Now that I've looked into BitArray some more, I'm inclined to agree with your assessment that only the expanded non-padding bits should be zeroed upon expansion.

Initially I only knew enough to see that the implementation was incorrect for attempting to zero the pad bits.

Could the realloc operation also cause corruption of shared BitArray data?
e.g. If we're trying to shrink the size and realloc decides to shrink in place, then there is no guarantees about the data between the new size and the old size.
Or does this form of realloc have stronger guarantees than GC.realloc?