Lock-free reads first open a storage engine snapshot and later check that the shard version the router sent matches the installed one. Because there's no shardVersion check before opening the snapshot, the snapshot could correspond to a different sharding placement. This will cause the query to not notice a placement mismatch or to be executed with a sharding filter that does not match the storage engine snapshot.