RTS crash with STM

Summary

RTS often (but not always) crashes in certain situations involving STM. Most of the time it's a segmentation fault, but sometimes one of these internal errors:

• STACK object (0x42008ec000) entered!
• TVAR_WATCH_QUEUE object (0x42008ec020) entered!
• MVAR object (0x42008f0000) entered!
• TSO object (0x42008f4000) entered!
• MSG_TRY_WAKEUP object (0x42008e8000) entered!

Steps to reproduce

bug.cabal:

cabal-version: 2.4
name: bug
version: 0.1.0.0

executable bug
    main-is: Main.hs
    build-depends: base ^>=4.15.1.0, async, stm
    default-language: Haskell2010
    ghc-options:
        -threaded
        -rtsopts
        "-with-rtsopts=-N8"

Main.hs:

module Main where

import Control.Concurrent.Async
import Control.Concurrent.STM
import Control.Monad
import Numeric.Natural

main :: IO ()
main = do
    queue <- newTBQueueIO 1000010
    withAsync (readQueue queue) $ \_ -> mapConcurrently_ (replicateM_ 100000 . enqueue queue) "0123456789"
        
readQueue :: TBQueue a -> IO ()
readQueue queue = forever . atomically $ readTBQueue queue

enqueue :: TBQueue a -> a -> IO Natural
enqueue queue a = atomically $ do
    writeTBQueue queue a
    lengthTBQueue queue

If I remove the call to lengthTBQueue, or don't set the -N RTS option, or compile without threaded RTS, it doesn't crash.

Expected behavior

No crash.

Environment

• GHC version used: 9.0.2

Optional:

• Operating System: Nix 22.05 in Ubuntu 22.04.1 LTS (Linux 5.15.0-52-generic)
• System Architecture: Intel x86_64