[Bug] exteraGram crashes after patching (MTE: Pointer tag truncated when integrated patch and Segmentation Violation: Access Error when local patch)

[AlexeiCrystal]

Steps to reproduce/复现步骤

Expected behaviour/预期行为

Actual behaviour/实际行为

Xposed Module List/Xposed 模块列表

-

LSPatch version/LSPatch 版本

1.2

Android version/Android 版本

Android 12, MIUI 14

Shizuku version/Shizuku 版本

13.6.0.r1086

Version requirement/版本要求

• I am using latest debug CI version of LSPatch and enable verbose log/我正在使用最新 CI 调试版本且启用详细日志

Apk file/Apk 文件

https://t.me/exteraGram
https://t.me/exteraReleases/156

Logs/日志

Crash when integrated patch:

DEBUG: *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
DEBUG: Build fingerprint: 'Redmi/joyeuse_global/joyeuse:12/SKQ1.211019.001/V14.0.3.0.SJZMIXM:user/release-keys'
DEBUG: Revision: '0'
DEBUG: ABI: 'arm64'
DEBUG: Timestamp: 2026-08-27 10:36:00.645976535+0300
DEBUG: Process uptime: 0s
DEBUG: Cmdline: com.exteragram.messenger
DEBUG: pid: 29931, tid: 29964, name: Verification th  >>> com.exteragram.messenger <<<
DEBUG: uid: 15909
DEBUG: signal 6 (SIGABRT), code -1 (SI_QUEUE), fault addr --------
DEBUG: Abort message: 'Pointer tag for 0x7e3df62000 was truncated, see 'https://source.android.com/devices/tech/debug/tagged-pointers'.'
DEBUG:     x0  0000000000000000  x1  000000000000750c  x2  0000000000000006  x3  0000007edc7bc900
DEBUG:     x4  8080808080808080  x5  8080808080808080  x6  8080808080808080  x7  8080808080808080
DEBUG:     x8  00000000000000f0  x9  d07058c3f8970c48  x10 0000000000000000  x11 ffffff80fffffbdf
DEBUG:     x12 0000000000000001  x13 0000000100000000  x14 0000007f74f6b1c0  x15 0000000000000048
DEBUG:     x16 0000007f74d45d30  x17 0000007f74d1f930  x18 0000007e77b3a000  x19 00000000000074eb
DEBUG:     x20 000000000000750c  x21 00000000ffffffff  x22 b400007ecc453000  x23 b400007f9f310400
DEBUG:     x24 0000000003bdde90  x25 b400007e76e681c0  x26 0000007e7475d638  x27 0000007eebe0e000
DEBUG:     x28 0000007eebe0d528  x29 0000007edc7bc980
DEBUG:     lr  0000007f74ccfcdc  sp  0000007edc7bc8e0  pc  0000007f74ccfd08  pst 0000000000001000
DEBUG: backtrace:
DEBUG:       #00 pc 000000000008bd08  /apex/com.android.runtime/lib64/bionic/libc.so (abort+168) (BuildId: 2f84be24a19d511a358a9050af5b3974)
DEBUG:       #01 pc 0000000000048c4c  /apex/com.android.runtime/lib64/bionic/libc.so (free+108) (BuildId: 2f84be24a19d511a358a9050af5b3974)
DEBUG:       #02 pc 00000000003d8060  /apex/com.android.art/lib64/libart.so!libart.so (art::mirror::Class::SetStatus(art::Handle<art::mirror::Class>, art::ClassStatus, art::Thread*)+3496) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
DEBUG:       #03 pc 000000000022bdf0  /apex/com.android.art/lib64/libart.so!libart.so (art::ClassLinker::FindClassInBaseDexClassLoader(art::Thread*, char const*, unsigned long, unsigned long, art::Handle<art::mirror::ClassLoader>, art::ObjPtr<art::mirror::Class>*)+964) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
DEBUG:       #04 pc 000000000027e22c  /apex/com.android.art/lib64/libart.so!libart.so (art::ClassLinker::FindClass(art::Thread*, char const*, unsigned long, art::Handle<art::mirror::ClassLoader>)+924) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
DEBUG:       #05 pc 0000000000391714  /apex/com.android.art/lib64/libart.so!libart.so (art::ClassLinker::DoResolveType(art::dex::TypeIndex, art::Handle<art::mirror::DexCache>, art::Handle<art::mirror::ClassLoader>)+120) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
DEBUG:       #06 pc 00000000003a1884  /apex/com.android.art/lib64/libart.so!libart.so (art::verifier::RegType const& art::verifier::impl::(anonymous namespace)::MethodVerifierImpl::ResolveClass<(art::verifier::impl::(anonymous namespace)::CheckAccess)2>(art::dex::TypeIndex) (.__uniq.63246233319839034720636906213703941800)+656) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
DEBUG:       #07 pc 0000000000398dc8  /apex/com.android.art/lib64/libart.so!libart.so (art::verifier::impl::(anonymous namespace)::MethodVerifier<false>::CodeFlowVerifyInstruction(unsigned int*) (.__uniq.63246233319839034720636906213703941800)+2808) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
DEBUG:       #08 pc 00000000003978e4  /apex/com.android.art/lib64/libart.so!libart.so (art::verifier::impl::(anonymous namespace)::MethodVerifier<false>::Verify() (.__uniq.63246233319839034720636906213703941800)+792) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
DEBUG:       #09 pc 0000000000396340  /apex/com.android.art/lib64/libart.so!libart.so (art::verifier::MethodVerifier::FailureData art::verifier::MethodVerifier::VerifyMethod<false>(art::Thread*, art::ArenaPool*, art::verifier::RegTypeCache*, art::verifier::VerifierDeps*, unsigned int, art::Handle<art::mirror::DexCache>, art::dex::ClassDef const&, art::dex::CodeItem const*, unsigned int, art::verifier::HardFailLogMode, unsigned int, bool, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >*)+412) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
DEBUG:       #10 pc 0000000000606444  /apex/com.android.art/lib64/libart.so!libart.so (art::verifier::ClassVerifier::VerifyClass(art::Thread*, art::verifier::VerifierDeps*, art::DexFile const*, art::Handle<art::mirror::Class>, art::Handle<art::mirror::DexCache>, art::Handle<art::mirror::ClassLoader>, art::dex::ClassDef const&, art::CompilerCallbacks*, art::verifier::HardFailLogMode, unsigned int, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >*)+1424) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
DEBUG:       #11 pc 0000000000605dcc  /apex/com.android.art/lib64/libart.so!libart.so (art::ClassLinker::PerformClassVerification(art::Thread*, art::verifier::VerifierDeps*, art::Handle<art::mirror::Class>, art::verifier::HardFailLogMode, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >*)+244) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
DEBUG:       #12 pc 0000000000625288  /apex/com.android.art/lib64/libart.so!libart.so (art::ClassLinker::VerifyClass(art::Thread*, art::verifier::VerifierDeps*, art::Handle<art::mirror::Class>, art::verifier::HardFailLogMode)+4692) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
DEBUG:       #13 pc 00000000006238cc  /apex/com.android.art/lib64/libart.so!libart.so (art::BackgroundVerificationTask::Run(art::Thread*)+448) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
DEBUG:       #14 pc 0000000000204930  /apex/com.android.art/lib64/libart.so!libart.so (art::ThreadPoolWorker::Run()+288) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
DEBUG:       #15 pc 0000000000472044  /apex/com.android.art/lib64/libart.so!libart.so (art::ThreadPoolWorker::Callback(void*)+180) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
DEBUG:       #16 pc 00000000000f0df4  /apex/com.android.runtime/lib64/bionic/libc.so!libc.so (__pthread_start(void*)+264) (BuildId: 2f84be24a19d511a358a9050af5b3974)
DEBUG:       #17 pc 000000000008d63c  /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+68) (BuildId: 2f84be24a19d511a358a9050af5b3974)

Crash when local patch:

DEBUG: *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
DEBUG: Build fingerprint: 'Redmi/joyeuse_global/joyeuse:12/SKQ1.211019.001/V14.0.3.0.SJZMIXM:user/release-keys'
DEBUG: Revision: '0'
DEBUG: ABI: 'arm64'
DEBUG: Timestamp: 2026-08-27 10:28:09.930535569+0300
DEBUG: Process uptime: 0s
DEBUG: Cmdline: com.exteragram.messenger
DEBUG: pid: 26740, tid: 26740, name: agram.messenger  >>> com.exteragram.messenger <<<
DEBUG: uid: 15908
DEBUG: signal 11 (SIGSEGV), code 2 (SEGV_ACCERR), fault addr 0x7f00543fa8
DEBUG:     x0  0000007edaa625f8  x1  b400007ecc4a7a60  x2  b400007f9f382c00  x3  0000000000000007
DEBUG:     x4  00000000000029aa  x5  0000000000000000  x6  0000007fa082d000  x7  000000000fc88464
DEBUG:     x8  d07058c3f8970c48  x9  d07058c3f8970c48  x10 0000000000000070  x11 0000007ec0000000
DEBUG:     x12 0000000000000000  x13 0000000020645be0  x14 0000007f9f680000  x15 000000003fffffff
DEBUG:     x16 0000007f74d45d60  x17 0000007f74d35934  x18 0000007fa01f6000  x19 0000007f00543f80
DEBUG:     x20 b400007f9f376b00  x21 0000000000000001  x22 b400007ecc4c0038  x23 0000007f9f68001d
DEBUG:     x24 0000007f9f680021  x25 b400007ecc4c0060  x26 b400007f9f376b00  x27 b400007ecc4c0000
DEBUG:     x28 0000007eef667a70  x29 0000007fdf9a9da0
DEBUG:     lr  0000007eeb47e718  sp  0000007fdf9a9ca0  pc  0000007eeb47e718  pst 0000000060001000
DEBUG: backtrace:
DEBUG:       #00 pc 000000000047e718  /apex/com.android.art/lib64/libart.so!libart.so (art::JavaVMExt::LoadNativeLibrary(_JNIEnv*, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, _jobject*, _jclass*, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >*)+2204) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
DEBUG:       #01 pc 0000000000005828  /apex/com.android.art/lib64/libopenjdkjvm.so (JVM_NativeLoad+368) (BuildId: d479deaa539a0e1b4bc3f2147656b703)
DEBUG:       #02 pc 0000000000fb5398  /data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat (art_jni_trampoline+152)

[AlexeiCrystal]

When I added android:allowNativeHeapPointerTagging="false" to the application tag in the manifest in exteraGram with the integrated patch, the MTE-related error disappeared. However, the following error appeared:

DEBUG: *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
DEBUG: Build fingerprint: 'Redmi/joyeuse_global/joyeuse:12/SKQ1.211019.001/V14.0.3.0.SJZMIXM:user/release-keys'
DEBUG: Revision: '0'
DEBUG: ABI: 'arm64'
DEBUG: Process uptime: 0s
DEBUG: Cmdline: com.exteragram.messenger
DEBUG: pid: 29518, tid: 29548, name: Verification th  >>> com.exteragram.messenger <<<
DEBUG: uid: 15923
DEBUG: signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x8f9f35463c
DEBUG:     x0  0000007edac24e28  x1  0000007e449ad000  x2  0000007edb06d800  x3  0000000000000000
DEBUG:     x4  0000000000000000  x5  0000007edc8c6448  x6  0000007edc8c6440  x7  0000007edc8c6438
DEBUG:     x8  0000007f74d4a5a0  x9  0000007ef3a008c0  x10 0000008f9f3541c8  x11 0000007e40000000
DEBUG:     x12 0000000000000001  x13 00000000001dc540  x14 00000000049172c8  x15 0000000000000000
DEBUG:     x16 0000007f74d45d60  x17 0000007f74d35934  x18 0000007e78656000  x19 0000007f9f354408
DEBUG:     x20 0000007e449ad000  x21 0000007f9f3545c8  x22 0000007edc8c7f80  x23 00000000ffffffdc
DEBUG:     x24 0000008f9f35463c  x25 0000007f9f354430  x26 0000007edc8c64c0  x27 0000007edc8c7f80
DEBUG:     x28 0000007edc8c7f80  x29 0000007edc8c6300
DEBUG:     lr  0000007f74c93094  sp  0000007edc8c62b0  pc  0000007f74c93228  pst 0000000080001000
DEBUG: backtrace:
DEBUG:       #00 pc 000000000004f228  /apex/com.android.runtime/lib64/bionic/libc.so (je_free+472) (BuildId: 2f84be24a19d511a358a9050af5b3974)
DEBUG:       #01 pc 00000000003d8060  /apex/com.android.art/lib64/libart.so!libart.so (art::mirror::Class::SetStatus(art::Handle<art::mirror::Class>, art::ClassStatus, art::Thread*)+3496) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
DEBUG:       #02 pc 00000000003273d8  /apex/com.android.art/lib64/libart.so!libart.so (art::mirror::Object* art::gc::Heap::AllocObjectWithAllocator<true, true, art::mirror::CopyClassVisitor>(art::Thread*, art::ObjPtr<art::mirror::Class>, unsigned long, art::gc::AllocatorType, art::mirror::CopyClassVisitor const&)+728) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
DEBUG:       #03 pc 000000000044a364  /apex/com.android.art/lib64/libart.so!libart.so (art::ClassLinker::LinkClass(art::Thread*, char const*, art::Handle<art::mirror::Class>, art::Handle<art::mirror::ObjectArray<art::mirror::Class> >, art::MutableHandle<art::mirror::Class>*)+5664) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
DEBUG:       #04 pc 0000000000238650  /apex/com.android.art/lib64/libart.so!libart.so (art::ClassLinker::DefineClass(art::Thread*, char const*, unsigned long, unsigned long, art::Handle<art::mirror::ClassLoader>, art::DexFile const&, art::dex::ClassDef const&)+2424) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
DEBUG:       #05 pc 000000000022bdf0  /apex/com.android.art/lib64/libart.so!libart.so (art::ClassLinker::FindClassInBaseDexClassLoader(art::Thread*, char const*, unsigned long, unsigned long, art::Handle<art::mirror::ClassLoader>, art::ObjPtr<art::mirror::Class>*)+964) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
DEBUG:       #06 pc 000000000027e22c  /apex/com.android.art/lib64/libart.so!libart.so (art::ClassLinker::FindClass(art::Thread*, char const*, unsigned long, art::Handle<art::mirror::ClassLoader>)+924) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
DEBUG:       #07 pc 0000000000391714  /apex/com.android.art/lib64/libart.so!libart.so (art::ClassLinker::DoResolveType(art::dex::TypeIndex, art::Handle<art::mirror::DexCache>, art::Handle<art::mirror::ClassLoader>)+120) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
DEBUG:       #08 pc 00000000003a1884  /apex/com.android.art/lib64/libart.so!libart.so (art::verifier::RegType const& art::verifier::impl::(anonymous namespace)::MethodVerifierImpl::ResolveClass<(art::verifier::impl::(anonymous namespace)::CheckAccess)2>(art::dex::TypeIndex) (.__uniq.63246233319839034720636906213703941800)+656) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
DEBUG:       #09 pc 00000000003a1374  /apex/com.android.art/lib64/libart.so!libart.so (art::verifier::impl::(anonymous namespace)::MethodVerifierImpl::GetStaticField(unsigned int, bool) (.__uniq.63246233319839034720636906213703941800)+72) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
DEBUG:       #10 pc 000000000039a870  /apex/com.android.art/lib64/libart.so!libart.so (art::verifier::impl::(anonymous namespace)::MethodVerifier<false>::CodeFlowVerifyInstruction(unsigned int*) (.__uniq.63246233319839034720636906213703941800)+9632) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
DEBUG:       #11 pc 00000000003978e4  /apex/com.android.art/lib64/libart.so!libart.so (art::verifier::impl::(anonymous namespace)::MethodVerifier<false>::Verify() (.__uniq.63246233319839034720636906213703941800)+792) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
DEBUG:       #12 pc 0000000000396340  /apex/com.android.art/lib64/libart.so!libart.so (art::verifier::MethodVerifier::FailureData art::verifier::MethodVerifier::VerifyMethod<false>(art::Thread*, art::ArenaPool*, art::verifier::RegTypeCache*, art::verifier::VerifierDeps*, unsigned int, art::Handle<art::mirror::DexCache>, art::dex::ClassDef const&, art::dex::CodeItem const*, unsigned int, art::verifier::HardFailLogMode, unsigned int, bool, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >*)+412) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
DEBUG:       #13 pc 0000000000606444  /apex/com.android.art/lib64/libart.so!libart.so (art::verifier::ClassVerifier::VerifyClass(art::Thread*, art::verifier::VerifierDeps*, art::DexFile const*, art::Handle<art::mirror::Class>, art::Handle<art::mirror::DexCache>, art::Handle<art::mirror::ClassLoader>, art::dex::ClassDef const&, art::CompilerCallbacks*, art::verifier::HardFailLogMode, unsigned int, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >*)+1424) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
DEBUG:       #14 pc 0000000000605dcc  /apex/com.android.art/lib64/libart.so!libart.so (art::ClassLinker::PerformClassVerification(art::Thread*, art::verifier::VerifierDeps*, art::Handle<art::mirror::Class>, art::verifier::HardFailLogMode, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >*)+244) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
DEBUG:       #15 pc 0000000000625288  /apex/com.android.art/lib64/libart.so!libart.so (art::ClassLinker::VerifyClass(art::Thread*, art::verifier::VerifierDeps*, art::Handle<art::mirror::Class>, art::verifier::HardFailLogMode)+4692) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
DEBUG:       #16 pc 00000000006238cc  /apex/com.android.art/lib64/libart.so!libart.so (art::BackgroundVerificationTask::Run(art::Thread*)+448) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
DEBUG:       #17 pc 0000000000204930  /apex/com.android.art/lib64/libart.so!libart.so (art::ThreadPoolWorker::Run()+288) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
DEBUG:       #18 pc 0000000000472044  /apex/com.android.art/lib64/libart.so!libart.so (art::ThreadPoolWorker::Callback(void*)+180) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
DEBUG:       #19 pc 00000000000f0df4  /apex/com.android.runtime/lib64/bionic/libc.so!libc.so (__pthread_start(void*)+264) (BuildId: 2f84be24a19d511a358a9050af5b3974)
DEBUG:       #20 pc 000000000008d63c  /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+68) (BuildId: 2f84be24a19d511a358a9050af5b3974)