Debug/ASAN mongos fatals with 40474 when forwarding a sampled count or distinct whose client command already has includeQueryStatsMetrics: IDL toBSON() emits the field once, then mongos appends {{

}} onto that BSON, which never replaces. The duplicate append has been there since query stats were added to these commands (SERVER-90656 / SERVER-107427); it started failing regularly after SERVER-76892 removed featureFlagQueryStatsCountDistinct (2026-08-18), because sampled router count/distinct always register query stats and take that append path. That matches jstestfuzz_concurrent_sharded (sample rate 1.0), first seen around 2026-08-21.