Crash on weapon switch (macOS Apple Silicon)

[742617000027]

Environment

• OS: macOS (Darwin 25.4.0), Apple M1
• Engine: oDFe.aarch64 (Q3 1.32e macos-aarch64, Apr 3 2026)
• Defrag: 1.91.3 (gamedate: Feb 29 2024)
• Proxy: cgame-proxy 1.4.0+55208ef (cgameaarch64.dylib, arm64)
• Config: vm_cgame 0

Description

The proxy loads and initializes correctly. I can load into a map and move around normally. However, the game crashes immediately upon switching weapons.

The crash occurs consistently with signals 10 (SIGBUS) and 11 (SIGSEGV):

]Received signal 10, exiting...
----- Client Shutdown (Signal caught (10)) -----
]DOUBLE SIGNAL FAULT: Received signal 11, exiting...

What I've tried

All of the following were tested individually and in combination — none prevent the crash:

• Removing the quarantine xattr from the dylib
• Setting g_synchronousClients 0 (was 1)
• Disabling all mdd_ features in-game before switching weapons:
  • mdd_cgaz 0
  • mdd_snap 0
  • mdd_ammo 0
  • mdd_compass 0
  • mdd_jump 0
  • mdd_gl_path_preview_draw 0

The crash is reproducible on every weapon switch regardless of settings. Removing the cgameaarch64.dylib and falling back to the VM cgame resolves the issue — weapon switching works fine without the proxy.

Console output

Relevant proxy initialization (successful):

Loading dll file cgame.
VM_LoadDLL 'cgameaarch64.dylib' ok
VM_LoadDll(cgame) found **vmMain** at 0x118a89bf8
VM_LoadDll(cgame) succeeded!
^7[^1m^3D^1d^7] cgame-proxy 1.4.0+55208ef

[742617000027]

After some investigation, this turned out to be a bug in the oDFe engine, not the proxy.

Root cause

The engine's VM_Call() in code/qcommon/vm.c has a DLL-mode code path that copies variadic arguments in a loop:

for ( i = 0; i < nargs; i++ ) {
    args[i] = va_arg( ap, int32_t );
}

On ARM64 with -O2, the compiler transforms this into a do-while loop (check at bottom) without a zero-trip guard. When nargs is 0 — which is the case for CG_CONSOLE_COMMAND and CG_SHUTDOWN — the loop never terminates and reads past the stack into the guard page, causing SIGBUS.

The VM interpreter path (used when no DLL is loaded) already has a proper guard, which is why removing the proxy resolves the crash.

Trigger

Weapon switching is the first console command routed to cgame (VM_Call(cgvm, 0, CG_CONSOLE_COMMAND)), which is why the crash consistently appears at that point. Any other cgame console command would trigger it too.

Fix

Submitted a PR to the oDFe engine: Defrag-racing/oDFe#66