Why not go for the big guns right off the bat? TSan is _amazingly_ good at finding race conditions in multithreaded code. Not only does it tell you the whole stack of the offending line, it also tells you where the thread was started.

Actually, though the root cause of this issue is about cryptography logic, no data-race.:-)

How “two NAND gates that implement an AND gate returning 0 for (0, 0) input, but sometimes 1” is about cryptography logic?

Because two HomNAND operations don't give the same result as one HomAND, and HomNAND/HomAND involve a lot of cryptography.