This might be related or the same issue.
With ITS#9124 and ITS#9145 fixed, if you run:
ldapsearch -E '!sync=rp' -E '!cancel'
syncprov has freed the operation and cancel_extop() still tries to touch the same Operation pointer without checking it's still in the connection list. At least valgrind isn't happy.