In stepping through code in debug, in Factory.cs, the two controllers are identical in the metadata. It is the same exact controller loaded twice. The same identical GUID. Why is it loading twice? What in the file system would cause this? It is definitely not in the web.config.

To close the loop on this, for anyone who finds this thread in the future: The issue was some kind of conflict in the /bin folder. I was able to consistently trigger the error with the contents of our Production /bin folder, and consistently repair it by replacing it with the contents from a non-failing lower environment and then re-deploying our custom modules (with no code changes). After a week of fighting this, I was happy just to get it working again without having to modify any core DNN libraries. I might spend some more time later to try to nail down the exact cause, but for now I have other work to catch up on.