This wouldn't surprise me at all.
I think we can make some headway on this bug, the next time
you trigger it, if the list debugging was a little less terse.
For example, a backtrace and perhaps even feeding the bad list
pointers in question to the SLAB/SLUB debug helpers that can
identify a kmem cache from a given pointer would help.
Thanks.
-