I noticed that configASSERT() is not defined – the definition is commented out. If you use a very basic definition (like the one below), it might help you catch unexpected violations of configLIBRARY_MAX_SYSCALL_INTERRUPT_PRIORITY. That’s a common cause of corruption in kernel data structures. I realize you’ve checked for it already, but sometimes one will slip through – especially if you’re using CubeMX.
/* Normal assert() semantics without relying on the provision of an assert.h
header file. */
#define configASSERT( x ) if ((x) == 0) {taskDISABLE_INTERRUPTS(); for( ;; );}