Reproduction steps:
1. Open the attached “IN-89916“ project
2. Build and Run the Android Player
3. In the Player, click on the “Confirm” button on the first screen
4. Keep tapping (for up to 1 minute) randomly on the buttons to the left to toggle between characters until the Player crashes
5. Observe the crash

Expected result: The Player does not crash
Actual result: The Player crashes

Reproducible with: 2022.3.54f1
Couldn't test with: 2021.3.47f1, 6000.0.30f1, 6000.1.0a7 (Repro project is complex, doesn’t allow to switch versions easily)

Reproducible environments: Windows 11 (24H2)
Not reproducible environments: No other environments tested

Reproducible with these devices:
VLNQA00460 - Google Pixel 6 (Pixel 6), CPU: Google Tensor (Whitechapel), GPU: Mali-G78, OS: 14

Not reproducible with these devices:
VLNQA00516 - Samsung Galaxy Fold (SM-F900F), CPU: Snapdragon 855 SM8150, GPU: Adreno 640, OS: 10 (Crashes with other error)
VLNQA00591 - Samsung Galaxy S23 (SM-S911B), CPU: Snapdragon 8 Gen 2 (SM8550), GPU: Adreno 740, OS: 14
VLNQA00403 - Galaxy Z Flip3 5G (SM-F711B), CPU: Snapdragon 888, GPU: Adreno 660, OS: 11
VLNQA00336 - HUAWEI Y6p (MED-LX9N), CPU: MediaTek MT6762R, GPU: PowerVR Rogue GE8320, OS: 10
VLNQA00510 - Lenovo Tab M10 HD Gen 2 (Lenovo TB-X306F), CPU: Mediatek MT8768, GPU: PowerVR Rogue GE8320, OS: 10
VLNQA00391 - Xiaomi Redmi 9A (M2006C3LG), CPU: MediaTek Helio G25 (MT6762G), GPU: PowerVR Rogue GE8320, OS: 10

First three lines of the crash stack trace:
#00 pc 0000000001786b3c /vendor/lib64/egl/libGLES_mali.so (gfx::command_buffer_builder::bind_vertex_buffers(unsigned int, unsigned int, gfx::buffer const* const, unsigned long const, unsigned long const, unsigned long const)+204) (BuildId: 9a91c3c0b3746b5c)
#01 pc 00000000008643bc /vendor/lib64/egl/libGLES_mali.so (vulkan::command_buffer::bind_vertex_buffers(unsigned int, unsigned int, gfx::buffer const*, unsigned long const, unsigned long const, unsigned long const)+92) (BuildId: 9a91c3c0b3746b5c)
#02 pc 0000000000864334 /vendor/lib64/egl/libGLES_mali.so (vkCmdBindVertexBuffers+116) (BuildId: 9a91c3c0b3746b5c)

Note: Could not test iOS, project is corrupted in the Xcode, cannot build iOS application