Comment 7 for bug 1923325

If it helps, I was able to debug the executable
./src/runtime/sbcl --core output/cold-sbcl.core --lose-on-corruption $SBCL_MAKE_TARGET_2_OPTIONS --no-sysinit --no-userinit --eval '(sb-fasl::!warm-load "src/cold/warm.lisp")' --quit

Before it crashes, these are the stack traces

689
690 /* Doing this immediately after the core has been located
691 * and before any random malloc() calls occur improves the chance
692 * of mapping dynamic space at our preferred address (if movable).
693 * If not movable, it was already mapped in allocate_spaces(). */
694 initial_function = load_core_file(core, embedded_core_offset,
695 merge_core_pages);
696 if (initial_function == NIL) {
697 lose("couldn't find initial function");
698 }

Then inside load_core_file,
1044 case BUILD_ID_CORE_ENTRY_TYPE_CODE:
1045 stringlen = *ptr++;
1046 --remaining_len;
1047 gc_assert(remaining_len * sizeof (core_entry_elt_t) >= stringlen);
1048 if (stringlen+1 != sizeof build_id || memcmp(ptr, build_id, stringlen))
1049 lose("core was built for runtime \"%.*s\" but this is \"%s\"",
1050 (int)stringlen, (char*)ptr, build_id);
1051 break;

Then, inside lose(),

 lose(char *fmt, ...)
123 {
124 va_list ap;
125 /* Block signals to prevent other threads, timers and such from
126 * interfering. If only all threads could be stopped somehow. */
127 block_blockable_signals(0);
128 fprintf(stderr, "fatal error encountered");
129 va_start(ap, fmt);
130 print_message(fmt, ap);
131 va_end(ap);

In block_blockable_signals,

 void
572 block_blockable_signals(sigset_t *old)
573 {
574 thread_sigmask(SIG_BLOCK, &blockable_sigset, old);
575 }

old is 0,

In sb_pthread_sigmask,
2021 if (oldset)
2022 *oldset = self->blocked_signal_set;
2023 if (set) {
2024 switch (how) {
2025 case SIG_BLOCK:
2026 self->blocked_signal_set |= *set;
2027 break;
2028 case SIG_UNBLOCK:
2029 self->blocked_signal_set &= ~(*set);
2030 break;

oldset = 0
self->blocked_signal_set cannot access memory address at 0x403c,
but self has an address at 0x4000

Let me know how else can I help troubleshoot.