SMP: threads get reinserted before their TCB gets saved

While trying to use RT-Thread with rp2040 I found in SMP configuration it can happen that current_thread gets inserted back into the ready thread list before context switch can occur. Let's say that happens on core 0. Then core 1 can already pick up that thread before PendSV gets to run on core0 where the TCB should be saved. Now core1 could do a context switch to a thread that has not yet its TCB saved on its stack leading to memory corruption.
Could anyone please confirm that? While I am new to RT-Thread I could start working on a PR once it is confirmed by others.
In my testing I added a MAGIC to the TCB and I could spot situations where whire switching to threads (in PendSV) MAGIC was missing from TCB.
I also ran tests with threads, all binded to a core or another and there there is no surprise the issue does not show up: core 1 cannot pickup on incomplete TCBs from core 0 and vice versa.

Any feedback would be appreciated!
Victor

Start by reproducing the SMP case on RP2040 and trace current_thread, the ready thread list, and the PendSV context-switch path. Check whether core 1 can select a thread before core 0 saves its TCB, using the reported MAGIC marker; done means the race is confirmed and a focused regression test or fix is identified.