Assertion failure in btr0pcur.cc line 510

Upgraded a long-running MariaDB 10.5.9 server to 10.6.4 and started getting crashes within a few days. The crash is reproducible with a single SQL query.

2021-11-15 18:22:26 0x1a63f467a40 InnoDB: Assertion failure in file /usr/obj/ports/mariadb-10.6.4/mariadb-10.6.4/storage/innobase/btr/btr0pcur.cc line 510
InnoDB: Failing assertion: page_is_comp(next_page) == page_is_comp(page)
InnoDB: We intentionally generate a memory trap.
InnoDB: Submit a detailed bug report to https://jira.mariadb.org/
InnoDB: If you get repeated assertion failures or crashes, even
InnoDB: immediately after the mariadbd startup, there may be
InnoDB: corruption in the InnoDB tablespace. Please refer to
InnoDB: https://mariadb.com/kb/en/library/innodb-recovery-modes/
InnoDB: about forcing recovery.
211115 18:22:26 [ERROR] mysqld got signal 6 ;
This could be because you hit a bug. It is also possible that this binary
or one of the libraries it was linked against is corrupt, improperly built,
or misconfigured. This error can also be caused by malfunctioning hardware.

To report this bug, see https://mariadb.com/kb/en/reporting-bugs

We will try our best to scrape up some info that will hopefully help
diagnose the problem, but since we have already crashed,
something is definitely wrong and this may fail.

Server version: 10.6.4-MariaDB-log
key_buffer_size=402653184
read_buffer_size=1048576
max_used_connections=95
max_threads=302
thread_count=98
It is possible that mysqld could use up to
key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 1947112 K bytes of memory
Hope that's ok; if not, decrease some variables in the equation.

Thread pointer: 0x1a61ab9e018
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 0x1a6330364b8 thread_stack 0x49000
??:0(my_print_stacktrace)[0x1a35cfa64bb]

Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (0x1a5ea38f030): SELECT `teams`.* FROM `teams` INNER JOIN `team_memberships` ON `teams`.`id` = `team_memberships`.`team_id` WHERE `team_memberships`.`is_pending` = FALSE AND `team_memberships`.`user_id` = 524905576757834439 AND `teams`.`enabled` = TRUE LIMIT 1

Connection ID (thread ID): 2664
Status: NOT_KILLED

Optimizer switch: index_merge=on,index_merge_union=on,index_merge_sort_union=on,index_merge_intersection=on,index_merge_sort_intersection=off,engine_condition_pushdown=off,index_condition_pushdown=on,derived_merge=on,derived_with_keys=on,firstmatch=on,loosescan=on,materialization=on,in_to_exists=on,semijoin=on,partial_match_rowid_merge=on,partial_match_table_scan=on,subquery_cache=on,mrr=off,mrr_cost_based=off,mrr_sort_keys=off,outer_join_with_cache=on,semijoin_with_cache=on,join_cache_incremental=on,join_cache_hashed=on,join_cache_bka=on,optimize_join_buffer_size=on,table_elimination=on,extended_keys=on,exists_to_in=on,orderby_uses_equalities=on,condition_pushdown_for_derived=on,split_materialized=on,condition_pushdown_for_subquery=on,rowid_filter=on,condition_pushdown_from_having=on,not_null_range_scan=off

A stack trace from another OpenBSD machine where I can reproduce the crash:

(gdb) bt -frame-arguments all full
#0 thrkill () at /tmp/-:3
No locals.
#1 0x00000efc7e0274ae in _libc_abort () at /usr/src/lib/libc/stdlib/abort.c:51
sa = {_sigaction_u = {_sa_handler = 0xefa76a63cc9, __sa_sigaction = 0xefa76a63cc9},
sa_mask = 2114294424, sa_flags = 3836}
mask = 4294967263
#2 0x00000efa777fbe6d in ut_dbg_assertion_failed(char const*, char const*, unsigned int) ()
No symbol table info available.
#3 0x00000efa776c2c48 in btr_pcur_move_to_next_page(btr_pcur_t*, mtr_t*) ()
No symbol table info available.
#4 0x00000efa777ba184 in row_search_mvcc(unsigned char*, page_cur_mode_t, row_prebuilt_t*, unsigned long, unsigned long) ()
No symbol table info available.
#5 0x00000efa77621496 in ha_innobase::index_read(unsigned char*, unsigned char const*, unsigned int, ha_rkey_function) ()
No symbol table info available.
#6 0x00000efa76ff364b in handler::index_read_idx_map(unsigned char*, unsigned int, unsigned char const*, unsigned long, ha_rkey_function) ()
No symbol table info available.
#7 0x00000efa76feb951 in handler::ha_index_read_idx_map(unsigned char*, unsigned int, unsigned char const*, unsigned long, ha_rkey_function) ()
No symbol table info available.
#8 0x00000efa7734831d in join_read_const(st_join_table*) ()
No symbol table info available.
#9 0x00000efa77347dad in join_read_const_table(THD*, st_join_table*, POSITION*) ()
No symbol table info available.
#10 0x00000efa77316c6e in JOIN::optimize_inner() ()
No symbol table info available.
#11 0x00000efa7730e75f in JOIN::optimize() ()
No symbol table info available.
#12 0x00000efa773085e1 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) ()
No symbol table info available.
#13 0x00000efa773084b9 in handle_select(THD*, LEX*, select_result*, unsigned long) ()
No symbol table info available.
#14 0x00000efa772d1b4b in execute_sqlcom_select(THD*, TABLE_LIST*) ()
No symbol table info available.
#15 0x00000efa772cc5cb in mysql_execute_command(THD*, bool) ()
No symbol table info available.
#16 0x00000efa772c700a in mysql_parse(THD*, char*, unsigned int, Parser_state*) ()
No symbol table info available.
#17 0x00000efa772c4b9e in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool)
()
No symbol table info available.
#18 0x00000efa772c751c in do_command(THD*, bool) ()
No symbol table info available.
#19 0x00000efa7740812e in do_handle_one_connection(CONNECT*, bool) ()
No symbol table info available.
-Type <RET> for more, q to quit, c to continue without paging-
#20 0x00000efa77407f08 in handle_one_connection ()
No symbol table info available.
#21 0x00000efa77583c12 in pfs_spawn_thread ()
No symbol table info available.
#22 0x00000efc88344651 in _rthread_start (v=<optimized out>)
at /usr/src/lib/librthread/rthread.c:96
thread = <optimized out>
retval = <optimized out>
#23 0x00000efc7e0012ea in __tfork_thread () at /usr/src/lib/libc/arch/amd64/sys/tfork_thread.S:84
No locals.