The Player crashes on "MemoryManager::Deallocate"

Reproduction steps:
1. Open the attached “CrashTest” project
2. Build and install the app on the device
3. Run the app and wait until you see "0 remaining", and close the app (from the recent apps screen)
4. Repeat the 3rd step 10 times

Expected result: The Player doesn’t crash
Actual result: The Player crashes

Reproducible with: 2022.3.26f1
Not reproducible with: 2021.3.40f1, 2022.3.36f1, 6000.0.9f1
Fixed in: 2022.3.27f1

Reproducible with these devices:
Google Pixel 6 (Android 14) (user’s)
VLNQA00460 - Google Pixel 6 (Pixel 6), CPU: Google Tensor (Whitechapel), GPU: Mali-G78, OS: 14

Not reproducible with these devices:
VLNQA00518 - Google Pixel 4 (Pixel 4), CPU: Snapdragon 855 SM8150, GPU: Adreno 640, OS: 13
VLNQA00414 - Galaxy Note10+ 5G (SM-N976V), CPU: Snapdragon 855 SM8150, GPU: Adreno 640, OS: 9
VLNQA00591 - Samsung Galaxy S23 (SM-S911B), CPU: Snapdragon 8 Gen 2 (SM8550), GPU: Adreno 740, OS: 14
VLNQA00278 - Xiaomi Redmi Note 7 (Redmi Note 7), CPU: Snapdragon 660, GPU: Adreno 512, OS: 9.0.0
VLNQA00139 - Vivo Xplay6 (vivo Xplay6), CPU: Snapdragon 820 MSM8996, GPU: Adreno 530, OS: 7.1.1
VLNQA00132 - Xiaomi Mi 5s (MI 5s), CPU: Snapdragon 820 MSM8996, GPU: Adreno 530, OS: 6.0.1

Testing environment: macOS 14.5 (Intel), Windows 11 23H2 (22631.3007), macOS 14.3.1 (M1) (by user)
Not reproducible on: No other environment tested

Notes:

• Reproduction is inconsistent, repeat the process many times
• Didn’t find the regression as the reproduction is inconsistent

A few lines of the crash stacktrace:

2024/07/07 19:40:21.322 16191 CRASH       #02 pc 00000000003fc0c0 (MemoryManager::Deallocate(void*, char const*, int) at ??:0)
2024/07/07 19:40:21.322 16191 CRASH       #03 pc 00000000003fc318 (MemoryManager::Deallocate(void*, MemLabelId const&, char const*, int) at ??:0) 
2024/07/07 19:40:21.322 16191 CRASH       #04 pc 00000000006bb54c (Il2cppMemoryWrapper::Deallocate(void*) 
2024/07/07 19:40:21.322 16191 CRASH       #05 pc 00000000014730d4 (free_gptr_array(MonoGPtrArray*)