ASan crash on failed redirection in subshell

I've compiled dash (current master branch, commit 037bbdfd) on an M1 (arm64) 
machine with macOS 15.7.4 with Apple's clang 17.0.0 and CFLAGS='-O0 -g 
-fsanitize=address'.

Looks like there are multiple crashes when running the shellspec[*1] and 
modernish[*2] regression tests. I will try to derive some concrete reproducers.

To begin with, this reproducer script:

	(
		: >/dev/null/nonexistent
	)

crashes as follows:

$ src/dash asan_crash.sh
asan_crash.sh: 2: cannot create /dev/null/nonexistent: Directory nonexistent
AddressSanitizer: CHECK failed: asan_poisoning.cpp:40 "((AddrIsInMem(addr + 
size - (1ULL << 3)))) != (0)" (0x0, 0x0) (tid=16311095)
     #0 0x000100e3b1cc in __asan::CheckUnwind()+0x24 
(libclang_rt.asan_osx_dynamic.dylib:arm64e+0x471cc)
     #1 0x000100e55048 in __sanitizer::CheckFailed(char const*, int, char 
const*, unsigned long long, unsigned long long)+0x94 
(libclang_rt.asan_osx_dynamic.dylib:arm64e+0x61048)
     #2 0x000100e79f34 in __asan::PoisonShadow(unsigned long, unsigned long, 
unsigned char) (.cold.4)+0x20 (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x85f34)
     #3 0x000100e32fb0 in __asan::PoisonShadow(unsigned long, unsigned long, 
unsigned char)+0x1c8 (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x3efb0)
     #4 0x000100e348c0 in __asan::PlatformUnpoisonStacks()+0x54 
(libclang_rt.asan_osx_dynamic.dylib:arm64e+0x408c0)
     #5 0x000100e3ae68 in __asan_handle_no_return+0x2c 
(libclang_rt.asan_osx_dynamic.dylib:arm64e+0x46e68)
     #6 0x000100848314 in evalcommand eval.c:857
     #7 0x000100846d44 in evaltree eval.c:305
     #8 0x00010084ade8 in evaltreenr eval.c:352
     #9 0x000100849a34 in evalsubshell eval.c:512
     #10 0x000100846d44 in evaltree eval.c:305
     #11 0x00010086e894 in cmdloop main.c:244
     #12 0x00010086e38c in main main.c:178
     #13 0x00019e60ab94  (<unknown module>)

Abort trap: 6


[*1] To run the shellspec tests:
git clone --depth=1 https://github.com/shellspec/shellspec
cd shellspec
path/to/dash shellspec

[*2] To run the modernish regression tests:
git clone --depth=1 https://github.com/modernish/modernish
cd modernish
path/to/dash bin/modernish --test

-- 
||	modernish -- harness the shell
||	https://github.com/modernish/modernish
||
||	KornShell lives!
||	https://github.com/ksh93/ksh