Reusing Byte Slice in Transaction causes Bugs with Subscriptions

What version of Go are you using (go version)?

$ go version
go version go1.18.1 darwin/arm64

What operating system are you using?

MacOS 12.3.1 (21E258)

What version of Badger are you using?

v3.2103.2

Does this issue reproduce with the latest master?

Yes

Steps to Reproduce the issue

func test() {
	badgerOptions := badger.DefaultOptions(path.Join(os.TempDir(), "badger.db"))
	database, err := badger.Open(badgerOptions)
	if err != nil {
		panic(err)
	}

	key := []byte("key")
	key1 := []byte("key1")
	key2 := []byte("key2")

	v1 := make([]byte, 32)
	_, err = rand.Read(v1)
	if err != nil {
		panic(err)
	}

	v2 := make([]byte, 32)
	_, err = rand.Read(v2)
	if err != nil {
		panic(err)
	}

	v := make([]byte, 32)
	copy(v, v1)

	ctx, cancel := context.WithCancel(context.Background())

	seen1 := make(chan []byte, 1)

	var wg sync.WaitGroup
	wg.Add(1)
	go func() {
		match := pb.Match{Prefix: key}
		err := database.Subscribe(ctx, func(kv *badger.KVList) error {
			for _, kv := range kv.Kv {
				if bytes.Equal(kv.Key, key1) {
					seen1 <- kv.Value
				}
			}
			return nil
		}, []pb.Match{match})
		if err != nil {
			panic(err)
		}
		wg.Done()
	}()

	err = database.Update(func(txn *badger.Txn) error {
		return txn.Set(key1, v)
	})
	if err != nil {
		panic(err)
	}

	copy(v, v2)

	err = database.Update(func(txn *badger.Txn) error {
		return txn.Set(key2, v)
	})
	if err != nil {
		panic(err)
	}

	select {
	case d := <-seen1:
		if !bytes.Equal(d, v1) {
			panic("value changed from v1 to v2 value but should not have")
		}
	}
	err = database.Close()
	if err != nil {
		panic(err)
	}
	cancel()
	wg.Wait()
}

What Badger options were set?

Just the default options

What did you do?

Ran the test function above.

What did you expect to see?

That no error occurred (and no panic happened) because v1 kept its value since v was only modified after the Set transaction was committed.

What did you see instead?

A panic occurred stating that the value stored for key1 was no longer equal to v1 when the subscription callback ran.