Wrong simplifier substitution? (Core Lint error)

I've been rebasing !2900 (closed) on HEAD for quite some time now. Until the latest rebase, it was passing CI successfully. Now I get a Core Lint error and I don't think my patch is responsible for it.

Built with: ./validate --legacy

The Core Lint error:

*** Core Lint errors : in result of Simplifier ***
compiler/GHC/CmmToAsm.hs:393:5: warning:
    Non-function type in function position
    Fun type: Platform
    Arg type: [[CLabel]]
    Arg: ys_adYh
    In the RHS of nativeCodeGen_siul :: forall {a}.
    [...]
    In a case alternative: (Platform ds10_su1N :: PlatformMini,
                                     ds11_su1O :: PlatformWordSize,
                                     ds12_su1P :: ByteOrder,
                                     ds13_su1Q :: Bool,
                                     ds14_su1R :: Bool,
                                     ds15_su1S :: Bool,
                                     ds16_su1T :: Bool,
                                     ds17_su1U :: Bool)
    In the RHS of d1_sfdX :: SDoc
    In a case alternative: (Platform ww20_su1D :: PlatformMini,
                                     ww21_su1E :: PlatformWordSize,
                                     ww22_su1F :: ByteOrder,
                                     ww23_su1G :: Bool,
                                     ww24_su1H :: Bool,
                                     ww25_su1I :: Bool,
                                     ww26_su1J :: Bool,
                                     ww27_su1K :: Bool)
    In a case alternative: (PlatformMini ww29_acIC :: Arch,
                                         ww30_acID :: OS)
    In a case alternative: (True)
    In the body of letrec with binders arg_suA9 :: [(CLabel, String)]
                                                   -> SDoc
    In a case alternative: (: y_adYg :: [CLabel],
                              ys_adYh :: [[CLabel]])
    In the RHS of z_X1v :: [(CLabel, String)]
    Substitution: [TCvSubst
                     In scope: InScope {a_abed}
                     Type env: []
                     Co env: []]

Indeed we find this totally bogus binding:

let {
  z_X1v
    :: [(CLabel,
         String)]
  [LclId,
   Unf=Unf{Src=<vanilla>,
           TopLvl=False,
           Value=True,
           ConLike=True,
           WorkFree=True,
           Expandable=True,
           Guidance=IF_ARGS [] 10 100}]
  z_X1v
    = Platform
        ds10_su1N
        ds11_su1O
        ds12_su1P
        ds13_su1Q
        ds14_su1R
        ds15_su1S
        ds16_su1T
        ds17_su1U
        ys_adYh } in

Platform is a DataCon with arity 8 and it's applied 9 arguments

More context (I can provide the full trace if needed):

case ds_ddVH
of {
  [] ->
    map
      @[(CLabel,
         String)]
      @SDoc
      arg_suCO
      (groupBy
         @(CLabel,
           String)
         lvl_sfJN
         (sortBy
            @(CLabel,
              String)
            lvl_sfJO
            ([]
               @(CLabel,
                 String))));
  : y_adYg [Dmd=<S,U>]
    ys_adYh ->
    let {
      z_X1v
        :: [(CLabel,
             String)]
      [LclId,
       Unf=Unf{Src=<vanilla>,
               TopLvl=False,
               Value=True,
               ConLike=True,
               WorkFree=True,
               Expandable=True,
               Guidance=IF_ARGS [] 10 100}]
      z_X1v
        = Platform
            ds10_su2L
            ds11_su2M
            ds12_su2N
            ds13_su2O
            ds14_su2P
            ds15_su2Q
            ds16_su2R
            ds17_su2S
            ys_adYh } in
    letrec {
      go_X1w [Occ=LoopBreaker]
        :: [CLabel]
           -> [(CLabel,
                String)]
      [LclId,
       Arity=1,
       Str=<S,U>,
       Unf=Unf{Src=<vanilla>,
               TopLvl=False,
               Value=True,
               ConLike=True,
               WorkFree=True,
               Expandable=True,
               Guidance=IF_ARGS [30] 170 30}]
      go_X1w
        = \ (ds_X1x
               :: [CLabel]) ->
            case ds_X1x
            of {
              [] ->
                z_X1v;
              : y_X1z
                ys_X1A ->
                : @(CLabel,
                    String)
                  (y_X1z,
                   fullRender
                     @String
                     PageMode
                     lvl_sfJR
                     $fShowDoc2
                     txtPrinter
                     ([]
                        @Char)
                     (((pprCLabel
                          dflags_XQ
                          y_X1z)
                       `cast` (N:SDoc[0]
                               :: SDoc
                                  ~R# (SDocContext
                                       -> Doc)))
                        ctx_sfJQ))
                  (go_X1w
                     ys_X1A)
            }; } in
    map
      @[(CLabel,
         String)]
      @SDoc
      arg_suCO
      (groupBy
         @(CLabel,
           String)
         lvl_sfJN
         (sortBy
            @(CLabel,
              String)
            lvl_sfJO
            (go_X1w
               y_adYg)))
})))

This bug seems to have been introduced with 4291bdda ("Major improvements to the specialiser").

How to reproduce

> git remote add hsyl20 https://gitlab.haskell.org/hsyl20/ghc
> git fetch hsyl20
> git checkout hsyl20/hsyl20-dynflags-runtime
> ./validate --legacy