The issue is related to the SLUB redzoning feature in the Linux kernel, which checks for corruption from `s->object size` instead of `s->inuse`. This can cause the freelist pointer to be written beyond `s->object size` when the object size is less than 24, corrupting the redzone. The problem is visible when using "slub debug=ZF". The kernel adjusts the offset to stay within `s->object size` to resolve the issue. No caches in this size range are known to exist in the kernel currently.