It's legal to have Gtid_list_log_event inside a group. E.g
{{Gtid_event, Gtid_log_list_event, ... }} is permitted.
However, the slave IO thread treated both and Gtid_log_list_event specifically (see how to repeat)
as the terminal even when the group represents a DDL query.
That causes a premature Gtid state update so the slave IO would think
the whole group has been collected while in fact ... the actual terminal events are yet to be seen and process.

How to reproduce requires a 10.9 test:
./mtr rpl_mysqlbinlog_slave_consistency.test