Found from the investigation of WT-14542, I identified a cursor caching problem for special cursors such as version cursor. Here is the code:

if (owner == NULL)

{ __wt_cursor_get_hash(session, uri, NULL, &hash_value); if ((ret = __wt_cursor_cache_get(session, uri, hash_value, NULL, cfg, cursorp)) == 0) return (0); WT_RET_NOTFOUND_OK(ret); }

Theoretically speaking the if condition is not needed. If we set the WT_CURSTD_CACHEABLE correctly, we can ensure that any cursor fetched from the cache is valid. This is largely true expect for special cursors.

In the case of version cursor:

• The version cursor opens a history store cursor which fetches it from the cache
• Because it is fetched from the cache, connection->close() will close the child cursor.
• The version cursor does a double free because doesn't expect it to be freed already.

There are two fixes:
(1) Properly disable all child/owner cursors
(2) Expect that history store cursors be closed underneath.
In ASC we disallow caching owners with children