[Bug] `perfetto_hprof_` thread crashes with SIGSEGV (SEGV_ACCERR) in `__cxa_atexit`

[Pandoriaantje]

Steps to reproduce/复现步骤

1. install NeoZygisk module

Expected behaviour/预期行为

no app crashes

Actual behaviour/实际行为

Ring buffer get filled up with app crashes.
On every Zygote app fork, the perfetto_hprof_ thread spawned by ART crashes with
signal 11 (SIGSEGV), code 2 (SEGV_ACCERR) inside __cxa_atexit+556 in libc.so.
This produces a tombstone for every affected process. 31 tombstones accumulated in a single boot session.

Root implementation/Root 方案

KernelSU-Next legacy 3.1.0

System Module List/系统模块列表

See https://github.com/PerformanC/ReZygisk/commit/d111a2dfc52b1aa74d3bf6f1c6120598c855acb6 for ReZygisk fix

NeoZygisk version/NeoZygisk 版本

v2.3

Android version/Android 版本

kernel 4.14, Samsung Galaxy S10+ (beyond2lteeea)

Version requirement/版本要求

• I am using the latest debug build from GitHub Actions./我正在使用 GitHub Actions 中最新的调试版本。

Logs/日志

### Tombstone (representative excerpt)
pid: 28779, tid: 28797, name: perfetto_hprof_  >>> com.samsung.android.app.galaxyfinder:appservice <<<
uid: 10059
signal 11 (SIGSEGV), code 2 (SEGV_ACCERR), fault addr 0x745d5c01c0
x0  000000745d5c0000  x1  0000000000001000  x2  0000000000000001  x3  000000713ba6b998
...
backtrace:
  #00 pc 0x000b8484  /apex/com.android.runtime/lib64/bionic/libc.so (_cxa_atexit+556)
  #01 pc 0x000215bc  /apex/com.android.art/lib64/libperfetto_hprof.so (ArtPlugin_Initialize::$33+1260)
  #02 pc 0x000b4b38  /apex/com.android.runtime/lib64/bionic/libc.so (_pthread_start+264)
  #03 pc 0x00052c60  /apex/com.android.runtime/lib64/bionic/libc.so (_start_thread+64)
memory near x0 (anon:atexit handlers):   ← fault address is inside this mapping
Also reproduces with `uid: 1000 / Cmdline: <pre-initialized>` (Zygote itself before app name is assigned):
pid: 28482, tid: 28498, name: perfetto_hprof_  >>> <pre-initialized> <<<
signal 11 (SIGSEGV), code 2 (SEGV_ACCERR), fault addr 0x7bb95791c0

[Pandoriaantje]

ReZygisk has a workaround/fix for this bug. NeoZygisk silently crashes all apps and fills up the ring buffer/32 tombstone slots.
See PerformanC/ReZygisk@d111a2d

[JingMatrix]

It is unlikely to be cause you mentioned, as we have adapted the same mechinism as well: #37

Please upload your full logs with debug builds of LSPosed and NeoZygisk, we cannot reproduce your issue, and need to figure out the actual casue.