Server crashes at filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long)

PoC:

UPDATE v44422 AS x0 SET v44423 = 1 ORDER BY COUNT(v44423);

docker log:

Thread pointer: 0x760850000c68
stack_bottom = 0x7608841af000 thread_stack 0x49000
Printing to addr2line failed
mariadbd(my_print_stacktrace+0x30)[0x5da297d800d0]
mariadbd(handle_fatal_signal+0x1f3)[0x5da2978e59d3]
/lib/x86_64-linux-gnu/libc.so.6(+0x45330)[0x760899fb5330]
mariadbd(_Z8filesortP3THDP5TABLEP8FilesortP16Filesort_trackerP4JOINy+0x382)[0x5da2978dee42]
mariadbd(_ZN14Sql_cmd_update19update_single_tableEP3THD+0xbfb)[0x5da2976f034b]
mariadbd(_ZN14Sql_cmd_update13execute_innerEP3THD+0x183)[0x5da2976f20f3]
mariadbd(_ZN11Sql_cmd_dml7executeEP3THD+0xcd)[0x5da29765abed]
mariadbd(_Z21mysql_execute_commandP3THDb+0xe43)[0x5da2975c5643]
mariadbd(_Z11mysql_parseP3THDPcjP12Parser_state+0x19a)[0x5da2975c935a]
mariadbd(_Z16dispatch_command19enum_server_commandP3THDPcjb+0x1064)[0x5da2975cbcf4]
mariadbd(_Z10do_commandP3THDb+0x199)[0x5da2975cd219]
mariadbd(_Z24do_handle_one_connectionP7CONNECTb+0x6b3)[0x5da29775ec93]
mariadbd(handle_one_connection+0x71)[0x5da29775f0d1]
mariadbd(+0xdf947e)[0x5da297b2547e]
/lib/x86_64-linux-gnu/libc.so.6(+0x9caa4)[0x76089a00caa4]
/lib/x86_64-linux-gnu/libc.so.6(__clone+0x44)[0x76089a099a34]

Connection ID (thread ID): 3
Status: NOT_KILLED
Query (0x7608500354f0): UPDATE v44422 AS x0 SET v44423 = v44423 * 5000 WHERE v44423 = 'Workflow' AND v44423 = 1 ORDER BY COUNT(v44423), SUM(x0.v44423) LIMIT 2

Optimizer switch: index_merge=on,index_merge_union=on,index_merge_sort_union=on,index_merge_intersection=on,index_merge_sort_intersection=off,index_condition_pushdown=on,derived_merge=on,derived_with_keys=on,firstmatch=on,loosescan=on,duplicateweedout=on,materialization=on,in_to_exists=on,semijoin=on,partial_match_rowid_merge=on,partial_match_table_scan=on,subquery_cache=on,mrr=off,mrr_cost_based=off,mrr_sort_keys=off,outer_join_with_cache=on,semijoin_with_cache=on,join_cache_incremental=on,join_cache_hashed=on,join_cache_bka=on,optimize_join_buffer_size=on,table_elimination=on,extended_keys=on,exists_to_in=on,orderby_uses_equalities=on,condition_pushdown_for_derived=on,split_materialized=on,condition_pushdown_for_subquery=on,rowid_filter=on,condition_pushdown_from_having=on,not_null_range_scan=off,hash_join_cardinality=on,cset_narrowing=on,sargable_casefold=on

Writing a core file...
Working directory at /var/lib/mysql
Resource Limits (excludes unlimited resources):
Limit Soft Limit Hard Limit Units
Max stack size 8388608 unlimited bytes
Max processes 4127167 4127167 processes
Max open files 524288 524288 files
Max locked memory 8388608 8388608 bytes
Max pending signals 4127167 4127167 signals
Max msgqueue size 819200 819200 bytes
Max nice priority 0 0
Max realtime priority 0 0
Core pattern: /var/lib/coredumps/core-%e-sig%s-user%u-group%g-pid%p-time%t

Kernel version: Linux version 6.5.13-5-pve (build@proxmox) (gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40) #1 SMP PREEMPT_DYNAMIC PMX 6.5.13-5 (2024-04-05T11:03Z)