Remotely triggered abort (`SIGABRT`, signal 6) crash with `experimental-dual-fund` enabled

[whitslack]

I was experimenting with dual funding, but my node is unstable with experimental-dual-fund enabled. It crashed twice in less than a day, with the same questionably nonsensical stack trace:

2026-03-16T04:09:05.625Z **BROKEN** lightningd: FATAL SIGNAL 6 (version 25.09.3-gentoo-r0)
2026-03-16T04:09:05.626Z **BROKEN** lightningd: backtrace: common/json_filter.c:130 (json_filter_new) 0x563e0038e0d0
2026-03-16T04:09:05.626Z **BROKEN** lightningd: backtrace: common/json_filter.c:138 (json_filter_subobj) 0x563e0038e0d0
2026-03-16T04:09:05.626Z **BROKEN** lightningd: backtrace: (null):0 ((null)) 0x7fc4ff41c08f
2026-03-16T04:09:05.626Z **BROKEN** lightningd: backtrace: (null):0 ((null)) 0x7fc4ff4787e3
2026-03-16T04:09:05.626Z **BROKEN** lightningd: backtrace: (null):0 ((null)) 0x7fc4ff41bf61
2026-03-16T04:09:05.626Z **BROKEN** lightningd: backtrace: (null):0 ((null)) 0x7fc4ff3fff8e
2026-03-16T04:09:05.626Z **BROKEN** lightningd: backtrace: lightningd/jsonrpc.c:63 (command_check_done) 0x563e002ee76c
2026-03-16T04:09:05.626Z **BROKEN** lightningd: backtrace: lightningd/jsonrpc.c:59 (command_check_done) 0x563e002ee76c
2026-03-16T04:09:05.626Z **BROKEN** lightningd: backtrace: lightningd/onchain_control.c:1459 (handle_onchaind_spend_htlc_success) 0x563e0032c2d2
2026-03-16T04:09:05.626Z **BROKEN** lightningd: backtrace: lightningd/onchain_control.c:1682 (onchain_msg) 0x563e0032c2d2
2026-03-16T04:09:05.626Z **BROKEN** lightningd: backtrace: lightningd/channel.c:747 (new_channel) 0x563e00300fdd
2026-03-16T04:09:05.626Z **BROKEN** lightningd: backtrace: lightningd/datastore.c:192 (json_datastore) 0x563e0035961d
2026-03-16T04:09:05.626Z **BROKEN** lightningd: backtrace: (null):0 ((null)) 0x563e0041059a
2026-03-16T04:09:05.626Z **BROKEN** lightningd: backtrace: (null):0 ((null)) 0x563e00410898
2026-03-16T04:09:05.626Z **BROKEN** lightningd: backtrace: (null):0 ((null)) 0x563e00410938
2026-03-16T04:09:05.626Z **BROKEN** lightningd: backtrace: (null):0 ((null)) 0x563e00411072
2026-03-16T04:09:05.626Z **BROKEN** lightningd: backtrace: (null):0 ((null)) 0x563e003fe8c8
2026-03-16T04:09:05.626Z **BROKEN** lightningd: backtrace: ./wallet/wallet.h:1454 (offer_status_active) 0x563e0035a614
2026-03-16T04:09:05.626Z **BROKEN** lightningd: backtrace: lightningd/offer.c:600 (json_listinvoicerequests) 0x563e0035a614
2026-03-16T04:09:05.626Z **BROKEN** lightningd: backtrace: (null):0 ((null)) 0x563e003fe623
2026-03-16T04:09:05.626Z **BROKEN** lightningd: backtrace: (null):0 ((null)) 0x563e00400a4b
2026-03-16T04:09:05.626Z **BROKEN** lightningd: backtrace: lightningd/jsonrpc.c:465 (json_add_help_command) 0x563e0032493e
2026-03-16T04:09:05.626Z **BROKEN** lightningd: backtrace: lightningd/jsonrpc.c:528 (json_help) 0x563e0032493e
2026-03-16T04:09:05.626Z **BROKEN** lightningd: backtrace: /var/tmp/portage/sys-devel/gcc-15.2.1_p20260214/work/gcc-15-20260214/libgcc/../gcc/common/config/i386/cpuinfo.h:1063 (get_available_features) 0x563e002f78bc
2026-03-16T04:09:05.627Z **BROKEN** lightningd: backtrace: /var/tmp/portage/sys-devel/gcc-15.2.1_p20260214/work/gcc-15-20260214/libgcc/../gcc/common/config/i386/cpuinfo.h:1156 (cpu_indicator_init) 0x563e002f78bc
2026-03-16T04:09:05.627Z **BROKEN** lightningd: backtrace: /var/tmp/portage/sys-devel/gcc-15.2.1_p20260214/work/gcc-15-20260214/libgcc/config/i386/cpuinfo.c:62 (__cpu_indicator_init) 0x563e002f78bc
2026-03-16T04:09:05.627Z **BROKEN** lightningd: backtrace: (null):0 ((null)) 0x7fc4ff402019
2026-03-16T04:09:05.627Z **BROKEN** lightningd: backtrace: (null):0 ((null)) 0x7fc4ff402135
2026-03-16T04:09:05.627Z **BROKEN** lightningd: backtrace: lightningd/anchorspend.c:125 (add_one_anchor) 0x563e002f9970
2026-03-16T04:09:05.627Z **BROKEN** lightningd: backtrace: lightningd/anchorspend.c:167 (create_anchor_details) 0x563e002f9970
2026-03-16T04:09:05.627Z **BROKEN** lightningd: backtrace: (null):0 ((null)) 0xffffffffffffffff

I've disabled dual funding again, as I can't risk my node crashing and being offline for hours before I notice, so unfortunately I will not be able to help in further diagnosing the issue.

I can say that I was not interacting with my node at the time of the crashes. They were remotely triggered, presumably by a peer that was attempting to initiate a dual-funded channel opening with my node.

[enaples]

I think it's related to #8780.
It was still present on v25.12 but it should be fixed on v25.12.1

[whitslack]

@enaples: I saw that issue, but I didn't think it was related since I'm not calling any RPCs and certainly not any with a filter specified. Would any part of the dual-funding machinery be calling an RPC and specifying a filter?

My suspicion is that the stack trace is complete garbage and that this crash has nothing to do with JSON filters. I think the stack has been smashed by a buffer overrun, and the stack canary check has failed, triggering a call to abort(), which raises the signal 6.

[enaples]

You are right, I think the crash is not related to dual fund feature. It's very likely that the node logged anchor channel message because in that moment there was an HTLC resolution ongoing.
Is there any chance you installed a new plugin that sends malformed RPC requests to cln?

[whitslack]

I think the crash is not related to dual fund feature.

I think it is related because I got two identical crashes within 24 hours after enabling dual funding, and then the crash has not recurred since I disabled dual funding. I also am aware that another node operator was attempting a dual-funded channel opening with me at the time of the first crash, and they may have been retrying at the time of the second crash. The story I got from them is that they messed up their first opening attempt by passing a different PSBT to openchannel_update immediately after they had called openchannel_init, and they claimed that this caused my node to reject/abort their channel opening. That may have been the moment at which my node crashed.

Is there any chance you installed a new plugin that sends malformed RPC requests to cln?

No chance. I haven't installed or updated any plugins in weeks. The cause can only be related to dual-funding. If the crash occurs again with dual-funding disabled, then that will disprove me. I will comment again here if that happens.

[enaples]

I was able to reproduce the issue in the mentioned PR, second commit.

Yes, apparently, passing a different PSBT to openchannel_update causes the node that called the RPC command to crash instead of getting an RPC error.

For convenience I report the logs:

FAILED tests/test_opening.py::test_openchannel_wrong_psbt_doesnt_crash_peer - jsonschema.exceptions.ValidationError: 'funding_outnum' is a required property

Failed validating 'required' in schema:
    {'required': ['channel_id',
                  'psbt',
                  'commitments_secured',
                  'channel_type',
                  'funding_outnum'],
     'additionalProperties': False,
     'properties': {'channel_id': {'type': 'hash',
                                   'description': ['The channel id of the '
                                                   'channel.']},
                    'channel_type': {'type': 'object',
                                     'description': ['Channel_type as '
                                                     'negotiated with '
                                                     'peer.'],
                                     'added': 'v24.02',
                                     'additionalProperties': False,
                                     'required': ['bits', 'names'],
                                     'properties': {'bits': {'type': 'array',
                                                             'description': ['Each '
                                                                             'bit '
                                                                             'set '
                                                                             'in '
                                                                             'this '
                                                                             'channel_type.'],
                                                             'added': 'v24.02',
                                                             'items': {'type': 'u32',
                                                                       'description': ['Bit '
                                                                                       'number.']}},
                                                    'names': {'type': 'array',
                                                              'description': ['Feature '
                                                                              'name '
                                                                              'for '
                                                                              'each '
                                                                              'bit '
                                                                              'set '
                                                                              'in '
                                                                              'this '
                                                                              'channel_type. '
                                                                              'Note '
                                                                              'that '
                                                                              '*anchors_zero_fee_htlc_tx* '
                                                                              'is '
                                                                              'a '
                                                                              'deprecated '
                                                                              'synonym '
                                                                              'for '
                                                                              '*anchors*.'],
                                                              'added': 'v24.02',
                                                              'items': {'type': 'string',
                                                                        'enum': ['static_remotekey/even',
                                                                                 'anchor_outputs/even',
                                                                                 'anchors_zero_fee_htlc_tx/even',
                                                                                 'anchors/even',
                                                                                 'scid_alias/even',
                                                                                 'zeroconf/even'],
                                                                        'description': ['Name '
                                                                                        'of '
                                                                                        'feature '
                                                                                        'bit.']}}}},
                    'psbt': {'type': 'string',
                             'description': ['The PSBT of the funding '
                                             'transaction.']},
                    'commitments_secured': {'type': 'boolean',
                                            'description': ['Whether the '
                                                            '*psbt* is '
                                                            'complete (if '
                                                            'true, sign '
                                                            '*psbt* and '
                                                            'call '
                                                            '`openchannel_signed` '
                                                            'to complete '
                                                            'the channel '
                                                            'open).']},
                    'funding_outnum': {'type': 'u32',
                                       'description': ['The index of the '
                                                       'funding output in '
                                                       'the psbt.']},
                    'close_to': {'type': 'hex',
                                 'description': ['Scriptpubkey which we '
                                                 'have to close to if we '
                                                 'mutual close.']},
                    'requires_confirmed_inputs': {'type': 'boolean',
                                                  'description': ['Does '
                                                                  'peer '
                                                                  'require '
                                                                  'confirmed '
                                                                  'inputs '
                                                                  'in '
                                                                  'psbt?']}},
     'allOf': [{'if': {'additionalProperties': True,
                       'properties': {'commitments_secured': {'type': 'boolean',
                                                              'enum': [True]}}},
                'then': {'additionalProperties': True,
                         'required': ['channel_id', 'funding_outnum'],
                         'properties': {'commitments_secured': {},
                                        'channel_id': {'type': 'hash',
                                                       'description': ['The '
                                                                       'derived '
                                                                       'channel '
                                                                       'id.']},
                                        'close_to': {'type': 'hex',
                                                     'description': ['If a '
                                                                     '`close_to` '
                                                                     'address '
                                                                     'was '
                                                                     'provided '
                                                                     'to '
                                                                     '`openchannel_init` '
                                                                     'and '
                                                                     'the '
                                                                     'peer '
                                                                     'supports '
                                                                     '`option_upfront_shutdownscript`.']},
                                        'funding_outnum': {'type': 'u32',
                                                           'description': ['The '
                                                                           'index '
                                                                           'of '
                                                                           'the '
                                                                           'funding '
                                                                           'output '
                                                                           'for '
                                                                           'this '
                                                                           'channel '
                                                                           'in '
                                                                           'the '
                                                                           'funding '
                                                                           'transaction.']}}},
                'else': {'additionalProperties': False,
                         'properties': {'commitments_secured': {}}}}]}

On instance:
    {'channel_id': '2c383675809577b343f57acbea98d51dd913817874a3b621173f3fe2ea519c45',
     'psbt': 'cHNidP8BAgQCAAAAAQMEZgAAAAEEAQEBBQEBAQYBAwH7BAIAAAAAAQC0AgAAAAHeXUqJ+FMURF99QfNesChSzK29vAwv0ihuBf7QmaKCVQAAAAAA/f///wMw6MgpAQAAACJRIBgbpQcLvoxNWf3/x8OKAJYfeeIl3uZmfsd7Bc9w3HSjgIQeAAAAAAAiUSC5UNiwZgMpisf3FGL565UvuL4AQpOWN0jlcQ/ii1Nww4CEHgAAAAAAIlEgn6TSTp2kPFv4/A2XNtTkRSOKzXFNBoEW31Fl0Hkduh1lAAAAAQErgIQeAAAAAAAiUSCfpNJOnaQ8W/j8DZc21ORFI4rNcU0GgRbfUWXQeR26HQEOIPnY/JD6DVlLzXo7V7sgDxHVu4zCxZ3UBSP7ttjjASwoAQ8EAgAAAAEQBP3///8M/AlsaWdodG5pbmcBCD9OB5zUzdoUAAEDCMbqHAAAAAAAAQQiUSDLmLufQyk2EMedQ8Kz3wihNg/lGfQmqqD9Ce/mACuAugz8CWxpZ2h0bmluZwEIV5Xu3sckCyQA',
     'channel_type': {'bits': [12, 22],
                      'names': ['static_remotekey/even', 'anchors/even']},
     'commitments_secured': False,
     'funding_serial': 3014915220181719196,
     'requires_confirmed_inputs': False}


ERROR tests/test_opening.py::test_openchannel_wrong_psbt_doesnt_crash_peer - ValueError: 
Node errors:
 - lightningd-1: had BROKEN or That's weird messages
 - lightningd-1: had memleak messages
Global errors:
 - Node /tmp/ltests-v1hn5dn1/test_openchannel_wrong_psbt_doesnt_crash_peer_1/lightning-1/ has memory leaks: [
    {
        "subdaemon": "dualopend"
    }
]

[whitslack]

Yes, apparently, passing a different PSBT to openchannel_update causes the node that called the RPC command to crash instead of getting an RPC error.

Okay, well that's a separate issue. Mine wasn't the node that called any openchannel RPCs. My node was totally passive. The other node was able to crash my node remotely, with no interaction from me. That's what makes this bug so devastating.

[enaples]

Reading carefully the error, it is from pyln-testing library side (validation) and not from a protocol point of view. Indeed, I tried to reproduce the issue locally and I wasn't able to crash both nodes, nor logs gave me FATAL SIGNAL 6.