binary_to_term reductions occurs system crash.

[gbember]

Describe the bug
binary_to_term/1 trap after HeapFactory preallocation corrupts the off-heap list and crashes in sweep_off_heap

To Reproduce

Decode = fun() ->
        Bin = <<0,0,0,203,0,10,131,110,6,0,8,0,0,0,128,150,2,90,0,0,0,2,1,159,167,171,92,253,0,0,0,175,131,104,69,100,0,7,97,99,99,111,117,110,116,107,0,16,114,111,98,111,116,50,56,56,49,64,122,116,116,101,115,116,97,0,97,0,98,106,104,93,5,97,0,98,106,104,93,5,97,0,108,0,0,0,1,110,6,0,5,0,0,0,128,150,106,106,104,4,97,127,97,0,97,0,97,1,97,0,106,106,106,106,106,106,106,106,106,106,97,0,106,107,0,9,114,111,98,111,116,50,56,56,49,106,106,97,0,97,0,97,0,106,97,0,106,106,106,106,106,97,1,106,106,106,106,106,106,97,0,97,0,107,0,3,48,46,48,106,97,0,106,97,1,106,106,106,97,0,97,0,104,2,97,0,97,0,97,0,106,97,0,97,0,97,0,106,106,97,0,106,97,0,97,0,106,154,222,49,92,78>>,
        Ls = lists:seq(1, 100000),
        lists:map(fun(_) ->
            <<Size:32, Block:Size/binary, _Rest/binary>> = Bin,
            case Block of
                <<0:16, _/binary>> ->
                    ok;
                <<KSize:16, K:KSize/binary, _Mark:16, Vsn:32, Time:48, VSize:32, V:VSize/binary, _/binary>> ->
                    {binary_to_term(K), binary_to_term(V), Vsn, Time}
            end
        end, Ls),
        io:format("====done====~p~n", [self()])
    end,
    [spawn(Decode) || _ <- lists:seq(1, 30)].

Expected behavior
print 30 line: ====done====

Affected versions
Versions 26.2.5.15 and above of Erlang/OTP all have

otp_binary_to_term_trap_crash_issue.md

[gbember]

[sverker]

Fix #11425 merged to maint for OTP 29.1. Also planned for patches on 27 and 28.