Something is garbage here. The type pointer is 0x43d78e, which is not a valid pointer. Type pointers should always be 8-byte aligned. There's no indication where reflect.(*rtype).Len gets its argument - everything else in that trace is runtime functions, which can't call into reflect.
I'm not sure there's more we can do here without a reproducer.
I would recommend running the race detector, and auditing any uses of unsafe.