App crashes with native error "Indirect call guard check detected invalid control transfer."

[hmg1000]

Describe the bug

Since we switched our App from UWP to WinUI it randomly crashes. When I open the dump it's always the same exception:
Unhandled exception at 0x772D9D40 (ntdll.dll) in Dump.dmp: Indirect call guard check detected invalid control transfer.

The call stack locks like this:

ntdll.dll!@RtlFailFast2@8() Unknown
ntdll.dll!@RtlpHandleInvalidUserCallTarget@4() Unknown
ntdll.dll!_LdrpValidateUserCallTargetBitMapRet@0() Unknown
[Inline Frame] Microsoft.UI.Xaml.Phone.dll!Microsoft::WRL::Callback::__l2::<lambda_1>::operator()(IInspectable * &&) Line 479 C++
Microsoft.UI.Xaml.Phone.dll!Microsoft::WRL::Details::DelegateArgTraits<long (__stdcall ABI::Microsoft::UI::Xaml::IRoutedEventHandler::*)(IInspectable *,ABI::Microsoft::UI::Xaml::IRoutedEventArgs *)>::DelegateInvokeHelper<ABI::Microsoft::UI::Xaml::IRoutedEventHandler,Microsoft::WRL::Callback<ABI::Microsoft::UI::Xaml::IRoutedEventHandler,ABI::Microsoft::UI::Xaml::Controls::DatePickerFlyout,IInspectable *,ABI::Microsoft::UI::Xaml::IRoutedEventArgs *>'::2'::<lambda_1>,1,IInspectable *,ABI::Microsoft::UI::Xaml::IRoutedEventArgs *>::Invoke(IInspectable * <args_0>, ABI::Microsoft::UI::Xaml::IRoutedEventArgs * <args_1>) Line 354 C++
Microsoft.UI.Xaml.dll!DirectUI::CEventSourceBase<DirectUI::IUntypedEventSource,ABI::Windows::Foundation::ITypedEventHandler<ABI::Microsoft::UI::Xaml::Documents::TextElement *,ABI::Microsoft::UI::Xaml::Input::AccessKeyDisplayDismissedEventArgs *>,ABI::Microsoft::UI::Xaml::Documents::ITextElement,ABI::Microsoft::UI::Xaml::Input::IAccessKeyDisplayDismissedEventArgs>::Raise(ABI::Microsoft::UI::Xaml::Documents::ITextElement * pSource, ABI::Microsoft::UI::Xaml::Input::IAccessKeyDisplayDismissedEventArgs * pArgs) Line 271 C++
Microsoft.UI.Xaml.dll!DirectUI::CEventSourceBaseDirectUI::IUntypedEventSource,ABI::Microsoft::UI::Xaml::IVisualStateChangedEventHandler,IInspectable,ABI::Microsoft::UI::Xaml::IVisualStateChangedEventArgs::UntypedRaise(IInspectable * pSource, IInspectable * pArgs) Line 243 C++
Microsoft.UI.Xaml.dll!DirectUI::DependencyObject::FireEvent(KnownEventIndex nEventId, IInspectable * pSender, IInspectable * pArgs) Line 3452 C++
Microsoft.UI.Xaml.dll!DirectUI::DXamlCore::FireEvent(CDependencyObject * pCoreListener, KnownEventIndex eventId, CDependencyObject * pCoreSender, CEventArgs * pCoreArgs, unsigned int flags) Line 2040 C++
[Inline Frame] Microsoft.UI.Xaml.dll!AgCoreCallbacks::FireEvent(CDependencyObject *) Line 89 C++
[Inline Frame] Microsoft.UI.Xaml.dll!FxCallbacks::JoltHelper_FireEvent(CDependencyObject ) Line 877 C++
Microsoft.UI.Xaml.dll!CCoreServices::CLR_FireEvent(CDependencyObject * pListener, EventHandle hEvent, CDependencyObject * pSender, CEventArgs * pArgs, unsigned int flags) Line 3181 C++
Microsoft.UI.Xaml.dll!CommonBrowserHost::CLR_FireEvent(CDependencyObject * pListener, EventHandle hEvent, CDependencyObject * pSender, CEventArgs * pArgs, unsigned int flags) Line 680 C++
Microsoft.UI.Xaml.dll!CControlBase::ScriptCallback(void * pControl, CDependencyObject * pListener, EventHandle hEvent, CDependencyObject * pSender, CEventArgs * pArgs, int flags, IScriptObject * pScriptObject, HRESULT(__stdcall)(CDependencyObject *, CEventArgs *) pInternalHandler) Line 213 C++
Microsoft.UI.Xaml.dll!CXcpDispatcher::OnScriptCallback(CEventInfo * pEventInfo) Line 1019 C++
Microsoft.UI.Xaml.dll!CXcpDispatcher::OnWindowMessage(unsigned int msg, unsigned int wParam, long lParam) Line 874 C++
Microsoft.UI.Xaml.dll!CXcpDispatcher::ProcessMessage(unsigned int msg, unsigned int wParam, long lParam) Line 630 C++
Microsoft.UI.Xaml.dll!CDeferredInvoke::DispatchQueuedMessage(bool * dispatchedWork, bool * hasMoreWork) Line 147 C++
Microsoft.UI.Xaml.dll!CXcpDispatcher::MessageTimerCallback() Line 1215 C++
[Inline Frame] Microsoft.UI.Xaml.dll!CXcpDispatcher::MessageTimerCallbackStatic(void *) Line 1203 C++
[Inline Frame] Microsoft.UI.Xaml.dll!CXcpDispatcher::Init::__l46::<lambda_1>::operator()(ABI::Microsoft::UI::Dispatching::IDispatcherQueueTimer *) Line 313 C++
Microsoft.UI.Xaml.dll!Microsoft::WRL::Details::DelegateArgTraits<long (__stdcall ABI::Windows::Foundation::ITypedEventHandler_impl<ABI::Windows::Foundation::Internal::AggregateType<ABI::Microsoft::UI::Dispatching::DispatcherQueueTimer *,ABI::Microsoft::UI::Dispatching::IDispatcherQueueTimer *>,IInspectable >::)(ABI::Microsoft::UI::Dispatching::IDispatcherQueueTimer *,IInspectable *)>::DelegateInvokeHelper<Microsoft::WRL::Implements<Microsoft::WRL::RuntimeClassFlags<2>,ABI::Windows::Foundation::ITypedEventHandler<ABI::Microsoft::UI::Dispatching::DispatcherQueueTimer *,IInspectable *>,Microsoft::WRL::FtmBase>,CXcpDispatcher::Init'::46'::<lambda_1> &,1,ABI::Microsoft::UI::Dispatching::IDispatcherQueueTimer *,IInspectable *>::Invoke(ABI::Microsoft::UI::Dispatching::IDispatcherQueueTimer * <args_0>, IInspectable * <args_1>) Line 354 C++

Steps to reproduce the bug

I can't reproduce it. It appears randomly

Expected behavior

No response

Screenshots

NuGet package version

WinUI 3 - Windows App SDK 1.6.1: 1.6.240923002

Windows version

Windows 11 (22H2): Build 22621

Additional context

No response