Sounded like a race condition causing a correct new mapping in the TLB to be cleared away by mistake, reverting back to the zero page mapping it was before.

Except incorrectly flushing the TLB would merely be a performance bug.