest const&, UniValue&, bool)>::operator()(JSONRPCRequest const&, UniValue&, bool) const (__args#2=<optimized out>, __args#1=..., 
    __args#0=..., this=<optimized out>) at /usr/include/c++/8/bits/std_function.h:682
#9  node::(anonymous namespace)::RpcHandlerImpl::<lambda(const JSONRPCRequest&, UniValue&, bool)>::operator() (last_handler=true, result=..., request=..., __closure=<optimized out>)
    at node/interfaces.cpp:397
#10 std::_Function_handler<bool(const JSONRPCRequest&, UniValue&, bool), node::(anonymous namespace)::RpcHandlerImpl::RpcHandlerImpl(const CRPCCommand&)::<lambda(const JSONRPCRequest&, UniValue&, bool)> >::_M_invoke(const std::_Any_data &, const JSONRPCRequest &, UniValue &, bool &&) (__functor=..., __args#0=..., __args#1=..., __args#2=<optimized out>)
    at /usr/include/c++/8/bits/std_function.h:282
#11 0x0000563a08570a1e in std::function<bool (JSONRPCRequest const&, UniValue&, bool)>::operator()(JSONRPCRequest const&, UniValue&, bool) const (__args#2=<optimized out>, __args#1=..., 
    __args#0=..., this=0x563a0a0ed9e8) at /usr/include/c++/8/bits/std_function.h:682
#12 ExecuteCommand (command=..., request=..., result=..., last_handler=<optimized out>) at rpc/server.cpp:480
#13 0x0000563a08571408 in ExecuteCommands (commands=std::vector of length 1, capacity 1 = {...}, request=..., result=...) at /usr/include/c++/8/bits/stl_iterator.h:844
#14 0x0000563a085718e8 in CRPCTable::execute (this=0x563a08c35260 <tableRPC>, request=...) at rpc/server.cpp:464
#15 0x0000563a08630c04 in HTTPReq_JSONRPC (context=..., req=0x7f10f00022f0) at httprpc.cpp:202
#16 0x0000563a08634b99 in std::function<bool (HTTPRequest*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&)>::operator()(HTTPRequest*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) const (__args#1="", __args#0=<optimized out>, this=0x7f10f0001060) at /usr/include/c++/8/bits/std_function.h:682
#17 HTTPWorkItem::operator() (this=0x7f10f0001030) at httpserver.cpp:49
#18 WorkQueue<HTTPClosure>::Run (this=0x563a0a0de5e0) at httpserver.cpp:107
#19 HTTPWorkQueueRun (queue=0x563a0a0de5e0, worker_num=<optimized out>) at httpserver.cpp:335
#20 0x00007f111ea90b2f in ?? () from /usr/lib/x86_64-linux-gnu/libstdc++.so.6
#21 0x00007f111f1a9fa3 in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0
#22 0x00007f111e7704cf in clone () from /lib/x86_64-linux-gnu/libc.so.6
```

full debug log https://pastebin.com/9nz6xi5V
bool CWaet::ImportPrivKeys(const std::map<CKeyID, CKey>& privkey_map, const int64_t timestamp)
{
    auto spk_man = GetLegacyScriptPubKeyMan();
    if (!spk_man) {
        return false;
    }
    LOCK(spk_man->cs_KeyStore);
    return spk_man->ImportPrivKeys(privkey_map, timestamp);
}
bool CWaet::ImportPubKeys(const std::vector<CKeyID>& ordered_pubkeys, const std::map<CKeyID, CPubKey>& pubkey_map, const std::map<CKeyID, std::pair<CPubKey, KeyOriginInfo>>& key_origins, const bool add_keypool, const bool internal, const int64_t timestamp)
{
    auto spk_man = GetLegacyScriptPubKeyMan();
    if (!spk_man) {
        return false;
    }
    LOCK(spk_man->cs_KeyStore);
    return spk_man->ImportPubKeys(ordered_pubkeys, pubkey_map, key_origins, add_keypool, internal, timestamp);
}
bool CWaet::ImportScriptPubKeys(const std::string& label, const std::set<CScript>& script_pub_keys, const bool have_solving_data, const bool apply_label, const int64_t timestamp)
{
    auto spk_man = GetLegacyScriptPubKeyMan();
    if (!spk_man) {
        return false;
    }
    LOCK(spk_man->cs_KeyStore);
    if (!spk_man->ImportScriptPubKeys(script_pub_keys, have_solving_data, timestamp)) {
        return false;
    }
    if (apply_label) {
        WaetBatch batch(GetDatabase());