These reveal that value_to_lisp eventually returns a corrupted string,
but I don't know why.  I've seen comments in src/fileio.c referring to
string-relocation during GC; could this be at play here?  Either way, do
you have any suggestions on how to proceed?

Here's the full recipe again, now with debugging symbols for the module:

0. git clone https://gitlab.com/basil-conto/realpath.git
1. cd realpath
2. make DEBUG=1
3. cd /path/to/emacs/src
4. gdb emacs
5. set logging on
6. r -Q --module-assertions
7. (progn (module-load "/path/to/realpath.so")
          (dotimes (_ 1000)
            (realpath-truename user-emacs-directory)))
   C-j

   [The loop usually trips the assertions on its first run, but if it
    doesn't, just try again once or twice.]

8. bt full
9. f 2
10. p p
11. pr [#<INVALID_LISP_OBJECT 0x03059c90>]
12. xpr

I attach the resulting GDB log.

Thanks,

-- 
Basil