ah. I suspect that explains the sporadic nature as well: normally there
is 'some' object at the list address, just with an invalid type.
The invalid type only gets visible as a hard crash if due to PAGEALLOC
the structure sizes and kmalloc/slab details cause the invalid access to
go to a not yet allocated page. (and then it crashes there)
And that in itself is a rather unlikely and fragile condition (it might
even depend on timings of various allocations), that's why the bug wasnt
really reproducible deterministically.