c608b65ef5
?yieldtrace shows the crash occurs with zero compiled-TB DONE_FLAG resume re-entries, so it is not the store block-replay path. Combined with nondeterminism and identity-independence, the corruption is a guest-RAM data race with concurrent device/timer callbacks. Blanket store-TCI stays default.