Skip to content

Crash-on-android-universal-mhrv_rs #330

Closed
Closed
Crash-on-android-universal-mhrv_rs#330
Labels
bugSomething isn't working

Description

@Plangto
Plangto
opened on Apr 27, 2026

When mode is on vpn tune i connect its nice but when click on disconnect it closes the app itself and disconnect

Activity

  1. therealaleph commented on Apr 27, 2026

    @therealaleph
    therealaleph
    on Apr 27, 2026
    Owner

    @Plangto — that's a real bug. App crashing on disconnect (not just disconnecting cleanly) means an unhandled exception or native crash in the VpnService teardown path. Likely candidates:

    1. tun2proxy native shutdown panic — the libtun2proxy.so library is dlopen'd at runtime (per feat: enable udpgw client via tun2proxy CLI API — no fork needed #271) and called via JNI; if its shutdown function panics, the whole process aborts.
    2. VpnService cleanup race — file descriptor of the TUN device is closed twice or used after close.
    3. Java ↔ native thread join issue — Kotlin code calls into native to stop, native blocks waiting for tun2proxy thread, deadlocks or panics.

    To narrow down, I need the logcat output around the crash. Specifically:

    # On a desktop with adb:
adb logcat -c                        # clear log
adb logcat | grep -iE "mhrv|tun2proxy|vpn|FATAL|SIGSEGV|AndroidRuntime"
# Then on the Android device:
# - open mhrv-rs
# - connect (in tunnel mode)
# - wait for it to confirm connected
# - tap disconnect → app crashes
# - the logcat output up to + including the crash is what we need

    Save and paste the output here (just the lines around the crash, ideally the last ~50 lines before app process dies).

    If you don't have a desktop with adb available, on the device itself you can:

    1. Install Logcat Reader (free on F-Droid) or Material Files + Termux
    2. Reproduce the crash
    3. Open Logcat Reader → look at recent entries → filter by mhrv → screenshot the crash trace

    A few questions to bound the issue:

    1. Which APK build? Universal? Or per-ABI (arm64-v8a / armeabi-v7a / x86_64 / x86)? Different ABIs have different libtun2proxy.so builds; one may have a regression.
    2. Android version of your device?
    3. Mode at the time of crash: Tunnel mode + apps_script? Or Tunnel mode + Full? Crash happens for both, or only one?
    4. Does it happen every time you disconnect, or intermittently?

    Tracking as a v1.7.x bug. If it reproduces consistently in apps_script mode, that points at the tun2proxy shutdown path. If only in Full mode, that points at the tunnel-node connection-cleanup path.

    This issue stays open until we have the logcat + can fix.

    [reply via Anthropic Claude | reviewed by @therealaleph]

  2. therealaleph
    added
    bugSomething isn't working
    on Apr 27, 2026

  3. Plangto commented on May 2, 2026

    @Plangto
    Plangto
    on May 2, 2026
    Author

    @Plangto — that's a real bug. App crashing on disconnect (not just disconnecting cleanly) means an unhandled exception or native crash in the VpnService teardown path. Likely candidates:

    1. tun2proxy native shutdown panic — the libtun2proxy.so library is dlopen'd at runtime (per feat: enable udpgw client via tun2proxy CLI API — no fork needed #271) and called via JNI; if its shutdown function panics, the whole process aborts.
    2. VpnService cleanup race — file descriptor of the TUN device is closed twice or used after close.
    3. Java ↔ native thread join issue — Kotlin code calls into native to stop, native blocks waiting for tun2proxy thread, deadlocks or panics.

    To narrow down, I need the logcat output around the crash. Specifically:

    On a desktop with adb:

    adb logcat -c # clear log
    adb logcat | grep -iE "mhrv|tun2proxy|vpn|FATAL|SIGSEGV|AndroidRuntime"

    Then on the Android device:

    - open mhrv-rs

    - connect (in tunnel mode)

    - wait for it to confirm connected

    - tap disconnect → app crashes

    - the logcat output up to + including the crash is what we need

    Save and paste the output here (just the lines around the crash, ideally the last ~50 lines before app process dies).

    If you don't have a desktop with adb available, on the device itself you can:

    1. Install Logcat Reader (free on F-Droid) or Material Files + Termux
    2. Reproduce the crash
    3. Open Logcat Reader → look at recent entries → filter by mhrv → screenshot the crash trace

    A few questions to bound the issue:

    1. Which APK build? Universal? Or per-ABI (arm64-v8a / armeabi-v7a / x86_64 / x86)? Different ABIs have different libtun2proxy.so builds; one may have a regression.
    2. Android version of your device?
    3. Mode at the time of crash: Tunnel mode + apps_script? Or Tunnel mode + Full? Crash happens for both, or only one?
    4. Does it happen every time you disconnect, or intermittently?

    Tracking as a v1.7.x bug. If it reproduces consistently in apps_script mode, that points at the tun2proxy shutdown path. If only in Full mode, that points at the tunnel-node connection-cleanup path.

    This issue stays open until we have the logcat + can fix.

    [reply via Anthropic Claude | reviewed by @therealaleph]

    -------- beginning of system
    05-02 10:47:05.651 1616 2548 W XSpaceManagerServiceImpl: checkXSpaceControl, from:com.mi.android.globallauncher, to:com.therealaleph.mhrv, with act:android.intent.action.MAIN, callingUserId:0, toUserId:0
    05-02 10:47:05.652 1616 2548 I ActivityTaskManager: START u0 {act=android.intent.action.MAIN cat=[android.intent.category.LAUNCHER] flg=0x10200000 cmp=com.therealaleph.mhrv/.MainActivity bnds=[440,143][641,344] (has extras)} from uid 10111 from pid 2997 callingPackage com.mi.android.globallauncher
    05-02 10:47:05.657 1616 2548 D MiuiFreeFormManagerService: onStartActivityInner as = Task{3ab08d1 #789 type=standard A=11915:com.therealaleph.mhrv U=0 visible=false mode=fullscreen translucent=true sz=1} op = ActivityOptions(141640950), mPackageName=null, mAnimationType=13, mStartX=0, mStartY=0, mWidth=0, mHeight=0, activityOptionsInjector=ActivityOptionsInjector={freeformScale: -1.0, miniFreeformMode: false, needAnimation: true, useCustomLaunchBounds:false}
    --------- beginning of main
    05-02 10:47:05.664 1616 2548 D PerfImpl: perfWarmLaunchBoost: com.therealaleph.mhrv, -1, 1
    05-02 10:47:05.675 1616 4893 D PerfImpl: perfWarmLaunchBoost: com.therealaleph.mhrv, -1, 1
    05-02 10:47:05.675 1616 4893 D PerfImpl: perfAnimBoost: com.therealaleph.mhrv
    05-02 10:47:05.687 5910 5927 I GST : forePkg: com.therealaleph.mhrv, preForePkg: com.mi.android.globallauncher
    05-02 10:47:05.687 1616 2569 D CameraBlackCoveredManager: mForegroundPackage = com.therealaleph.mhrv mOccupiedPackage = com.intsig.camscanner
    05-02 10:47:05.687 5881 9079 D PerfEngineController: ForegroundInfo{mForegroundPackageName='com.therealaleph.mhrv', mForegroundUid=11915, mForegroundPid=16842, mLastForegroundPackageName='com.mi.android.globallauncher', mLastForegroundUid=10111, mLastForegroundPid=2997, mMultiWindowForegroundPackageName='com.therealaleph.mhrv', mMultiWindowForegroundUid=11915, mFlags=0}
    05-02 10:47:05.688 15391 15401 D AutoInstallService: onForegroundInfoChanged: com.therealaleph.mhrv
    05-02 10:47:05.688 5881 6108 D LS-ForegroundStatusManager: handleMessage ForegroundInfoChanged. pkg = com.therealaleph.mhrv, uid = 11915, mCurrentForegroundUid = 10111
    05-02 10:47:05.688 4470 7508 I ProcessMonitor: onForegroundInfoChanged: ForegroundInfo{mForegroundPackageName='com.therealaleph.mhrv', mForegroundUid=11915, mForegroundPid=16842, mLastForegroundPackageName='com.mi.android.globallauncher', mLastForegroundUid=10111, mLastForegroundPid=2997, mMultiWindowForegroundPackageName='com.therealaleph.mhrv', mMultiWindowForegroundUid=11915, mFlags=0}
    05-02 10:47:05.689 4470 7508 I GameBoosterService: onForegroundInfoChanged: Cur=com.therealaleph.mhrv last=com.mi.android.globallauncher
    05-02 10:47:05.693 4470 7508 D GameBoosterService: onGameStatusChange foreground:ForegroundInfo{mForegroundPackageName='com.therealaleph.mhrv', mForegroundUid=11915, mForegroundPid=16842, mLastForegroundPackageName='com.mi.android.globallauncher', mLastForegroundUid=10111, mLastForegroundPid=2997, mMultiWindowForegroundPackageName='com.therealaleph.mhrv', mMultiWindowForegroundUid=11915, mFlags=0}
    05-02 10:47:05.698 4470 7508 D GlobalDock-MonitorService: onForegroundInfoChanged: appUserId=0 myUserId=0 foregroundInfo = ForegroundInfo{mForegroundPackageName='com.therealaleph.mhrv', mForegroundUid=11915, mForegroundPid=16842, mLastForegroundPackageName='com.mi.android.globallauncher', mLastForegroundUid=10111, mLastForegroundPid=2997, mMultiWindowForegroundPackageName='com.therealaleph.mhrv', mMultiWindowForegroundUid=11915, mFlags=0}
    05-02 10:47:05.700 1616 2861 V MiuiActivityTaskManagerServiceEx: dispatchActivityLifeState r = ActivityRecord{d12fbf8 u0 com.therealaleph.mhrv/.MainActivity t789}
    05-02 10:47:05.704 1616 2548 D WindowManager: Input focus has changed to Window{72dff3b u0 com.therealaleph.mhrv/com.therealaleph.mhrv.MainActivity} display=0
    05-02 10:47:05.716 2997 2997 D RecentsImpl: mActivityStateObserver com.therealaleph.mhrv.MainActivity
    05-02 10:47:05.724 1616 1981 D PerfImpl: perfFirstDrawBoost: com.therealaleph.mhrv, 16842, 1
    05-02 10:47:05.736 4074 4074 I GoogleInputMethodService: GoogleInputMethodService.onStartInput():1385 onStartInput(EditorInfo{EditorInfo{packageName=com.therealaleph.mhrv, inputType=0, inputTypeString=NULL, enableLearning=false, autoCorrection=false, autoComplete=false, imeOptions=0, privateImeOptions=null, actionName=UNSPECIFIED, actionLabel=null, initialSelStart=-1, initialSelEnd=-1, initialCapsMode=0, label=null, fieldId=-1, fieldName=null, extras=null, hintText=null, hintLocales=[]}}, false)
    05-02 10:47:06.228 5881 6139 I DisplayFrameSetting: homeToAppEnd pkg=com.therealaleph.mhrv
    05-02 10:47:09.262 1616 2475 D MIUIInput: [MotionEvent] publisher action=0x0, 141259819, channel '72dff3b com.therealaleph.mhrv/com.therealaleph.mhrv.MainActivity (server)'
    05-02 10:47:09.338 1616 2475 D MIUIInput: [MotionEvent] publisher action=0x1, 141259897, channel '72dff3b com.therealaleph.mhrv/com.therealaleph.mhrv.MainActivity (server)'
    05-02 10:47:09.354 1085 1085 I vendor.qti.hardware.servicetracker@1.2-service: startService() is called for servicecom.therealaleph.mhrv/.MhrvVpnService
    05-02 10:47:09.406 16842 16842 I mhrv_rs : 2026-05-02T07:17:09.406503Z INFO Loaded MITM CA from /data/user/0/com.therealaleph.mhrv/files/ca/ca.crt
    05-02 10:47:09.430 1085 1085 I vendor.qti.hardware.servicetracker@1.2-service: bindService is called for service : com.therealaleph.mhrv/.MhrvVpnService and for client system
    05-02 10:47:09.430 1085 1085 I vendor.qti.hardware.servicetracker@1.2-service: total connections for service : com.therealaleph.mhrv/.MhrvVpnServiceare :1
    05-02 10:47:09.442 5881 5907 D PowerKeeper.Vpn: added vpn iface: tun0
    05-02 10:47:09.447 1616 2548 D ConnectivityService: registerNetworkAgent NetworkAgentInfo{network{258} handle{1111507259405} ni{VPN CONNECTING extra: } created=2026-05-02T07:17:09.446Z Score(Policies : IS_VPN ; KeepConnected : 0) lp{{InterfaceName: tun0 LinkAddresses: [ 10.0.0.2/32 ] DnsAddresses: [ /1.1.1.1 ] Domains: MTU: 1500 Routes: [ 0.0.0.0/0 -> 0.0.0.0 tun0 mtu 0,::/0 unreachable mtu 0 ]}} nc{[ Transports: VPN Capabilities: INTERNET&NOT_RESTRICTED&TRUSTED&NOT_VCN_MANAGED TransportInfo: <VpnTransportInfo{type=1, sessionId=mhrv-rs, bypassable=false longLivedTcpConnectionsExpensive=false}> Uids: <{99900000-99911914, 99911916-99999999, 0-11914, 11916-99999}> OwnerUid: 11915 AdminUids: [11915] UnderlyingNetworks: Null]} factorySerialNumber=5}
    05-02 10:47:09.448 1616 2548 I Vpn : Established by com.therealaleph.mhrv on tun0
    05-02 10:47:09.450 16842 18190 I mhrv_rs : 2026-05-02T07:17:09.450743Z INFO runTun2proxy: cli=tun2proxy --proxy socks5://127.0.0.1:1081 --tun-fd 128 --dns virtual --verbosity info --close-fd-on-drop true
    05-02 10:47:09.453 5881 5995 D PowerKeeper.Vpn: add vpn: user = com.therealaleph.mhrv, uid = 11915, userId = 0
    05-02 10:47:09.633 1616 1976 I GnssNetworkConnectivityHandler: updateNetworkState, state=CLOSED, connected=true, network=258, capabilities=[ Transports: WIFI|VPN Capabilities: INTERNET&NOT_RESTRICTED&TRUSTED&VALIDATED&NOT_ROAMING&FOREGROUND&NOT_CONGESTED&NOT_SUSPENDED&NOT_VCN_MANAGED LinkUpBandwidth>=39947Kbps LinkDnBandwidth>=35014Kbps TransportInfo: <VpnTransportInfo{type=1, sessionId=mhrv-rs, bypassable=false longLivedTcpConnectionsExpensive=false}> Uids: <{99900000-99911914, 99911916-99999999, 0-11914, 11916-99999}> AdminUids: [11915] UnderlyingNetworks: [257]], apn: , availableNetworkCount: 2
    05-02 10:47:09.666 2974 2974 D InterruptionStateProvider: No bubble up: not allowed to bubble: 0|com.therealaleph.mhrv|4097|null|11915
    05-02 10:47:09.674 2974 3216 D PeopleSpaceWidgetMgr: Sbn doesn't contain valid PeopleTileKey: null/0/com.therealaleph.mhrv
    05-02 10:47:09.698 2974 3216 D IconCustomizer: Generate customized icon for com.therealaleph.mhrv.png
    05-02 10:47:13.687 1616 2475 D MIUIInput: [MotionEvent] publisher action=0x0, 141264246, channel '72dff3b com.therealaleph.mhrv/com.therealaleph.mhrv.MainActivity (server)'
    05-02 10:47:13.749 1616 2475 D MIUIInput: [MotionEvent] publisher action=0x1, 141264308, channel '72dff3b com.therealaleph.mhrv/com.therealaleph.mhrv.MainActivity (server)'
    05-02 10:47:13.753 16842 16842 I MhrvVpnService: onStartCommand action=com.therealaleph.mhrv.STOP startId=2
    05-02 10:47:13.755 16842 18416 I MhrvVpnService: teardown: begin caller=mhrv-teardown (tun2proxy running=true, proxyHandle=1)
    05-02 10:47:13.757 16842 18417 D nativeloader: Load /data/app/~~mgnTi9PGjnLpUyP4ybEv5w==/com.therealaleph.mhrv-06oYsNkjB6uDHVniua9Irw==/base.apk!/lib/arm64-v8a/libtun2proxy.so using class loader ns clns-4 (caller=/data/app/~~mgnTi9PGjnLpUyP4ybEv5w==/com.therealaleph.mhrv-06oYsNkjB6uDHVniua9Irw==/base.apk!classes2.dex): ok
    05-02 10:47:13.779 2974 3216 D PeopleSpaceWidgetMgr: Sbn doesn't contain valid PeopleTileKey: null/0/com.therealaleph.mhrv
    05-02 10:47:13.793 1085 4502 I vendor.qti.hardware.servicetracker@1.2-service: unbindService is called for service : com.therealaleph.mhrv/.MhrvVpnService and for client system
    05-02 10:47:13.793 1085 4502 I vendor.qti.hardware.servicetracker@1.2-service: size of service connections for service: com.therealaleph.mhrv/.MhrvVpnServiceafter removal is 0
    05-02 10:47:13.793 1085 4502 I vendor.qti.hardware.servicetracker@1.2-service: destroyService is called for service : com.therealaleph.mhrv/.MhrvVpnService
    05-02 10:47:13.795 5881 6166 D PowerKeeper.Vpn: removed vpn iface: tun0
    05-02 10:47:13.795 5881 5995 D PowerKeeper.Vpn: removed vpn: 11915
    05-02 10:47:13.831 1616 1976 I GnssNetworkConnectivityHandler: updateNetworkState, state=CLOSED, connected=false, network=258, capabilities=[ Transports: WIFI|VPN Capabilities: INTERNET&NOT_RESTRICTED&TRUSTED&VALIDATED&NOT_ROAMING&FOREGROUND&NOT_CONGESTED&NOT_SUSPENDED&NOT_VCN_MANAGED LinkUpBandwidth>=39947Kbps LinkDnBandwidth>=35014Kbps TransportInfo: <VpnTransportInfo{type=1, sessionId=mhrv-rs, bypassable=false longLivedTcpConnectionsExpensive=false}> Uids: <{99900000-99911914, 99911916-99999999, 0-11914, 11916-99999}> AdminUids: [11915] UnderlyingNetworks: [257]], apn: , availableNetworkCount: 1
    05-02 10:47:15.892 1616 1732 I WindowManager: WIN DEATH: Window{72dff3b u0 com.therealaleph.mhrv/com.therealaleph.mhrv.MainActivity}
    05-02 10:47:15.892 1616 1732 W InputManager-JNI: Input channel object '72dff3b com.therealaleph.mhrv/com.therealaleph.mhrv.MainActivity (client)' was disposed without first being removed with the input manager!
    05-02 10:47:15.895 1616 4045 I ActivityManager: Process com.therealaleph.mhrv (pid 16842) has died: fg TOP
    05-02 10:47:15.905 1616 4045 W ActivityTaskManager: Force removing ActivityRecord{d12fbf8 u0 com.therealaleph.mhrv/.MainActivity t789}: app died, no saved state
    05-02 10:47:15.915 5881 6166 D PerfEngineController: ForegroundInfo{mForegroundPackageName='com.mi.android.globallauncher', mForegroundUid=10111, mForegroundPid=2997, mLastForegroundPackageName='com.therealaleph.mhrv', mLastForegroundUid=11915, mLastForegroundPid=16842, mMultiWindowForegroundPackageName='com.mi.android.globallauncher', mMultiWindowForegroundUid=10111, mFlags=0}
    05-02 10:47:15.915 5910 5927 I GST : forePkg: com.mi.android.globallauncher, preForePkg: com.therealaleph.mhrv
    05-02 10:47:15.916 4470 12095 I ProcessMonitor: onForegroundInfoChanged: ForegroundInfo{mForegroundPackageName='com.mi.android.globallauncher', mForegroundUid=10111, mForegroundPid=2997, mLastForegroundPackageName='com.therealaleph.mhrv', mLastForegroundUid=11915, mLastForegroundPid=16842, mMultiWindowForegroundPackageName='com.mi.android.globallauncher', mMultiWindowForegroundUid=10111, mFlags=0}
    05-02 10:47:15.919 4470 12095 I GameBoosterService: onForegroundInfoChanged: Cur=com.mi.android.globallauncher last=com.therealaleph.mhrv
    05-02 10:47:15.920 4470 12095 D GameBoosterService: onGameStatusChange foreground:ForegroundInfo{mForegroundPackageName='com.mi.android.globallauncher', mForegroundUid=10111, mForegroundPid=2997, mLastForegroundPackageName='com.therealaleph.mhrv', mLastForegroundUid=11915, mLastForegroundPid=16842, mMultiWindowForegroundPackageName='com.mi.android.globallauncher', mMultiWindowForegroundUid=10111, mFlags=0}
    05-02 10:47:15.923 4470 12095 D GlobalDock-MonitorService: onForegroundInfoChanged: appUserId=0 myUserId=0 foregroundInfo = ForegroundInfo{mForegroundPackageName='com.mi.android.globallauncher', mForegroundUid=10111, mForegroundPid=2997, mLastForegroundPackageName='com.therealaleph.mhrv', mLastForegroundUid=11915, mLastForegroundPid=16842, mMultiWindowForegroundPackageName='com.mi.android.globallauncher', mMultiWindowForegroundUid=10111, mFlags=0}

  4. Plangto commented on May 2, 2026

    @Plangto
    Plangto
    on May 2, 2026
    Author

    btw the crash is still same in v1.9.7

  5. therealaleph commented on May 2, 2026

    @therealaleph
    therealaleph
    on May 2, 2026
    Owner

    @Plangto — log رو دیدم. اتفاق چیه:

    1. MhrvVpnService: onStartCommand action=...STOP — tap Disconnect
    2. MhrvVpnService: teardown: begin — تردید سرویس شروع می‌شه
    3. nativeloader: Load /data/.../libtun2proxy.so — JNI loading libtun2proxy.so for Tun2proxy.stop()
    4. بعد از ~۲ ثانیه: process dies

    علت احتمالی race در shared mutable state بین Native.runTun2proxy() (که قبلاً libtun2proxy.so رو via dlsym باز کرده بود) و Tun2proxy.stop() (که الان میخواد همان lib رو via JNI استفاده کنه) — هنگام اجرای همزمان Tun2proxy.stop() و close فد + تحویل tun2proxy native، یک crash silently رخ می‌ده.

    status کار:

    این bug را تأیید می‌کنم + برای v1.9.x candidate ذخیره کرده‌ام. دو راه برای fix:

    1. حذف Tun2proxy.stop() call — let close-on-fd-EOF natively تمام کنه (closeFdOnDrop = true که در argp set شده، tun2proxy خود وقتی fd بسته شد drop می‌کنه). این path از race کمتر استفاده می‌کنه.
    2. wrap Tun2proxy.stop() در runCatching — اگه crash رخ داد، silently catch بشه (Java try/catch already wraps it ولی ممکنه native abort سبک رو به‌سختی catch کنه).

    پیاده‌سازی نیاز به test روی device واقعی Android داره (که فعلاً در دسترس ندارم). آماده می‌شه برای v1.9.x.

    workaround تا fix:

    به‌جای دکمهٔ Disconnect، direct از system VPN settings disconnect کن:

    • Settings → Network & internet → VPN → mhrv-rs → Disconnect

    این path تردید سرویس از طریق onRevoke() می‌ره که دیگر Tun2proxy.stop() فراخوانی نمی‌کنه + crash پیش نمیاد.

    می‌گذارم open به‌عنوان tracking. وقتی fix در یک release ship شد، اعلام می‌کنم.

    [reply via Anthropic Claude | reviewed by @therealaleph]

  6. Plangto commented on May 4, 2026

    @Plangto
    Plangto
    on May 4, 2026
    Author

    Still same crash on v1.9.10

  7. therealaleph commented on May 5, 2026

    @therealaleph
    therealaleph
    on May 5, 2026
    Owner

    @Plangto — this is the disconnect-crash bug from before v1.9.8. Tracked as canonical thread #666 + #700 with two distinct root causes:

    1. App crashes when tapping Disconnect button #666 (fixed in v1.9.8): MainActivity.onStop was calling stopService() immediately after startService(ACTION_STOP) — the redundant stopService() triggered onDestroy() while the teardown thread was still running, racing the lifecycle.
    2. App crashes ~2 seconds after Disconnect due to teardown ordering — worker thread still in native code when Rust runtime is killed #700 (fixed in v1.9.9): even after App crashes when tapping Disconnect button #666's fix, a separate use-after-free remained — Native.stopProxy was called LAST in teardown, but the tun2proxy worker was still in a native blocking read of the SOCKS5 socket. When stopProxy freed the runtime, the worker hit use-after-free → SIGSEGV ~2s later. Fix: stopProxy now goes FIRST so the worker's blocking read returns cleanly.

    Both fixes are live in v1.9.9 / v1.9.10 / v1.9.11 / v1.9.12. Update to the latest release (releases page) and the disconnect crash should be gone.

    If you're already on v1.9.9+ and still see a crash, paste the full log + Android version and we'll dig deeper. Otherwise closing.

    [reply via Anthropic Claude | reviewed by @therealaleph]

  8. therealaleph
    closed this as completedon May 5, 2026

  9. Plangto commented on May 5, 2026

    @Plangto
    Plangto
    on May 5, 2026
    Author

    @Plangto — this is the disconnect-crash bug from before v1.9.8. Tracked as canonical thread #666 + #700 with two distinct root causes:

    1. App crashes when tapping Disconnect button #666 (fixed in v1.9.8): MainActivity.onStop was calling stopService() immediately after startService(ACTION_STOP) — the redundant stopService() triggered onDestroy() while the teardown thread was still running, racing the lifecycle.
    2. App crashes ~2 seconds after Disconnect due to teardown ordering — worker thread still in native code when Rust runtime is killed #700 (fixed in v1.9.9): even after App crashes when tapping Disconnect button #666's fix, a separate use-after-free remained — Native.stopProxy was called LAST in teardown, but the tun2proxy worker was still in a native blocking read of the SOCKS5 socket. When stopProxy freed the runtime, the worker hit use-after-free → SIGSEGV ~2s later. Fix: stopProxy now goes FIRST so the worker's blocking read returns cleanly.

    Both fixes are live in v1.9.9 / v1.9.10 / v1.9.11 / v1.9.12. Update to the latest release (releases page) and the disconnect crash should be gone.

    If you're already on v1.9.9+ and still see a crash, paste the full log + Android version and we'll dig deeper. Otherwise closing.

    [reply via Anthropic Claude | reviewed by @therealaleph]

    Im using version 1.9.10 and it still has the same crash

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions