The failure happened at
The transaction was allocated at slab-256. The slab element before transaction belongs to ldiskfs ext path, executed function is ldiskfs_ext_remove_space().
There is a bug in a while loop where bread is called.
The allocation was done for s_max_ext_tree_depth elements. Iteration index start with 0. And compared with depth(number of elements). So
memset(path + i + 1, 0, sizeof(*path));
could zero memory outside the allocation. The depth is 5 at vmcore.