I added some debug logs to the rasterize method in Moz2dBlobRasterizer, which write out the index of the first non-zero byte in the resulting image.
Initially this is at byte 1429. As you scroll down the page and force new display lists (by clicking on the page content), this value remains constant.
At some point, this value starts to change - e.g. about half way down the page, when rasterizing the blob, the first non-zero byte in the rasterized result is at 230678. This corresponds with scrolling up and seeing the mask is partially clipped and drawn incorrectly.
If you continue scrolling down the page to the bottom, and force a new DL to be sent, the rasterized blob image is completely empty (all 0), which corresponds with scrolling up to the top of the page and seeing nothing drawn.
My guess is that this is occurring somewhere around where the display port / view port (?) region is?