Reproduced with Debian clang version 17.0.6

Not systematic. To reproduce it, run the test in loop
$ while ./modules/h2conn_test; do echo ""; done`

While stressing the machine a little bit:
$ stress --cpu 32 -i 1000

==892210==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fae954fdb90 at pc 0x55da59444573 bp 0x7fae954fdb70 sp 0x7fae954fd340
WRITE of size 24 at 0x7fae954fdb90 thread T4 (vlc-h2-recv)
    #0 0x55da59444572 in sigaltstack (/home/tom/work/git/vlc/build-asan/modules/.libs/h2conn_test+0xa4572) (BuildId: 8ead1e4d94475932abd3d192f0c9c782a2470ea0)
    #1 0x55da5947188f in __asan::PlatformUnpoisonStacks() (/home/tom/work/git/vlc/build-asan/modules/.libs/h2conn_test+0xd188f) (BuildId: 8ead1e4d94475932abd3d192f0c9c782a2470ea0)
    #2 0x55da594778b7 in __asan_handle_no_return (/home/tom/work/git/vlc/build-asan/modules/.libs/h2conn_test+0xd78b7) (BuildId: 8ead1e4d94475932abd3d192f0c9c782a2470ea0)
    #3 0x55da594b6d33 in vlc_h2_recv_thread /home/tom/work/git/vlc/build-asan/modules/../../modules/access/http/h2conn.c:804:5
    #4 0x55da5946b70a in asan_thread_start(void*) asan_interceptors.cpp.o
    #5 0x7fae98877043  (/lib/x86_64-linux-gnu/libc.so.6+0x89043) (BuildId: 51657f818beb1ae70372216a99b7412b8a100a20)
    #6 0x7fae988f761b  (/lib/x86_64-linux-gnu/libc.so.6+0x10961b) (BuildId: 51657f818beb1ae70372216a99b7412b8a100a20)

Address 0x7fae954fdb90 is located in stack of thread T4 (vlc-h2-recv) at offset 208 in frame
    #0 0x55da594b897f in vlc_h2_frame_recv /home/tom/work/git/vlc/build-asan/modules/../../modules/access/http/h2conn.c:754

  This frame has 2 object(s):
    [32, 41) 'header' (line 755)
    [64, 168) '__cancel_buf' (line 773) <== Memory access at offset 208 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
Thread T4 (vlc-h2-recv) created by T0 here:
    #0 0x55da5945349d in pthread_create (/home/tom/work/git/vlc/build-asan/modules/.libs/h2conn_test+0xb349d) (BuildId: 8ead1e4d94475932abd3d192f0c9c782a2470ea0)
    #1 0x7fae98c2af4c in vlc_clone_attr /home/tom/work/git/vlc/build-asan/src/../../src/posix/thread.c:180:11
    #2 0x7fae98c2af4c in vlc_clone /home/tom/work/git/vlc/build-asan/src/../../src/posix/thread.c:191:12
    #3 0x55da594b68c2 in vlc_h2_conn_create /home/tom/work/git/vlc/build-asan/modules/../../modules/access/http/h2conn.c:897:9
    #4 0x55da594ab69c in conn_create /home/tom/work/git/vlc/build-asan/modules/../../modules/access/http/h2conn_test.c:106:12
    #5 0x55da594aa472 in main /home/tom/work/git/vlc/build-asan/modules/../../modules/access/http/h2conn_test.c:172:5
    #6 0x7fae988151c9  (/lib/x86_64-linux-gnu/libc.so.6+0x271c9) (BuildId: 51657f818beb1ae70372216a99b7412b8a100a20)

SUMMARY: AddressSanitizer: stack-buffer-overflow (/home/tom/work/git/vlc/build-asan/modules/.libs/h2conn_test+0xa4572) (BuildId: 8ead1e4d94475932abd3d192f0c9c782a2470ea0) in sigaltstack