This might be related or the same issue.

With ITS#9124 and ITS#9145 fixed, if you run:

ldapsearch -E '!sync=rp' -E '!cancel'

syncprov has freed the operation and cancel_extop() still tries to touch the same Operation pointer without checking it's still in the connection list. At least valgrind isn't happy.