Now I notice there's another report for firmware_parser_create+0xa9b/0xd90.
What does faddr2line say for that?

Though it's weird that KASAN claims the memory written in
firmware_parser_create was freed from rcu_cpu_kthread. If that's accurate[0],
it might indicate a lower level issue.

[0] There is some doubt about that due to the "Frankenkernel monster". :) Does
enabling CONFIG_DEBUG_INFO_REDUCED as well allow you to keep debugging symbols
for everything, or at least for the vmlinuz image?