The bug in TeX is right here:

From tex.web, marker added by me.

    @d glue_offset = 6 {position of |glue_set| in a box node}
    @d glue_set(#) == mem[#+glue_offset].gr

    @<Display the value of |glue_set(p)|@>=
    g:=float(glue_set(p));                                              { <--- (1) }
    {        ^^^^^^^^^^^ }
    if (g<>float_constant(0))and(glue_sign(p)<>normal) then
      begin print(", glue set ");
      if glue_sign(p)=shrinking then print("- ");
      if abs(mem[p+glue_offset].int)<@'4000000 then print("?.?")        { <--- (2) }
      {      ^^^^^^^^^^^^^^^^^^^^^^  }
      else if abs(g)>float_constant(20000) then
        begin if g>float_constant(0) then print_char(">")
        else print("< -");
        print_glue(20000*unity,glue_order(p),0);
        end
      else print_glue(round(unity*g),glue_order(p),0);
    @^real multiplication@>
      end


At (1), glue_set(p) = mem[p+glue_offset].gr is read, that is field 'gr'

At (2), mem[p+glue_offset].int is read, which is field 'int'.

As mem is an array of 'memory_word' records, which are a union,
defined as

    @!memory_word = record@;@/
      case four_choices of
      1: (@!int:integer);
      2: (@!gr:glue_ratio);
      3: (@!hh:two_halves);
      4: (@!qqqq:four_quarters);
      end;

not both the 'gr' and the 'int' field could be defined at the same
time. => UB => Bug!

2021-07-26 GB