Currently the page allocator's allocToCache method can update the search address in such a way that it doesn't point into memory contained in pageAlloc.inUse, which violates a documented property.
The result of this is an occasional crash. A similar bug was fixed prior to the Go 1.14 release with https://golang.org/cl/216697, but that failed to take into account allocToCache. This is causing real failures and we should fix it ASAP. We should also backport it as there is no workaround available when you do run into it.