Corruption of PAGE_BTR_IBUF_FREE_LIST

I received a 9GiB data set (3GiB compressed) that would trigger a crash in the debug build in the flst_validate() check during btr_page_alloc_for_ibuf().

In the system tablespace, the change buffer root page (page 4) would appear empty, but the PAGE_BTR_IBUF_FREE_LIST would contain 608 entries, instead of something like 1 entry (comprising only the empty root page). In the first entry that it would point to, the FLST_PREV was not the null address as expected. The linear forward scan of the list in flst_validate() would fail on the 601th iteration, attempting to access a FIL_NULL page and triggering a fatal error for an invalid page access. In other words, both the start and the end of the doubly-linked list were misplaced.

This corruption was successfully bypassed by SET GLOBAL innodb_change_buffering=none.

Unfortunately, I have no idea how that corruption would have come into existence in the first place.