It turned out to be a low-level bug in glibc: https://sourceware.org/bugzilla/show_bug.cgi?id=10797
It got fixed five years later, long after I had worked around it and left the job where I found the bug.