Looking at the proto signatures, they mainly seem to be
glBindRenderbuffer (Maybe the same as bug 1704153)
glCopyImageSubData (I think we only call this when resizing the GPU cache on adreno, but the stacks aren't helpful)
Interestingly we never call
bind_draw_target().. Perhaps it's actually
glBindFramebuffer that is crashing (it's declared just afterwards in gleam, so maybe a similar address). There's also some
glLineWidth calls in some of the proto signatures, and I'm pretty certain we never ever call that. So take android crash stacks with a pinch of salt!
About a 3rd of the reports have PBO mapping failures or surface allocation errors in the graphicsCriticalError. So potentially OOM related, though not smoking gun levels.
Unfortunately not a lot to go on yet. Hopefully another user will come forward with some reliable steps to reproduce.