I am still working on understanding the crash. Seems that maybe we tried reading from a deleted connection? (I cannot understand how possible from the code though, since as far as I can tell the code path nullifying the connections and establish new connection on retries.. )

There is also another fail in the valgrind test, which seems related to the fact that the replica <-> primary is timing out. maybe just increase the repl-timeout in case of valgrind run identification.

So we were able to track down the reason for the crash:

during Dual channel load the replica maintains 2 connections with the primary - repl_transfer_s, in order to read the psync data from the primary and repl_rdb_transfer_s for the rdb data transfer. when the replica is loading the data to via socket, it is in a tight loop inside rdbLoadRioWithLoadingCtx. in Case the network with the primary is lost it will usually be identified on repl_rdb_transfer_s connection while reading the data from the socket in rioRead.
However in some cases it is possible that the disconnection is identified on the repl_transfer_s first during the loading phase. This can happen while we free the CPU to process some Epoll events in rdbLoadProgressCallback. In this case we identified the repl_transfer_s was disconnected during the rdbLoadProgressCallback and thus we cleanup all Replication connections and state in cancelReplicationHandshake which also closes and cleanup the repl_rdb_transfer_s in replicationAbortDualChannelSyncTransfer. this, however will then return to the rdbLoadRioWithLoadingCtx loop and attempt another rioRead on the rio connection which was never nullified or indicated as freed.

One possible fix is to add a flag to rio which indicates it should abort ASAP (which means on the next io operation)