[Bug][Linux] WebKitWebProcess SIGSEGV in host dri_gbm/free on quit (extracted AppImage + Arch Mesa)

Start at the buzz-desktop entry point and AppRun behavior described here, then reproduce the extracted AppImage quit crash with WebKitWebProcess under the listed Arch/Hyprland setup. Use the mapped /usr/lib/gbm/dri_gbm.so and bundled libwebkit2gtk-4.1.so.0 as the boundary for investigation. Done means the quit-time crash is reproduced and a verified fix or regression test is identified.

Summary

On Arch/Omarchy + Hyprland + Intel Iris Xe, an extracted Buzz AppImage's WebKitWebProcess crashes with SIGSEGV during process exit, not at launch.

The crash is in glibc free() called from host Mesa dri_gbm.so, while Ubuntu-bundled libwebkit2gtk-4.1.so.0 is running GBM teardown from exit() / atexit.

Repeatable: three coredumps on the same boot, all teardown. Not OOM. Not the launch-time dmabuf dump in #2338.

Environment

• OS: Omarchy (Arch), kernel 7.2.5-3-omarchy
• Compositor: Hyprland 0.56.2-2, Wayland
• GPU: Intel TigerLake-LP GT2 Iris Xe (8086:9a49)
• Mesa: 1:26.2.2-1 (vulkan-intel same)
• Host webkit2gtk-4.1: 2.52.6-1 (present, not the crashing binary)
• Buzz: extracted AppImage tree (Buzz_0.5.23_amd64.AppImage extracted to ~/Applications/Buzz-extracted)
• Desktop launcher:

Exec=env GDK_BACKEND=wayland APPIMAGE_GTK_THEME=BuzzNoHeader GTK_THEME=BuzzNoHeader …/Buzz-extracted/AppRun

• WEBKIT_DISABLE_DMABUF_RENDERER is not set.
• Direct buzz-desktop prints: WebKit rendering left as-is — no NVIDIA GPU and not an AppImage

So the AppImage DMABUF workaround from #2338 / #4920 never applies: the extracted tree is not detected as an AppImage, and there is no NVIDIA GPU.

Timeline (2026-09-20 JST)

time	event
23:15:18	gtk-launch buzz.desktop
23:15:19	Fizz/ACP agent starts
23:15:51	agent shutting down → presence offline → buzz-acp stopped (no in-flight prompts)
23:15:53	window-state saved; WebKitWebProcess PID 438095 SIGSEGV (SEGV_MAPERR)
23:16:02	gtk-launch scope ends (44.6s wall, 1.7G peak)

Crashing thread (PID 438095)

Symbolized with eu-addr2line for libc; Mesa frames have no debug symbols (not named).

#0  glibc malloc.c:1433
#1  glibc malloc.c:4138          (_int_free)
#2  glibc malloc.c:4070          (free)
#3  dri_gbm.so + 0x24f6          /usr/lib/gbm/dri_gbm.so     (host Mesa)
#4  libgbm.so.1 + 0x2104         /usr/lib/libgbm.so.1        (host)
#5–8 libwebkit2gtk-4.1.so.0      Buzz-extracted Ubuntu bundle
#9  glibc exit.c:119             (__run_exit_handlers)
#10 exit
#11–12 __libc_start_main
#13 WebKitWebProcess

gdb confirmed the mapped objects:

• /usr/lib/gbm/dri_gbm.so
• /usr/lib/libgbm.so.1
• /usr/lib/libEGL_mesa.so.0
• /usr/lib/libc.so.6
• …/Buzz-extracted/usr/lib/libwebkit2gtk-4.1.so.0

Another thread (438126) was concurrently in __call_tls_dtors → libEGL_mesa.so.0.

Command line: ././/lib/x86_64-linux-gnu/webkit2gtk-4.1/WebKitWebProcess 4 36

Pattern on this boot

time	PID	signal	stack
2026-09-19 12:28	89724	SIGSEGV	identical to above
2026-09-20 15:00	322008	SIGABRT	malloc abort in libgallium-26.2.2-arch1.1.so during exit()
2026-09-20 23:16	438095	SIGSEGV	this report

All three die in GPU teardown on quit, not while the UI is in use.

OOM ruled out: no kernel OOM entries; ~7.8 GiB still available afterwards.

Proven vs inferred

Proven: Ubuntu-bundled WebKitGTK calls host Arch Mesa GBM during exit(), and glibc free() then hits an unmapped address (SEGV_MAPERR).

Inferred: heap corruption / double-free / use-after-free of a GBM buffer, possibly racing EGL TLS destructors. Exact WebKit symbols are unavailable (no Ubuntu debuginfod on this host).

Related issues (not duplicates)

• #2338 (closed): Intel Mesa dmabuf launch crash on XWayland; workaround WEBKIT_DISABLE_DMABUF_RENDERER=1. This crash is on quit, with GDK_BACKEND=wayland.
• #4920: AppImage forces that env var. Extracted tree is treated as “not an AppImage”, so the workaround never runs.
• #4305: Wayland DMABUF freeze, not SIGSEGV.
• #4358 / #4359: PipeWire metadata segfault / silent dead window. Different library.
• #6740 / #7762: GStreamer createAudioSink SIGABRT. Different.

Repo search for dri_gbm, libgbm, atexit teardown: no matches.

Data loss

None observed. Agent shutdown completed; window state was saved.