was it really in frame 0 within `tls_complete_init` ? your `bt all` shows `dom` local variable in the frame.
another strangeness is that pointers to the `cfg` and `data` are equal. `data` is freshly allocated and could get this address if `cfg` is freed in another place so at the first glance looks like issues with reference in `cfg->ref_count`.
do you use TLS configuration reloads in runtime?