Error or assertion is logged when setting managedReferenceValue on a SerializedObject with multiple targets

How to reproduce:

1. Open the attached "IN-155738" project
2. In the menu bar, select "Repro" > "Replace managed reference on multiple objects"
3. Observe the Console

Actual result: "Assertion failed on expression: 'referencedObjectOffset + std::max(newProperty.iterator->m_ByteSize, 0) <= m_Data->size()'" is logged when the managed reference is applied to two targets
Expected result: No errors or assertions are logged

Reproducible with: 6000.0.0f1, 6000.0.84f1, 6000.3.26f1, 6000.6.5f1, 6000.7.0b3, 7000.0.0a5

Reproducible on: Windows 11 Enterprise (25H2)
Not reproducible on: No other environments tested

Notes:

• In 6000.7.0a5 and older, only the error "Invalid reference data for SerializedProperty..." is logged. In 6000.7.0a6 and newer, only the assertion is logged
• When the field is empty and gets a value, or has a value and is set to null, on two objects at once, only the first object is changed and the second keeps its old value. Nothing is logged in the Console (tested in 6000.0.0f1, 6000.0.84f1, 6000.3.26f1, 6000.6.5f1, 6000.7.0b3, 7000.0.0a5)
• Does not reproduce when the SerializedObject edits only one object. Setting the same new value on a single object logs no errors or assertions