More than 100 cases opened at Citrix for the AAA daemon crashing and subsequent crash of the NetScaler. Please enact the policy @Jason Symczak posted above ASAP.

Do we need to enable that policy if we're not using SAML VIPs?

I would say no. It does seem to be affecting SAML only.

We have two of them so far - started with the 13.1's but that may have just been timing, now the 14.1's are starting to go

just confirming, bind the responder policy in the following places: 1. Netscaler Gateway vServers with SAML 2. AAA Auth vservers 3. ?

Correct. And it affects SAML only.

im still getting bounced, but I'm afraid I missed a step

Are you sure you have bound it to all authentication and ssl vservers?

like every LBVS? I did it everywhere I know SAML is used

Do a "show authentication vserver" and a "show vpn vserver" and see if there is an unexpected one. Also, do you have a ticket open?

got it thank you. no I dont have a ticket, been piggy backing off everyone else