Reproducer attached. The dumpOplog library uses a reverse cursor and when it loops around, the server hits this invariant in  reportOutOfOrderRead. After hacking out the crash, we can clearly see from the returned documents that WT looped around.