buf->ops is (int)-2. This seems to be a use-after-free. Could you test with kernel-debug and kernel-syzkaller? It should detect and point out such ill-behaviour.