In WiredTiger's page materialization code at src/third_party/wiredtiger/src/btree/bt_page.c:1421-1430, each child WT_REF's internal/leaf flag is derived solely from the parent's on-disk address cell type (WT_CELL_ADDR_LEAF → WT_REF_FLAG_LEAF), with no cross-validation against the actual child page type at read time. Only the offline wt verify path (bt_vrfy.c:982-1000) checks this invariant. When a corruption causes a parent address cell claiming ADDR_LEAF (0x20) for a child that is physically WT_PAGE_ROW_INT (type 6), the child ref is flagged as a leaf. During eviction, __evict_review at evict_page.c:1030 gates the __evict_child_check call behind F_ISSET(ref, WT_REF_FLAG_INTERNAL), so the flag mismatch causes this safety check to be skipped entirely. Eviction proceeds and __free_page_int at bt_discard.c:413-414 walks the actual page type, recognizes an internal page, and frees all child WT_REFs. A concurrent __wt_row_search at row_srch.c:433 still holds a pointer to one of those freed 48-byte WT_REF structures and dereferences it, producing a heap-use-after-free.

This is the WiredTiger ticket for the issue originally tracked as SERVER-135624