it looks like it's taking the normal, non-deferred overlay path, and failing when it runs the callback to create an overlay.  normally, i'd say that the callback is null from the error, but it checks that explicitly.

it also looks like it's taking the pre-M path, where switching between overlays and not isn't allowed.  however, the crashes all seem to be from M.

~65k crashes are from the sony bravia 2015 -- so wait, that's atv not generic cast.  there was a workaround for atv specifically, so maybe this is just the aftermath of that.

turns out atv is already aware of this, and it's fixed in atv 1.28.  sorry for the churn.