I attached valgrind log,
may be you can find something usefull.

>> #0  SYMBOL_NAME (sym=XIL(0x55555f9b3260)) at /usr/src/debug/emacs/emacs-29.4/src/lisp.h:1152

> Can you examine the memory it points to so we get a clue, maybe?
> (gdb) x/64gx 0x55555f9b3200

So the idea is to use p-0x60, where where p from XIL(p)?

Here new crash, and x/6gx:

#0  SYMBOL_NAME (sym=0x555577a7a770) at /usr/src/debug/emacs/emacs-29.4/src/lisp.h:1152
1152	  return p;
(gdb) print sym
$1 = (Lisp_Object) 0x555577a7a770
(gdb) xtype
Lisp_Symbol
(gdb) xsymbol
$2 = (struct Lisp_Symbol *) 0xaaaacd8485d0
Cannot access memory at address 0xaaaacd8485d8
(gdb) x/64gx 0x555577a7a710
0x555577a7a710:	0x0000000000000004	0x0000555577a7a700
0x555577a7a720:	0x0000000000000004	0x0000555577a7a710
0x555577a7a730:	0x0000000000000004	0x0000555577a7a720
0x555577a7a740:	0x0000000000000004	0x0000555577a7a730
0x555577a7a750:	0x0000000000000004	0x0000555577a7a740
0x555577a7a760:	0x0000000000000004	0x0000555577a7a750
0x555577a7a770:	0x0000000000000004	0x0000555577a7a760
0x555577a7a780:	0x0000000000000004	0x0000555577a7a770
0x555577a7a790:	0x0000000000000004	0x0000555577a7a780
0x555577a7a7a0:	0x0000000000000004	0x0000555577a7a790
0x555577a7a7b0:	0x0000000000000004	0x0000555577a7a7a0
0x555577a7a7c0:	0x0000000000000004	0x0000555577a7a7b0
0x555577a7a7d0:	0x0000000000000004	0x0000555577a7a7c0
0x555577a7a7e0:	0x0000000000000000	0x0000555577a7a800
0x555577a7a7f0:	0x5f74736574225b3a	0x0000555577a77c00
0x555577a7a800:	0x0000555577a7a400	0x00005555810353d0
0x555577a7a810:	0x0000000000000004	0x0000555577a7a800
0x555577a7a820:	0x0000000000000004	0x0000555577a7a810
0x555577a7a830:	0x0000000000000004	0x0000555577a7a820
0x555577a7a840:	0x0000000000000004	0x0000555577a7a830
0x555577a7a850:	0x0000000000000004	0x0000555577a7a840
0x555577a7a860:	0x0000000000000004	0x0000555577a7a850
0x555577a7a870:	0x0000000000000004	0x0000555577a7a860
0x555577a7a880:	0x0000000000000004	0x0000555577a7a870
0x555577a7a890:	0x0000000000000004	0x0000555577a7a880
0x555577a7a8a0:	0x0000000000000004	0x0000555577a7a890
0x555577a7a8b0:	0x0000000000000004	0x0000555577a7a8a0
0x555577a7a8c0:	0x0000000000000004	0x0000555577a7a8b0
0x555577a7a8d0:	0x0000000000000004	0x0000555577a7a8c0
0x555577a7a8e0:	0x0000000000000004	0x0000555577a7a8d0
0x555577a7a8f0:	0x0000000000000004	0x0000555577a7a8e0
0x555577a7a900:	0x0000000000000004	0x0000555577a7a8f0


>  If you can set a breakpoint on the function
> "wrong_type_argument" (note there may be some false positives)

"wrong_type_argument" for some reason triggers
on every attempt to open file.

I will try to rebuild emacs with sanitizer.

-- 
/Evgeniy