Made some progress. By running it under gdb and breaking in malloc_printerr(), I got a better stack trace:

Breakpoint 1, malloc_printerr (str=0x76e028f8 "free(): invalid pointer")
    at malloc.c:5341
5341	malloc.c: No such file or directory.
(gdb) bt
#0  malloc_printerr (str=0x76e028f8 "free(): invalid pointer") at malloc.c:5341
#1  0x76d44d50 in _int_free (av=0x76e1f7d4 <main_arena>, 
    p=0x43417c <small_ints.lto_priv+72>, have_lock=<optimized out>)
    at malloc.c:4165
#2  0x001b4f40 in list_dealloc (op=0x760ef288) at ../Objects/listobject.c:324
#3  0x001be784 in frame_dealloc (
    f=Frame 0x765fcc30, for file /home/pi/src/QTD/src/tdc7201/tdc7201/__init__.py, line 719, in read_regs24 (i=40, reg=28)) at ../Objects/frameobject.c:470
#4  function_code_fastcall (globals=<optimized out>, nargs=<optimized out>, 
    args=<optimized out>, co=<optimized out>) at ../Objects/call.c:291
#5  _PyFunction_FastCallKeywords (func=<optimized out>, stack=<optimized out>, 
    nargs=<optimized out>, kwnames=<optimized out>) at ../Objects/call.c:408
#6  0x0011f984 in call_function (kwnames=0x0, oparg=<optimized out>, 
    pp_stack=0x7effed40) at ../Python/ceval.c:4554
#7  _PyEval_EvalFrameDefault (f=<optimized out>, throwflag=<optimized out>)
    at ../Python/ceval.c:3110
#8  0x0011d63c in PyEval_EvalFrameEx (throwflag=0, 
    f=Frame 0x760e8960, for file /home/pi/src/QTD/src/tdc7201/tdc7201/__init__.py, line 962, in measure (self=<TDC7201(_spi=<SpiDev at remote 0x7618d2f0>, reg1=[130, 66, 0, 7, 255, 255, 6, 64, 0, 1, 65535, 1600, Breakpoint 1, malloc_printerr (str=0x76e028f8 "free(): invalid pointer")
    at malloc.c:5341
5341	malloc.c: No such file or directory.
(gdb) bt
#0  malloc_printerr (str=0x76e028f8 "free(): invalid pointer") at malloc.c:5341
#1  0x76d44d50 in _int_free (av=0x76e1f7d4 <main_arena>, 
    p=0x43417c <small_ints.lto_priv+72>, have_lock=<optimized out>)
    at malloc.c:4165
#2  0x001b4f40 in list_dealloc (op=0x760ef288) at ../Objects/listobject.c:324
#3  0x001be784 in frame_dealloc (
    f=Frame 0x765fcc30, for file /home/pi/src/QTD/src/tdc7201/tdc7201/__init__.py, line 719, in read_regs24 (i=40, reg=28)) at ../Objects/frameobject.c:470
#4  function_code_fastcall (globals=<optimized out>, nargs=<optimized out>, 
    args=<optimized out>, co=<optimized out>) at ../Objects/call.c:291
#5  _PyFunction_FastCallKeywords (func=<optimized out>, stack=<optimized out>, 
    nargs=<optimized out>, kwnames=<optimized out>) at ../Objects/call.c:408
#6  0x0011f984 in call_function (kwnames=0x0, oparg=<optimized out>, 
    pp_stack=0x7effed40) at ../Python/ceval.c:4554
#7  _PyEval_EvalFrameDefault (f=<optimized out>, throwflag=<optimized out>)
    at ../Python/ceval.c:3110
#8  0x0011d63c in PyEval_EvalFrameEx (throwflag=0, 
    f=Frame 0x760e8960, for file /home/pi/src/QTD/src/tdc7201/tdc7201/__init__.py, line 962, in measure (self=<TDC7201(_spi=<SpiDev at remote 0x7618d2f0>, reg1=[130, 66, 0, 7, 255, 255, 6, 64, 0, 1, 65535, 1600, 1, None, None, None, 1284, 322, 2371, 0, 0, 0, 0, 0, 0, 0, 0, 2322, 23172, None], chip_select=1, sclk=23, miso=21, mosi=19, cs1=24, cs2=26, enable=12, osc_enable=16, trig1=7, int1=37, trig2=None, int2=None, start=18, stop=22, meas_mode=2, cal_pers=10, cal_count=<float at remote 0x76225e50>, norm_lsb=<float at remote 0x760ee8f0>, tof1=<float at remote 0x760ee900>, tof2=<float at remote 0x760ee920>, tof3=0, tof4=0, tof5=0) at remote 0x76191750>, simulate=True, error_prefix='59835 ', log_file=<_io.TextIOWrapper at remote 0x761df4b0>, cf1=130, timeout=<float at remote 0x76225d00>, n_stop=3, threshold=<float at remote 0x760ee880>, pulse=2))
    at ../Python/ceval.c:3930
1, None, None, None, 1284, 322, 2371, 0, 0, 0, 0, 0, 0, 0, 0, 2322, 23172, None], chip_select=1, sclk=23, miso=21, mosi=19, cs1=24, cs2=26, enable=12, osc_enable=16, trig1=7, int1=37, trig2=None, int2=None, start=18, stop=22, meas_mode=2, cal_pers=10, cal_count=<float at remote 0x76225e50>, norm_lsb=<float at remote 0x760ee8f0>, tof1=<float at remote 0x760ee900>, tof2=<float at remote 0x760ee920>, tof3=0, tof4=0, tof5=0) at remote 0x76191750>, simulate=True, error_prefix='59835 ', log_file=<_io.TextIOWrapper at remote 0x761df4b0>, cf1=130, timeout=<float at remote 0x76225d00>, n_stop=3, threshold=<float at remote 0x760ee880>, pulse=2))
    at ../Python/ceval.c:3930
...

read_regs24 (i=40, reg=28) performs an SPI read of 13 24-bit registers (so 39 bytes); the corresponding Python code is:

    def read_regs24(self):
        """Read all 24-bit chip registers, using auto-increment feature."""
        result24 = self._spi.xfer([self.MINREG24|self._AI,
                                   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                                   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                                   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                                   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                                   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00])
        #print("AI read 24-bits =", result24)
        #print("length =", len(result24))
        i = 1
        for reg in range(self.MINREG24, self.MAXREG24+1):
            # Data comes in MSB first.
            self.reg1[reg] = (result24[i] << 16) | (result24[i+1] << 8) | result24[i+2]
            i += 3

The zero padding is necessary to make sure that enough SPI clock cycles are sent for the data bytes to get clocked back in. The _AI flag turns on auto-increment, so each byte is from the next address.

So it looks like the bug is either in the spidev library, or in Python deallocation of this frame. I'll try pulling the sent data list outside the method, since it is always the same; that will avoid the list alloc/dealloc, and may even slightly speed up the program. If that fixes the problem, it's in Python; if it doesn't, it's in spidev. Probably.