In end(), the freelist pointer is owned so the bare store would be ok.
However, there is a load in start() that can happen at the same time, if
another start() and end() pair grabs that same index.

I don't think this fixes #21663 actually because even if the data race
corrupts the value for `next`, the cmpxchg protects the value from being
stored there.