Sorry, maybe it was a bad example.
Here is a much more minimal config that you can run directly.
https://pastebin.com/x775E7iF
For me, it crashes almost immediately after starting.
It actually calls nxsem_checkholder() many, many times before it finally
triggers the KAZAN failure.
Trying again with 4ff4562401401a3a86c74cb2bda9a1a2b8d94e6d and it moves
along.
That just removes the call to nxsched_get_tcb() that triggers the KAZAN
failure. It is really not otherwise related to the failure as far as I
can tell.
It appears that that the change generates the right condition to produce
a failure from some existing problem. But I might be missing
something. Maybe you or someone on the list can add some insight.