I’m happy it turned out to be that simple, but the amount of such bugs and devastating consequences are humiliating. Bug#7209 is a case of an intermittent failure when the best brain of Support department and dozens of man hours had to be spent to track the issue down to a repeatable test case. And the cause is such a trivial design mistake:

typedef struct st_hash {
  uint key_offset,key_length;           /* Length of key if const length */

  uint records,blength,current_record;
  DYNAMIC_ARRAY array;                          /* Place for hash_keys */

  /* cut */
} HASH;

gptr hash_search(HASH *info,const byte *key,uint length);

gptr hash_next(HASH *info,const byte *key,uint length);
Now, where does hash_next get the current position of the search? In st_hash::current_record, and it, obviously, makes the search non concurrent-safe.