Probably because musl's allocator exposes single newly faulted pages directly to the app. Other allocators tend to pre-allocate multiple pages at a time, so that the race window is narrower.
Shouldn't tons of applications linked against musl be crashing all over the Internet if it can express this kernel bug?
Not necessarily. Another key here is that the allocation is triggered from the libc, while the main app uses another allocator.
These kinds of issues with VM are notoriously tricky to replicate. And the main debugging method is "staring intently at the code".
Coincidence. It also only triggers on one machine.