Hi Ulrich,
I've now built a kernel with CONFIG_ARM_ERRATA_720789 enabled, and the symptoms indeed seem to have disappeared completely ...
Yup - that's because without it, invalidating a TLB entry for a particular process isn't broadcast correctly, so you can end up using the old (pre-COW) mappings if you're running on a different core.
Will