Instrumented probe stores through an unguarded raw pointer into a file-backed mapping — any loss of page backing kills the process with an AccessViolation attributed to innocent user code

[pcshrosbree]

Package: Microsoft.Testing.Extensions.CodeCoverage 18.8.0 (also reproduced on 18.9.0)
Repo: https://github.com/microsoft/codecoverage
Runtime: .NET 8 (8.0.28) and .NET 10 hosts, Linux x64 (Ubuntu container), xunit.v3 3.2.2 on Microsoft.Testing.Platform
Invocation: dotnet test --project <proj> -c Release --coverage --coverage-output-format cobertura

Summary

Static instrumentation prefixes every basic block of every instrumented assembly with an unconditional raw byte store through a static pointer:

ldsfld uint8* Tracker::Begin
ldc.i4 N
add
ldc.i4.1
stind.i1

which the JIT compiles to a single mov byte ptr [reg+idx], 1.

Begin is obtained as

Begin = (byte*)_view.SafeMemoryMappedViewHandle.DangerousGetHandle();

with no DangerousAddRef, over a small file-backed mapping (MemoryMappedFile.CreateFromFile("/tmp/CodeCoverage.<sessionGuid>.<moduleGuid>", FileMode.Open, null, <bufferSize>, MemoryMappedFileAccess.ReadWrite)).

Because the store is unguarded and executes on every basic block, any condition that makes that mapped page unbacked turns the next executed instrumented method into a process-fatal AccessViolationException. The reported stack is whichever user method happened to run at that instant, so the failure is systematically misattributed to innocent user code — including code that provably cannot fault, such as a two-field constructor.

Impact

• A test host dies with Fatal error. System.AccessViolationException / SIGABRT (exit 134).
• The blamed frame is arbitrary and varies run to run, so users chase phantom concurrency and memory-safety bugs in their own code. We spent a substantial investigation before establishing that the faulting instruction was the injected probe rather than our code.
• On CI this reds unrelated pipelines.

Reproducer (self-contained, no proprietary code)

Reproduced deterministically, 3/3, on a synthetic solution containing only ordinary safe C# (no unsafe, no pointers, no P/Invoke, no interop):

1. Create a solution with a class library LibA and an MTP test project referencing it (xunit.v3 + Microsoft.Testing.Extensions.CodeCoverage, global.json with "test": { "runner": "Microsoft.Testing.Platform" }).
2. Run dotnet test --project Tests -c Release --coverage --coverage-output-format cobertura once and terminate it while the rewritten assemblies are on disk (the run leaves LibA.dll rewritten plus LibA.dll.orig). This step just makes the instrumented artifact available for direct execution.
3. Read the buffer path baked into the rewritten library:
   strings -el LibA.dll | grep '^/tmp/CodeCoverage\.'
4. Create that file at the buffer size and confirm the probes are live:
   dd if=/dev/zero of=$BUF bs=1 count=<bufferSize> then run the test host directly
   (dotnet exec Tests.dll) and observe non-zero bytes appear in $BUF.
5. Run the test host again and, while it is executing, truncate the buffer:
   truncate -s 0 $BUF.

Result (3/3):

Fatal error. System.AccessViolationException: Attempted to read or write protected memory.
 at BigRepro.LibA.Widget4.Touch(Int32, Int32, Int32, Int64)
 at BigRepro.Tests.Suite34.Calc10Works(Int32)

Fatal error. System.AccessViolationException: ...
 at BigRepro.LibA.Widget12..ctor(Double, Double, Int64, Boolean)
 at BigRepro.Tests.Suite12+<>c.<RejectsBadConfig>b__1_0()

Fatal error. System.AccessViolationException: ...
 at BigRepro.LibA.Widget6.Evict(Int32, Int32, Int32)
 at BigRepro.Tests.Suite46+<ConcurrentTouchVsEvict>d__0.MoveNext()

Note the second one: the faulting "user code" is a constructor that only validates arguments and assigns fields.

Specificity control: unlinking and recreating the buffer file (new inode) does not crash the host — the existing mapping keeps the old inode alive. Only losing backing for the mapped page faults. So this is specifically about page backing, not about the file being touched.

Evidence from a naturally-occurring crash (not induced)

We independently captured core dumps of the same failure occurring spontaneously in CI-shaped runs (~0.5-1% of invocations). In those dumps:

• SOS clrstack -f shows a FaultingExceptionFrame directly above a trivial property getter.
• Disassembly at the faulting offset is the probe store, before any user IL executes:

513e: 48 8b 3d cb 4d aa ff mov rdi, [rip-0x55b235] ; Tracker::Begin
5145: b8 c9 00 00 00 mov eax, 0xc9 ; probe index 201
514a: 48 98 cdqe
514c: c6 04 07 01 mov byte ptr [rdi+rax], 1 ; <-- faulting instruction
5150: ... ; user code starts only here

• Begin = 0x7824061b5000 (non-null), buffer size 0x99b (2459), probe index 201 (in range), and the core's NT_FILE maps /tmp/CodeCoverage.<session>.<module> at exactly 0x7824061b5000. So: valid pointer, in-range index, mapping present — the page was simply not backed at the instant of the store.
• The managed heap verifies clean (verifyheap: 0 errors in one dump; the only "errors" in
  others are InvalidMethodTable at a thread's alloc_limit, i.e. allocation-boundary artifacts). So this is not heap corruption by user code.
• The process then FailFasts; dumps carry ExecutionEngineException HResult 0x80131506.

We also observed, with a 5 ms poller during a normal (non-crashing) run, that buffer files are rewritten in place while mapped (size regressions such as 2459 -> 2458 on 2 of 158 buffer files), which suggests these files are not stable for the lifetime of the mapping.

Plausible real-world causes of lost page backing include truncation/rewrite of the buffer file by another participant, and filesystem exhaustion (a dirty page of a file-backed mapping that cannot be allocated yields SIGBUS; CoreCLR's PAL reports both SIGBUS and SIGSEGV as
EXCEPTION_ACCESS_VIOLATION). Our failures cluster on a small, disk-pressured CI runner.

Suggested remedies

1. Hold a reference for the lifetime of the pointer — use DangerousAddRef/DangerousRelease (or keep and use the SafeMemoryMappedViewHandle directly) so the mapping cannot be released while probes may still execute.
2. Do not use a shared, world-writable, guessable path. /tmp/CodeCoverage.<guid>.<guid> is writable by any process on the machine; a truncation by anything else is fatal to unrelated test hosts. Consider an unlinked/anonymous mapping, memfd_create, or a private directory.
3. Do not let instrumentation faults kill the host. A coverage probe failing should at worst lose coverage data, never terminate the process — and never surface as an AccessViolationException attributed to user code. Even a one-time validity check with a graceful disable would prevent the misattribution.
4. If the buffer must be file-backed, preallocate and fsync it, and handle SIGBUS.

Why this is easy to misdiagnose (please consider the diagnostics angle)

Because the injected store is attributed to the enclosing user method, the crash looks exactly like a memory-safety bug in the user's own code. In our case it repeatedly pointed at a lock-protected ConcurrentDictionary wrapper and at trivial constructors. Anything that makes the probe's provenance visible — a marker frame, a distinguishable exception, or a documented signature — would save considerable investigation time.

[fhnaseer]

Please use 18.10.0 version and see if it fixes the issue for you or not.

[pcshrosbree]

Thanks — I've tested 18.10.0.

Short answer: no, it does not fix it. The two changes 18.10.0 does make are real and address parts of remedies 1 and 4, but the reported failure mode is unchanged: losing page backing for the mapped buffer still kills the test host with an AccessViolationException attributed to innocent user code. Reproduced 3/3 on net8.0 and 1/1 on net10.0 with 18.10.0, against 0/4 for the same runs without the induced truncation.

What 18.10.0 changed

Decompiling lib/netstandard2.0/Microsoft.CodeCoverage.Instrumentation.Core.dll, these are the only two functional differences between 18.9.0 and 18.10.0:

-Begin = (byte*)_view.SafeMemoryMappedViewHandle.DangerousGetHandle().ToPointer();
+byte* pointer = null;
+_view.SafeMemoryMappedViewHandle.AcquirePointer(ref pointer);
+Begin = pointer;

-MemoryMappedFiles[i] = MemoryMappedFile.CreateFromFile(text, FileMode.Create, null, BufferSizes[i], MemoryMappedFileAccess.ReadWrite);
+using (FileStream fileStream = new FileStream(text, FileMode.Create, FileAccess.ReadWrite, FileShare.ReadWrite))
+{
+ byte[] array = new byte[65536];
+ int num = BufferSizes[i];
+ while (num > 0)
+ {
+ int num2 = ((num < array.Length) ? num : array.Length);
+ fileStream.Write(array, 0, num2);
+ num -= num2;
+ }
+ fileStream.Flush();
+}
+MemoryMappedFiles[i] = MemoryMappedFile.CreateFromFile(text, FileMode.Open, null, BufferSizes[i], MemoryMappedFileAccess.ReadWrite);

Both are genuine improvements and I appreciate them:

• Remedy 1 is addressed. AcquirePointer takes the ref (DangerousAddRef), so the mapping can no longer be released out from under a live Begin. (FWIW there is no matching ReleasePointer anywhere in the assembly — AcquirePointer appears once, ReleasePointer zero times — so the ref is held permanently. That is the right lifetime for this use, but it may be worth an explicit comment so it isn't "fixed" later as a leak.)
• Remedy 4 is half-addressed. The buffer is now preallocated with real blocks rather than created at length by FileMode.Create, which should genuinely reduce the filesystem-exhaustion path — an unwritten hole in a sparse file is exactly the case where a dirty page can't be allocated and you get SIGBUS. That is the cause I suspected for our naturally-occurring CI crashes, so this may well reduce their frequency. The other half is missing: fileStream.Flush() is the managed overload and does not fsync (Flush(flushToDisk: true) would), and there is still no SIGBUS handling.

What did not change

Remedy 2 — the buffer is still a shared, world-writable, guessable path. Still Path.Combine(Path.GetTempPath(), …). Observed in all 10 runs below, e.g.:

/tmp/CodeCoverage.14f67fa5-1417-454e-a53a-66464fe0c569.be97176d2-c35e-412a-8bf2-72bb6baeb402 (1633 bytes)

Remedy 3 — the probe store is still unguarded. Capturing the rewritten LibA.dll mid-run under 18.10.0 and disassembling, the injected prologue is byte-for-byte the shape originally reported:

IL_0000: ldsfld uint8* 'Microsoft.CodeCoverage.Instrumentation.Static.Tracker.StaticManagedTrackerTemplate_61950162-d3c5-49c6-822a-a8d8675bb5dc'::Begin
IL_0005: ldc.i4 1609
IL_000a: add
IL_000b: ldc.i4.1
IL_000c: stind.i1
IL_000d: ldarg.2 // user code starts here

(Static rewriting in place is also unchanged — LibA.dll.orig and LibA.pdb.orig appear in the output directory during every run.)

So AcquirePointer guarantees the mapping object stays alive, but that was never the only way to lose page backing. Anything that unbacks the mapped page still turns the next basic block of any instrumented method into a fatal AV, and it is still reported against whatever user method happened to be executing.

Results

Same solution, same harness, only the package version and the induced truncation varying. truncate = truncate -s 0 on the buffer file 6 s into a run while instrumented code is executing continuously; observe = the identical run with no truncation (the specificity control).

version	TFM	mode	exit	AV?
18.10.0	net8.0	truncate	7	YES
18.10.0	net8.0	truncate	7	YES
18.10.0	net8.0	truncate	7	YES
18.10.0	net8.0	observe	0	no
18.10.0	net10.0	truncate	7	YES
18.10.0	net10.0	observe	0	no
18.9.0	net8.0	truncate	134	YES
18.9.0	net8.0	observe	0	no
18.9.0	net10.0	truncate	134	YES
18.9.0	net10.0	observe	0	no

Representative failure under 18.10.0:

Fatal error. System.AccessViolationException: Attempted to read or write protected memory. This is often an indication that other memory is corrupt.
 at BigRepro.Tests.SlowSuite.ChurnsInstrumentedCodeForThirtySeconds()
 at System.RuntimeMethodHandle.InvokeMethod(System.Object, Void**, System.Signature, Boolean)
 at System.Reflection.MethodBaseInvoker.InvokeWithNoArgs(System.Object, System.Reflection.BindingFlags)

One incidental behaviour change worth knowing about: the host still FailFasts and still prints Fatal error. System.AccessViolationException, but the exit code the platform reports moved from 134 (SIGABRT) on 18.9.0 to 7 on 18.10.0, consistently. I haven't chased why. If anything that makes it slightly harder to spot in CI, since 134 is recognisably a crash.

Environment

• .NET SDK 10.0.301; runtimes Microsoft.NETCore.App 8.0.26 and 10.0.10
• Ubuntu 26.04, x64, ext4 (not the disk-pressured CI runner — this is induced, not the spontaneous variant)
• xunit.v3 3.2.2 on Microsoft.Testing.Platform

Reproducer

Self-contained — the script below generates the whole solution (ordinary safe C# only; no unsafe, no pointers, no interop), and the second one runs the probe and the attack.

gen_repro.py — generates the solution

#!/usr/bin/env python3
"""Generate the minimal reproducer solution used for
microsoft/codecoverage#232 and coverlet-coverage/coverlet#1990.

Ordinary safe C# only: no unsafe, no pointers, no P/Invoke, no interop.
Layout:
 BigRepro/
 NuGet.config -- nuget.org only
 global.json -- MTP test runner
 Directory.Build.props -- shared settings
 LibA/LibA.csproj -- net8.0;net10.0 class library
 Tests/Tests.csproj -- net8.0;net10.0 xunit.v3 MTP test project
"""
import os, shutil, pathlib, textwrap

ROOT = pathlib.Path("/data/tmp/cov-repro/BigRepro")
N_WIDGETS = 24
N_SUITES = 24

if ROOT.exists():
 shutil.rmtree(ROOT)
(ROOT / "LibA").mkdir(parents=True)
(ROOT / "Tests").mkdir(parents=True)

# ---------------------------------------------------------------- solution files
(ROOT / "NuGet.config").write_text("""<?xml version="1.0" encoding="utf-8"?>
<configuration>
 <packageSources>
 <clear />
 <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
 </packageSources>
</configuration>
""")

(ROOT / "global.json").write_text("""{
 "sdk": {
 "version": "10.0.301",
 "rollForward": "latestFeature"
 },
 "test": {
 "runner": "Microsoft.Testing.Platform"
 }
}
""")

(ROOT / "Directory.Build.props").write_text("""<Project>
 <PropertyGroup>
 <Nullable>enable</Nullable>
 <LangVersion>latest</LangVersion>
 <ImplicitUsings>enable</ImplicitUsings>
 <AllowUnsafeBlocks>false</AllowUnsafeBlocks>
 <TreatWarningsAsErrors>false</TreatWarningsAsErrors>
 <DebugType>portable</DebugType>
 <ManagePackageVersionsCentrally>false</ManagePackageVersionsCentrally>
 </PropertyGroup>
</Project>
""")

# ---------------------------------------------------------------- LibA
(ROOT / "LibA" / "LibA.csproj").write_text("""<Project Sdk="Microsoft.NET.Sdk">
 <PropertyGroup>
 <TargetFrameworks>net8.0;net10.0</TargetFrameworks>
 <RootNamespace>BigRepro.LibA</RootNamespace>
 <AssemblyName>LibA</AssemblyName>
 </PropertyGroup>
</Project>
""")

for i in range(1, N_WIDGETS + 1):
 src = textwrap.dedent(f"""\
 using System.Collections.Concurrent;

 namespace BigRepro.LibA;

 /// <summary>Ordinary safe type; many small basic blocks so instrumentation
 /// has plenty of probe sites.</summary>
 public sealed class Widget{i}
 {{
 private readonly ConcurrentDictionary<int, long> _cells = new();
 private readonly double _scale;
 private readonly double _bias;
 private readonly long _seed;
 private readonly bool _strict;

 public Widget{i}(double scale, double bias, long seed, bool strict)
 {{
 if (double.IsNaN(scale)) throw new ArgumentException("scale", nameof(scale));
 if (double.IsNaN(bias)) throw new ArgumentException("bias", nameof(bias));
 _scale = scale;
 _bias = bias;
 _seed = seed;
 _strict = strict;
 }}

 public double Scale => _scale;
 public double Bias => _bias;
 public long Seed => _seed;
 public bool Strict => _strict;
 public int Count => _cells.Count;

 public long Touch(int a, int b, int c, long d)
 {{
 var key = (a * 31 + b) * 31 + c;
 if (key < 0) key = -key;
 var v = _cells.AddOrUpdate(key % 64, d, (_, old) => old + d);
 if (_strict && v < 0) return 0;
 return v;
 }}

 public int Evict(int a, int b, int c)
 {{
 var removed = 0;
 for (var k = a; k < a + 8; k++)
 {{
 if ((k + b) % 3 == 0) continue;
 if (_cells.TryRemove(k % 64, out _)) removed++;
 if (removed > c) break;
 }}
 return removed;
 }}

 public double Calc(int n)
 {{
 var acc = _bias;
 for (var k = 0; k < n; k++)
 {{
 acc = k % 2 == 0 ? acc + _scale * k : acc - _scale / (k + 1);
 if (acc > 1e12) {{ acc = 1e12; break; }}
 if (acc < -1e12) {{ acc = -1e12; break; }}
 }}
 return acc;
 }}

 public string Describe(int n) => n switch
 {{
 < 0 => "negative",
 0 => "zero",
 < 10 => "small",
 < 100 => "medium",
 _ => "large",
 }};

 public bool Validate(int n, string? tag)
 {{
 if (tag is null) return false;
 if (tag.Length == 0) return false;
 if (n < 0) return false;
 return tag.Length + n < 4096;
 }}
 }}
 """)
 (ROOT / "LibA" / f"Widget{i}.cs").write_text(src)

# ---------------------------------------------------------------- Tests
(ROOT / "Tests" / "Tests.csproj").write_text("""<Project Sdk="Microsoft.NET.Sdk">
 <PropertyGroup>
 <TargetFrameworks>net8.0;net10.0</TargetFrameworks>
 <RootNamespace>BigRepro.Tests</RootNamespace>
 <AssemblyName>Tests</AssemblyName>
 <OutputType>Exe</OutputType>
 <IsPackable>false</IsPackable>
 <UseMicrosoftTestingPlatformRunner>true</UseMicrosoftTestingPlatformRunner>
 <TestingPlatformDotnetTestSupport>true</TestingPlatformDotnetTestSupport>
 </PropertyGroup>
 <ItemGroup>
 <PackageReference Include="XUNIT_PKG" Version="XUNIT_VERSION" />
 <PackageReference Include="Microsoft.Testing.Extensions.CodeCoverage" Version="COVERAGE_VERSION" />
 </ItemGroup>
 <ItemGroup>
 <ProjectReference Include="../LibA/LibA.csproj" />
 </ItemGroup>
</Project>
""")

for i in range(1, N_SUITES + 1):
 w = (i % N_WIDGETS) + 1
 src = textwrap.dedent(f"""\
 using BigRepro.LibA;
 using Xunit;

 namespace BigRepro.Tests;

 public class Suite{i}
 {{
 private static Widget{w} Make() => new Widget{w}(1.5, 0.25, {i}L, strict: {'true' if i % 2 == 0 else 'false'});

 [Theory]
 [InlineData(1)] [InlineData(2)] [InlineData(3)] [InlineData(4)] [InlineData(5)]
 public void Calc10Works(int n)
 {{
 var w = Make();
 var v = w.Calc(n * 10);
 Assert.False(double.IsNaN(v));
 Assert.True(w.Touch(n, n + 1, n + 2, n) != long.MinValue);
 }}

 [Fact]
 public void RejectsBadConfig()
 {{
 Assert.Throws<ArgumentException>(() => new Widget{w}(double.NaN, 0, 1, false));
 }}

 [Fact]
 public async Task ConcurrentTouchVsEvict()
 {{
 var w = Make();
 var t1 = Task.Run(() => {{ for (var k = 0; k < 200; k++) w.Touch(k, k + 1, k + 2, k); }});
 var t2 = Task.Run(() => {{ for (var k = 0; k < 200; k++) w.Evict(k, k + 1, 3); }});
 await Task.WhenAll(t1, t2);
 Assert.True(w.Count >= 0);
 }}

 [Theory]
 [InlineData(-1, "negative")] [InlineData(0, "zero")] [InlineData(5, "small")]
 [InlineData(50, "medium")] [InlineData(500, "large")]
 public void DescribeBuckets(int n, string expected)
 {{
 Assert.Equal(expected, Make().Describe(n));
 }}

 [Theory]
 [InlineData(1, "x", true)] [InlineData(-1, "x", false)] [InlineData(1, "", false)]
 public void ValidateWorks(int n, string tag, bool expected)
 {{
 Assert.Equal(expected, Make().Validate(n, tag));
 }}
 }}
 """)
 (ROOT / "Tests" / f"Suite{i}.cs").write_text(src)

print(f"Generated {ROOT}")
print(f" LibA: {N_WIDGETS} widget classes")
print(f" Tests: {N_SUITES} suites (~{N_SUITES * 15} test cases)")
print(" Tests.csproj carries the literal token COVERAGE_VERSION -- substitute per run.")

probe_live.py — runs it, observes the buffer, and performs the truncation

#!/usr/bin/env python3
"""Observe the coverage buffer / rewritten-assembly state WHILE an instrumented
run is in flight, then attempt the microsoft/codecoverage#232 truncation repro.

Adds a deliberately slow test to the generated solution so there is a window to
observe in, launches `dotnet test --coverage`, and polls:
 - /tmp/CodeCoverage.* (the shared world-writable buffer files)
 - the test output dir (*.orig -> rewrite-in-place evidence)
 - the process maps (is the buffer mmap'd into the test host?)

Usage: probe_live.py <coverage-version> <tfm> <xunit-pkg> [truncate|observe]
"""
import os, shutil, subprocess, sys, pathlib, time, threading, glob, textwrap

VERSION = sys.argv[1] if len(sys.argv) > 1 else "18.10.0"
TFM = sys.argv[2] if len(sys.argv) > 2 else "net8.0"
XPKG = sys.argv[3] if len(sys.argv) > 3 else "xunit.v3.mtp-v2"
MODE = sys.argv[4] if len(sys.argv) > 4 else "observe"

ROOT = pathlib.Path("/data/tmp/cov-repro/BigRepro")
WORK = pathlib.Path(f"/data/tmp/cov-repro/live-{VERSION}-{TFM}-{MODE}")
LOG = []


def say(m):
 print(m, flush=True)
 LOG.append(str(m))


def sh(cmd, **kw):
 e = dict(os.environ); e["DOTNET_CLI_TELEMETRY_OPTOUT"] = "1"; e["DOTNET_NOLOGO"] = "1"
 return subprocess.run(cmd, capture_output=True, text=True, env=e, **kw)


# ----------------------------------------------------------------- prepare
if WORK.exists():
 shutil.rmtree(WORK)
shutil.copytree(ROOT, WORK)
csproj = WORK / "Tests" / "Tests.csproj"
csproj.write_text(csproj.read_text()
 .replace("COVERAGE_VERSION", VERSION)
 .replace("XUNIT_PKG", XPKG)
 .replace("XUNIT_VERSION", "3.2.2"))

# a slow test so instrumented code is live long enough to observe / attack
(WORK / "Tests" / "SlowSuite.cs").write_text(textwrap.dedent("""\
 using BigRepro.LibA;
 using Xunit;

 namespace BigRepro.Tests;

 public class SlowSuite
 {
 // Keeps instrumented user code executing continuously for ~30s so the
 // coverage buffer is mapped and being written the whole time.
 [Fact]
 public void ChurnsInstrumentedCodeForThirtySeconds()
 {
 var deadline = DateTime.UtcNow.AddSeconds(30);
 var w1 = new Widget1(1.5, 0.25, 7L, false);
 var w2 = new Widget2(2.5, 0.5, 9L, true);
 long acc = 0;
 while (DateTime.UtcNow < deadline)
 {
 for (var k = 0; k < 5000; k++)
 {
 acc += w1.Touch(k, k + 1, k + 2, k);
 acc += w2.Evict(k, k + 1, 3);
 acc += (long)w1.Calc(8);
 acc += w2.Describe(k % 200).Length;
 acc += w1.Validate(k, "t") ? 1 : 0;
 }
 }
 Assert.True(acc != long.MinValue);
 }
 }
 """))

say(f"=== live probe: CodeCoverage {VERSION}, {TFM}, {XPKG}, mode={MODE} ===")
r = sh(["dotnet", "build", "Tests/Tests.csproj", "-c", "Release", "-f", TFM], cwd=WORK, timeout=900)
say(f"[build] rc={r.returncode}")
if r.returncode != 0:
 say(r.stdout[-4000:]); say(r.stderr[-3000:]); sys.exit(1)

BIN = WORK / "Tests" / "bin" / "Release" / TFM
pre_tmp = set(glob.glob("/tmp/CodeCoverage.*"))

# ----------------------------------------------------------------- launch
proc = subprocess.Popen(
 ["dotnet", "test", "--project", "Tests/Tests.csproj", "-c", "Release", "-f", TFM,
 "--coverage", "--coverage-output-format", "cobertura"],
 cwd=WORK, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True,
 env={**os.environ, "DOTNET_CLI_TELEMETRY_OPTOUT": "1", "DOTNET_NOLOGO": "1"})

observations = {"tmp_bufs": {}, "orig_files": set(), "maps": [], "host_pids": set(), "cmdlines": {}}
stop = threading.Event()
attacked = {"done": False, "path": None, "size": None}


def poller():
 t0 = time.time()
 while not stop.is_set() and time.time() - t0 < 120:
 # 1. buffer files
 for f in glob.glob("/tmp/CodeCoverage.*"):
 if f in pre_tmp:
 continue
 try:
 observations["tmp_bufs"].setdefault(f, []).append(os.path.getsize(f))
 except OSError:
 pass
 # 2. rewrite-in-place evidence
 for f in BIN.glob("*.orig"):
 observations["orig_files"].add(f.name)
 # 3. is a buffer mapped into a live process? (scan every readable /proc/<pid>/maps)
 if not observations["maps"]:
 for pid in os.listdir("/proc"):
 if not pid.isdigit():
 continue
 try:
 maps = open(f"/proc/{pid}/maps").read()
 except (OSError, PermissionError):
 continue
 if "CodeCoverage" not in maps:
 continue
 observations["host_pids"].add(pid)
 try:
 cl = open(f"/proc/{pid}/cmdline", "rb").read().decode(errors="replace").replace("\x00", " ")
 except OSError:
 cl = "?"
 observations["cmdlines"][pid] = cl.strip()[:200]
 for line in maps.splitlines():
 if "CodeCoverage" in line:
 observations["maps"].append(f"pid {pid}: {line}")
 # 4. attack, once, after the buffer is live and being written
 if MODE == "truncate" and not attacked["done"]:
 live = [f for f, sizes in observations["tmp_bufs"].items() if sizes and sizes[-1] > 0]
 if live and observations["maps"] and time.time() - t0 > 6:
 target = sorted(live, key=lambda p: os.path.getsize(p))[-1]
 attacked["path"] = target
 try:
 attacked["size"] = os.path.getsize(target)
 os.truncate(target, 0)
 attacked["done"] = True
 except OSError as e:
 attacked["done"] = True
 attacked["size"] = f"truncate failed: {e}"
 time.sleep(0.02)


th = threading.Thread(target=poller, daemon=True)
th.start()
try:
 out, _ = proc.communicate(timeout=300)
except subprocess.TimeoutExpired:
 proc.kill(); out, _ = proc.communicate()
stop.set(); th.join(timeout=5)

# ----------------------------------------------------------------- report
say(f"\n[dotnet test] rc={proc.returncode}")
for line in out.strip().splitlines()[-30:]:
 say(" " + line)

say(f"\n[buffer files seen in /tmp during the run] {len(observations['tmp_bufs'])}")
for f, sizes in sorted(observations["tmp_bufs"].items())[:12]:
 uniq = sorted(set(sizes))
 say(f" {f} sizes seen: {uniq[:8]}{' ...' if len(uniq) > 8 else ''} samples={len(sizes)}")

say(f"\n[mmap of a buffer into the test host] {len(observations['maps'])} lines")
for m in observations["maps"][:10]:
 say(" " + m)

say(f"\n[*.orig in the output dir during the run] {sorted(observations['orig_files'])}")
say(f"[pids with a CodeCoverage mapping] {sorted(observations['host_pids'])}")
for pid, cl in observations["cmdlines"].items():
 say(f" pid {pid}: {cl}")

if MODE == "truncate":
 say(f"\n[attack] truncated={attacked['done']} path={attacked['path']} size_before={attacked['size']}")

say(f"\n[AccessViolation in output?] {'YES' if 'AccessViolation' in out else 'no'}")
say(f"[exit 134 / SIGABRT?] {'YES' if proc.returncode in (134, -6) else 'no (rc=%s)' % proc.returncode}")

pathlib.Path(f"/data/tmp/cov-repro/log-live-{VERSION}-{TFM}-{MODE}.txt").write_text("\n".join(LOG) + "\n\n--- full output ---\n" + out)
say(f"\n[log] /data/tmp/cov-repro/log-live-{VERSION}-{TFM}-{MODE}.txt")

python3 gen_repro.py
python3 probe_live.py 18.10.0 net8.0 xunit.v3.mtp-v2 truncate # faults
python3 probe_live.py 18.10.0 net8.0 xunit.v3.mtp-v2 observe # control, clean

Note for anyone reproducing: with 18.9.0/18.10.0 the plain xunit.v3 3.2.2 package no longer works — the run dies at startup with TypeLoadException: Could not load type 'Microsoft.Testing.Platform.Extensions.TestHost.IDataConsumer' from assembly 'Microsoft.Testing.Platform, Version=2.3.3.0', because xunit.v3 pulls xunit.v3.mtp-v1 while the coverage package requires Microsoft.Testing.Platform 2.3.x. Referencing xunit.v3.mtp-v2 instead fixes it. That is a separate packaging matter, not part of this issue, but it will block a naive repro attempt.

What would actually close this

Remedy 3 is the one that matters, and it is independent of how the buffer is created or referenced: a coverage probe failing should never terminate the process, and should never be attributed to user code. Even a one-time validity check with a graceful disable, or a marker frame that makes the probe's provenance visible in the stack, would have saved us the investigation that produced this report. Remedy 2 (a private or anonymous mapping — memfd_create, or at minimum a private directory rather than a path any process on the machine can truncate) removes the most easily triggered cause.

Happy to test any prerelease build against the same harness.