[NativeAOT][tvOS] PacStripPtr executes xpaci on devices without pointer authentication #130470

Closed
#130474
Closed
[NativeAOT][tvOS] PacStripPtr executes xpaci on devices without pointer authentication#130470
#130474
Assignees
kotlarmiloscopilot-swe-agent
Labels
area-NativeAOT-coreclros-tvosApple tvOS
Milestone
11.0.0

Description

@kotlarmilos
kotlarmilos
opened on Jul 10, 2026

Problem

The tvOS arm64 NativeAOT library leg in https://dev.azure.com/dnceng-public/public/_build/results?buildId=1502636 has 163 work items that exit with XHarness code 80 because the application crashes during GC stack walking.

Representative crash reports from AppleHybrid.Tests and System.Runtime.Extensions.Tests show EXC_BAD_INSTRUCTION with SIGILL on AppleTV5,3. The faulting opcode is 0xDAC143E0, which decodes to xpaci x0.

PacStripPtr
StackFrameIterator::InternalInit
Thread::GcScanRoots
GCToEEInterface::GcScanRoots

The affected Apple TV model uses the Apple A8 processor, which does not implement pointer authentication. xpaci is not a hint-space instruction, so executing it on this device raises an illegal-instruction exception.

#128950 introduced this NativeAOT implementation in src/coreclr/nativeaot/Runtime/arm64/MiscStubs.S and src/coreclr/nativeaot/Runtime/arm64/MiscStubs.asm.

PacStripPtr: xpaci x0ret

#129130 previously fixed the equivalent CoreCLR implementation by moving the pointer through lr and using xpaclri. The xpaclri encoding is in architectural hint space and acts as a no-op on hardware without pointer authentication. The NativeAOT implementation was added later and did not use that pattern. Current main still contains xpaci x0.

Representative artifacts

Proposed fix

Port the safe CoreCLR PacStripPtr implementation from #129130 to both NativeAOT assembly files.

  • Move the input pointer from x0 to lr.
  • Execute xpaclri, using raw encoding 0xD50320FF where required.
  • Move the stripped pointer back to x0.
  • Preserve and restore the caller's original lr.
  • Validate the fix on an AppleTV5,3 device and on a pointer-authentication-capable arm64 device.

Metadata

Metadata

Assignees

Labels

area-NativeAOT-coreclros-tvosApple tvOS

Type

No type

Projects

  • AppModel
    Status
    No status

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
[NativeAOT][tvOS] PacStripPtr executes xpaci on devices without pointer authentication #130470
Closed
#130474
Closed
[NativeAOT][tvOS] PacStripPtr executes xpaci on devices without pointer authentication#130470
#130474
Assignees
kotlarmiloscopilot-swe-agent
Labels
area-NativeAOT-coreclros-tvosApple tvOS
Milestone
11.0.0
Description
@kotlarmilos
kotlarmilos
opened on Jul 10, 2026
Problem
The tvOS arm64 NativeAOT library leg in https://dev.azure.com/dnceng-public/public/_build/results?buildId=1502636 has 163 work items that exit with XHarness code 80 because the application crashes during GC stack walking.
Representative crash reports from AppleHybrid.Tests and System.Runtime.Extensions.Tests show EXC_BAD_INSTRUCTION with SIGILL on AppleTV5,3. The faulting opcode is 0xDAC143E0, which decodes to xpaci x0.
PacStripPtr
StackFrameIterator::InternalInit
Thread::GcScanRoots
GCToEEInterface::GcScanRoots

The affected Apple TV model uses the Apple A8 processor, which does not implement pointer authentication. xpaci is not a hint-space instruction, so executing it on this device raises an illegal-instruction exception.
#128950 introduced this NativeAOT implementation in src/coreclr/nativeaot/Runtime/arm64/MiscStubs.S and src/coreclr/nativeaot/Runtime/arm64/MiscStubs.asm.
PacStripPtr: xpaci x0ret
#129130 previously fixed the equivalent CoreCLR implementation by moving the pointer through lr and using xpaclri. The xpaclri encoding is in architectural hint space and acts as a no-op on hardware without pointer authentication. The NativeAOT implementation was added later and did not use that pattern. Current main still contains xpaci x0.
Representative artifacts
Proposed fix
Port the safe CoreCLR PacStripPtr implementation from #129130 to both NativeAOT assembly files.
  • Move the input pointer from x0 to lr.
  • Execute xpaclri, using raw encoding 0xD50320FF where required.
  • Move the stripped pointer back to x0.
  • Preserve and restore the caller's original lr.
  • Validate the fix on an AppleTV5,3 device and on a pointer-authentication-capable arm64 device.
Metadata
Metadata
Assignees
Labels
area-NativeAOT-coreclros-tvosApple tvOS
Type
No type
Projects
  • AppModel
    Status
    No status
Milestone
Relationships
None yet
Development
No branches or pull requests
Issue actions

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
[NativeAOT][tvOS] PacStripPtr executes xpaci on devices without pointer authentication #130470
Closed
#130474
Closed
[NativeAOT][tvOS] PacStripPtr executes xpaci on devices without pointer authentication#130470
#130474
Assignees
kotlarmiloscopilot-swe-agent
Labels
area-NativeAOT-coreclros-tvosApple tvOS
Milestone
11.0.0
Description
@kotlarmilos
kotlarmilos
opened on Jul 10, 2026
Problem
The tvOS arm64 NativeAOT library leg in https://dev.azure.com/dnceng-public/public/_build/results?buildId=1502636 has 163 work items that exit with XHarness code 80 because the application crashes during GC stack walking.
Representative crash reports from AppleHybrid.Tests and System.Runtime.Extensions.Tests show EXC_BAD_INSTRUCTION with SIGILL on AppleTV5,3. The faulting opcode is 0xDAC143E0, which decodes to xpaci x0.
PacStripPtr
StackFrameIterator::InternalInit
Thread::GcScanRoots
GCToEEInterface::GcScanRoots

The affected Apple TV model uses the Apple A8 processor, which does not implement pointer authentication. xpaci is not a hint-space instruction, so executing it on this device raises an illegal-instruction exception.
#128950 introduced this NativeAOT implementation in src/coreclr/nativeaot/Runtime/arm64/MiscStubs.S and src/coreclr/nativeaot/Runtime/arm64/MiscStubs.asm.
PacStripPtr: xpaci x0ret
#129130 previously fixed the equivalent CoreCLR implementation by moving the pointer through lr and using xpaclri. The xpaclri encoding is in architectural hint space and acts as a no-op on hardware without pointer authentication. The NativeAOT implementation was added later and did not use that pattern. Current main still contains xpaci x0.
Representative artifacts
Proposed fix
Port the safe CoreCLR PacStripPtr implementation from #129130 to both NativeAOT assembly files.
  • Move the input pointer from x0 to lr.
  • Execute xpaclri, using raw encoding 0xD50320FF where required.
  • Move the stripped pointer back to x0.
  • Preserve and restore the caller's original lr.
  • Validate the fix on an AppleTV5,3 device and on a pointer-authentication-capable arm64 device.
Metadata
Metadata
Assignees
Labels
area-NativeAOT-coreclros-tvosApple tvOS
Type
No type
Projects
  • AppModel
    Status
    No status
Milestone
Relationships
None yet
Development
No branches or pull requests
Issue actions

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
[NativeAOT][tvOS] PacStripPtr executes xpaci on devices without pointer authentication #130470
Closed
#130474
Closed
[NativeAOT][tvOS] PacStripPtr executes xpaci on devices without pointer authentication#130470
#130474
Assignees
kotlarmiloscopilot-swe-agent
Labels
area-NativeAOT-coreclros-tvosApple tvOS
Milestone
11.0.0
Description
@kotlarmilos
kotlarmilos
opened on Jul 10, 2026
Problem
The tvOS arm64 NativeAOT library leg in https://dev.azure.com/dnceng-public/public/_build/results?buildId=1502636 has 163 work items that exit with XHarness code 80 because the application crashes during GC stack walking.
Representative crash reports from AppleHybrid.Tests and System.Runtime.Extensions.Tests show EXC_BAD_INSTRUCTION with SIGILL on AppleTV5,3. The faulting opcode is 0xDAC143E0, which decodes to xpaci x0.
PacStripPtr
StackFrameIterator::InternalInit
Thread::GcScanRoots
GCToEEInterface::GcScanRoots

The affected Apple TV model uses the Apple A8 processor, which does not implement pointer authentication. xpaci is not a hint-space instruction, so executing it on this device raises an illegal-instruction exception.
#128950 introduced this NativeAOT implementation in src/coreclr/nativeaot/Runtime/arm64/MiscStubs.S and src/coreclr/nativeaot/Runtime/arm64/MiscStubs.asm.
PacStripPtr: xpaci x0ret
#129130 previously fixed the equivalent CoreCLR implementation by moving the pointer through lr and using xpaclri. The xpaclri encoding is in architectural hint space and acts as a no-op on hardware without pointer authentication. The NativeAOT implementation was added later and did not use that pattern. Current main still contains xpaci x0.
Representative artifacts
Proposed fix
Port the safe CoreCLR PacStripPtr implementation from #129130 to both NativeAOT assembly files.
  • Move the input pointer from x0 to lr.
  • Execute xpaclri, using raw encoding 0xD50320FF where required.
  • Move the stripped pointer back to x0.
  • Preserve and restore the caller's original lr.
  • Validate the fix on an AppleTV5,3 device and on a pointer-authentication-capable arm64 device.
Metadata
Metadata
Assignees
Labels
area-NativeAOT-coreclros-tvosApple tvOS
Type
No type
Projects
  • AppModel
    Status
    No status
Milestone
Relationships
None yet
Development
No branches or pull requests
Issue actions

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
[NativeAOT][tvOS] PacStripPtr executes xpaci on devices without pointer authentication #130470
Closed
#130474
Closed
[NativeAOT][tvOS] PacStripPtr executes xpaci on devices without pointer authentication#130470
#130474
Assignees
kotlarmiloscopilot-swe-agent
Labels
area-NativeAOT-coreclros-tvosApple tvOS
Milestone
11.0.0
Description
@kotlarmilos
kotlarmilos
opened on Jul 10, 2026
Problem
The tvOS arm64 NativeAOT library leg in https://dev.azure.com/dnceng-public/public/_build/results?buildId=1502636 has 163 work items that exit with XHarness code 80 because the application crashes during GC stack walking.
Representative crash reports from AppleHybrid.Tests and System.Runtime.Extensions.Tests show EXC_BAD_INSTRUCTION with SIGILL on AppleTV5,3. The faulting opcode is 0xDAC143E0, which decodes to xpaci x0.
PacStripPtr
StackFrameIterator::InternalInit
Thread::GcScanRoots
GCToEEInterface::GcScanRoots

The affected Apple TV model uses the Apple A8 processor, which does not implement pointer authentication. xpaci is not a hint-space instruction, so executing it on this device raises an illegal-instruction exception.
#128950 introduced this NativeAOT implementation in src/coreclr/nativeaot/Runtime/arm64/MiscStubs.S and src/coreclr/nativeaot/Runtime/arm64/MiscStubs.asm.
PacStripPtr: xpaci x0ret
#129130 previously fixed the equivalent CoreCLR implementation by moving the pointer through lr and using xpaclri. The xpaclri encoding is in architectural hint space and acts as a no-op on hardware without pointer authentication. The NativeAOT implementation was added later and did not use that pattern. Current main still contains xpaci x0.
Representative artifacts
Proposed fix
Port the safe CoreCLR PacStripPtr implementation from #129130 to both NativeAOT assembly files.
  • Move the input pointer from x0 to lr.
  • Execute xpaclri, using raw encoding 0xD50320FF where required.
  • Move the stripped pointer back to x0.
  • Preserve and restore the caller's original lr.
  • Validate the fix on an AppleTV5,3 device and on a pointer-authentication-capable arm64 device.
Metadata
Metadata
Assignees
Labels
area-NativeAOT-coreclros-tvosApple tvOS
Type
No type
Projects
  • AppModel
    Status
    No status
Milestone
Relationships
None yet
Development
No branches or pull requests
Issue actions

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
[NativeAOT][tvOS] PacStripPtr executes xpaci on devices without pointer authentication #130470
Closed
#130474
Closed
[NativeAOT][tvOS] PacStripPtr executes xpaci on devices without pointer authentication#130470
#130474
Assignees
kotlarmiloscopilot-swe-agent
Labels
area-NativeAOT-coreclros-tvosApple tvOS
Milestone
11.0.0
Description
@kotlarmilos
kotlarmilos
opened on Jul 10, 2026
Problem
The tvOS arm64 NativeAOT library leg in https://dev.azure.com/dnceng-public/public/_build/results?buildId=1502636 has 163 work items that exit with XHarness code 80 because the application crashes during GC stack walking.
Representative crash reports from AppleHybrid.Tests and System.Runtime.Extensions.Tests show EXC_BAD_INSTRUCTION with SIGILL on AppleTV5,3. The faulting opcode is 0xDAC143E0, which decodes to xpaci x0.
PacStripPtr
StackFrameIterator::InternalInit
Thread::GcScanRoots
GCToEEInterface::GcScanRoots

The affected Apple TV model uses the Apple A8 processor, which does not implement pointer authentication. xpaci is not a hint-space instruction, so executing it on this device raises an illegal-instruction exception.
#128950 introduced this NativeAOT implementation in src/coreclr/nativeaot/Runtime/arm64/MiscStubs.S and src/coreclr/nativeaot/Runtime/arm64/MiscStubs.asm.
PacStripPtr: xpaci x0ret
#129130 previously fixed the equivalent CoreCLR implementation by moving the pointer through lr and using xpaclri. The xpaclri encoding is in architectural hint space and acts as a no-op on hardware without pointer authentication. The NativeAOT implementation was added later and did not use that pattern. Current main still contains xpaci x0.
Representative artifacts
Proposed fix
Port the safe CoreCLR PacStripPtr implementation from #129130 to both NativeAOT assembly files.
  • Move the input pointer from x0 to lr.
  • Execute xpaclri, using raw encoding 0xD50320FF where required.
  • Move the stripped pointer back to x0.
  • Preserve and restore the caller's original lr.
  • Validate the fix on an AppleTV5,3 device and on a pointer-authentication-capable arm64 device.
Metadata
Metadata
Assignees
Labels
area-NativeAOT-coreclros-tvosApple tvOS
Type
No type
Projects
  • AppModel
    Status
    No status
Milestone
Relationships
None yet
Development
No branches or pull requests
Issue actions

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
[NativeAOT][tvOS] PacStripPtr executes xpaci on devices without pointer authentication #130470
Closed
#130474
Closed
[NativeAOT][tvOS] PacStripPtr executes xpaci on devices without pointer authentication#130470
#130474
Assignees
kotlarmiloscopilot-swe-agent
Labels
area-NativeAOT-coreclros-tvosApple tvOS
Milestone
11.0.0
Description
@kotlarmilos
kotlarmilos
opened on Jul 10, 2026
Problem
The tvOS arm64 NativeAOT library leg in https://dev.azure.com/dnceng-public/public/_build/results?buildId=1502636 has 163 work items that exit with XHarness code 80 because the application crashes during GC stack walking.
Representative crash reports from AppleHybrid.Tests and System.Runtime.Extensions.Tests show EXC_BAD_INSTRUCTION with SIGILL on AppleTV5,3. The faulting opcode is 0xDAC143E0, which decodes to xpaci x0.
PacStripPtr
StackFrameIterator::InternalInit
Thread::GcScanRoots
GCToEEInterface::GcScanRoots

The affected Apple TV model uses the Apple A8 processor, which does not implement pointer authentication. xpaci is not a hint-space instruction, so executing it on this device raises an illegal-instruction exception.
#128950 introduced this NativeAOT implementation in src/coreclr/nativeaot/Runtime/arm64/MiscStubs.S and src/coreclr/nativeaot/Runtime/arm64/MiscStubs.asm.
PacStripPtr: xpaci x0ret
#129130 previously fixed the equivalent CoreCLR implementation by moving the pointer through lr and using xpaclri. The xpaclri encoding is in architectural hint space and acts as a no-op on hardware without pointer authentication. The NativeAOT implementation was added later and did not use that pattern. Current main still contains xpaci x0.
Representative artifacts
Proposed fix
Port the safe CoreCLR PacStripPtr implementation from #129130 to both NativeAOT assembly files.
  • Move the input pointer from x0 to lr.
  • Execute xpaclri, using raw encoding 0xD50320FF where required.
  • Move the stripped pointer back to x0.
  • Preserve and restore the caller's original lr.
  • Validate the fix on an AppleTV5,3 device and on a pointer-authentication-capable arm64 device.
Metadata
Metadata
Assignees
Labels
area-NativeAOT-coreclros-tvosApple tvOS
Type
No type
Projects
  • AppModel
    Status
    No status
Milestone
Relationships
None yet
Development
No branches or pull requests
Issue actions

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
[NativeAOT][tvOS] PacStripPtr executes xpaci on devices without pointer authentication #130470
Closed
#130474
Closed
[NativeAOT][tvOS] PacStripPtr executes xpaci on devices without pointer authentication#130470
#130474
Assignees
kotlarmiloscopilot-swe-agent
Labels
area-NativeAOT-coreclros-tvosApple tvOS
Milestone
11.0.0
Description
@kotlarmilos
kotlarmilos
opened on Jul 10, 2026
Problem
The tvOS arm64 NativeAOT library leg in https://dev.azure.com/dnceng-public/public/_build/results?buildId=1502636 has 163 work items that exit with XHarness code 80 because the application crashes during GC stack walking.
Representative crash reports from AppleHybrid.Tests and System.Runtime.Extensions.Tests show EXC_BAD_INSTRUCTION with SIGILL on AppleTV5,3. The faulting opcode is 0xDAC143E0, which decodes to xpaci x0.
PacStripPtr
StackFrameIterator::InternalInit
Thread::GcScanRoots
GCToEEInterface::GcScanRoots

The affected Apple TV model uses the Apple A8 processor, which does not implement pointer authentication. xpaci is not a hint-space instruction, so executing it on this device raises an illegal-instruction exception.
#128950 introduced this NativeAOT implementation in src/coreclr/nativeaot/Runtime/arm64/MiscStubs.S and src/coreclr/nativeaot/Runtime/arm64/MiscStubs.asm.
PacStripPtr: xpaci x0ret
#129130 previously fixed the equivalent CoreCLR implementation by moving the pointer through lr and using xpaclri. The xpaclri encoding is in architectural hint space and acts as a no-op on hardware without pointer authentication. The NativeAOT implementation was added later and did not use that pattern. Current main still contains xpaci x0.
Representative artifacts
Proposed fix
Port the safe CoreCLR PacStripPtr implementation from #129130 to both NativeAOT assembly files.
  • Move the input pointer from x0 to lr.
  • Execute xpaclri, using raw encoding 0xD50320FF where required.
  • Move the stripped pointer back to x0.
  • Preserve and restore the caller's original lr.
  • Validate the fix on an AppleTV5,3 device and on a pointer-authentication-capable arm64 device.
Metadata
Metadata
Assignees
Labels
area-NativeAOT-coreclros-tvosApple tvOS
Type
No type
Projects
  • AppModel
    Status
    No status
Milestone
Relationships
None yet
Development
No branches or pull requests
Issue actions