2042985 - Crash in [@ mio::sys::windows::selector::SelectorInner::feed_events] with CFG indirect call failures on Firefox 150

Status: ASSIGNED

(Core :: Audio/Video: cubeb, defect)

Description

[Matthew Gregan [:kinetik]]

Spun off from bug 1794992 (sec-restricted), which originally tracked a
mozjemalloc UAF (0xe5e5 poison) on this signature on ESR-115. That UAF
pattern is gone on supported branches as of the mio 1.1.1 update in bug
2024485. A residual non-UAF crash pattern on the same signature remains
on Firefox 150+, tracked here as a stability issue.

Volume and character (last 70 days on release, post-fix):
56 crashes total, 52 of which are
EXCEPTION_STACK_BUFFER_OVERRUN / FAST_FAIL_GUARD_ICALL_CHECK_FAILURE
(Control Flow Guard rejecting an indirect call target).
3 are EXCEPTION_ACCESS_VIOLATION_READ on pointer-shaped addresses
(not 0xe5e5 poison).
1 is EXCEPTION_ACCESS_VIOLATION_EXEC.

Distribution:
150.0.1: 40 (all build 20260427013024)
150.0: 3
150.0.2: 1
150.0.3: 4
149.0: 1
149.0.2: 1
148.0.2: 3
151.0: 1
151.0.1: 2

The 150.0.1 cluster has very specific environmental concentration:

• All build 20260427013024
• 39/40 on Windows 10 19045
• All in parent process (AudioIPC Server RPC thread)
• CPU concentration: family 6 model 60 (Haswell, 19),
  family 6 model 55 (Bay Trail Atom, 12),
  family 6 model 69 (Haswell-ULT, 7)

Sample stack (f40f3323-c7a9-4b72-9792-dae540260508):
LdrpICallHandler
RtlpExecuteHandlerForException
RtlDispatchException
KiUserExceptionDispatch
LdrpDispatchUserCallTarget <- CFG check fails here
mio::sys::windows::selector::SelectorInner::select2
mio::poll::Poll::poll
audioipc2::ipccore::EventLoop::poll

The "left half of MAGIC intact, right half corrupted" buffer-corruption
pattern seen in bug 1986089 may or may not be related; both signatures
sit on the same audioipc2 event loop on Windows.

CFG-caught failures terminate the process safely (not exploitable), so
this is a stability rather than security issue. Severity S3 reflects the
low volume and benign termination.