> Looking closely to the gdb stack, there is that frame:

Yeah, but it calls _free, which runs unlocked. That's not the problem.

> I am still unable to reproduce the bug in a simple script.

Try with this one:

"""
import multiprocessing.heap


tab = []

for i in range(100000):
    print(i)
    b = multiprocessing.heap.BufferWrapper(10)
    # create a circular reference (we want GC and not refcount collection when
    # the block goes out of scope)
    b.tab = tab
    tab.append(b)
    # drop buffers refcount to 0 to make them eligible to GC
    if i % 100 == 0:
        del tab
        tab = []
"""

It deadlocks pretty quickly (well, on my box).
And, as expected, disabling/enabling the GC inside malloc solves the problem.
I have to think a little bit more for a clean solution.