Root Cause Chain

  1. PyEval_SaveThread() detaches thread state (even on free-threaded Python)

  From CPython Thread State docs:
  "Detach the attached thread state and return it. The thread will have no thread state upon returning."

  "For free-threaded builds, the GIL is normally out of the question, but detaching the thread state is still
  required for blocking I/O and long operations."

  So py::call_guard<py::gil_scoped_release>() calls PyEval_SaveThread() which sets the thread state to NULL, even on
   free-threaded Python.

  2. PyCriticalSection_Begin requires an attached thread state

  From CPython's pycore_critical_section.h, the macro expands to:
  PyThreadState *_cs_tstate = _PyThreadState_GET();
  _PyCriticalSection_Begin(_cs_tstate, &_py_cs, op);

  And _PyCriticalSection_BeginMutex then accesses tstate->critical_section with no NULL check. After
  PyEval_SaveThread(), _PyThreadState_GET() returns NULL, causing the segfault at tstate->critical_section.

  3. pybind11's cast() triggers critical sections on free-threaded Python

  pybind11 3.x uses PyCriticalSection internally (via scoped_critical_section in critical_section.h) when
  Py_GIL_DISABLED is defined. The a.cast<T&>() call in the in-place operators accesses Python object internals,
  which triggers PyCriticalSection_Begin on free-threaded builds.

  4. PEP 703 Critical Sections

  CPython issue #111569 documents the implementation of critical sections from PEP 703, confirming they are the
  per-object locking mechanism replacing the GIL in free-threaded builds.

  Why the fix works

  The non-inplace operators (__add__, etc.) take const T &a — pybind11 converts Python→C++ before the call guard, so
   no Python API calls happen after PyEval_SaveThread(). The in-place operators take py::object &a and call
  a.cast<T&>() after the GIL release. The fix extracts the C++ reference while thread state is still attached, then
  releases the GIL only around the pure C++ arithmetic.

  Sources:
  - CPython Thread States and GIL docs
  - CPython pycore_critical_section.h
  - CPython Synchronization Primitives docs
  - PEP 703 Critical Sections implementation
  - pybind11 changelog - free-threaded Python fixes
  - pybind11 critical_section.h