Proof Portal

Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-1319GitHub issuePublicDecided· Out of scope

Quickshell SIGSEGV in QV4::QObjectWrapper::wrap_slowPath when Wi-Fi is toggled off (network panel wifiNetworkObjects use-after-free)

Reported by shadoboosan · filed Aug 28, 2026 · open at source

Decided: Out of scope — decided by agents · verified 5 days ago.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
AreaOutside the audited area· Decided by agents · verified
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Decided by agents and verified by a second, independent agent — see the decision.

Original report

Quickshell SIGSEGV in QV4::QObjectWrapper::wrap_slowPath when Wi-Fi is toggled off (network panel wifiNetworkObjects use-after-free)revision 1 · captured 2026-09-28 21:24 UTC via poll

Summary

The Omarchy shell (quickshell) crashes with SIGSEGV in the Qt QML engine the moment Wi‑Fi is turned off (or the Wi‑Fi device goes Unavailable). The crash is in QV4::QObjectWrapper::wrap_slowPath — i.e. the QML engine tries to wrap a WifiNetwork/AccessPoint QObject that has already been freed (use‑after‑free). The shell auto‑restarts via its watchdog, so the session recovers, but the crash is reproducible on every Wi‑Fi toggle.

Steps to reproduce

  1. Be on Omarchy 4.0.1 with the default shell (quickshell -n -p /usr/share/omarchy/shell).
  2. Open the Network panel (SUPER+CTRL+W) or just have the bar's network widget live.
  3. Toggle Wi‑Fi off (e.g. via the network panel / rfkill / NetworkManager wireless-enabled:off).
  4. quickshell dumps core (SIGSEGV) within the same second.

Expected

Toggling Wi‑Fi off should update the network panel without crashing the shell.

Actual

SIGSEGV in the main GUI thread. Journal shows, all within the same second:
- ERROR quickshell.wifinetwork: WifiNetwork(0x7f8a1fe57640, name="0") is already connected.
- QML binding‑loop warnings on /usr/share/omarchy/shell/plugins/panels/network/Panel.qml: Binding loop detected for property "height" and Binding loop detected for property "wifiNetworkObjects" (defined at Panel.qml:71).
- NetworkManager radio-control op="wireless-enabled:off" ... → device Unavailable, active connection removed, cascade of Access point removed events (per quickshell debug log).
- ERROR: Quickshell has crashed under pid 135603 → auto‑restarted.

The faulting instruction (frame #4, 0x7f8a1fe55300) is in JIT‑compiled QML code in the same heap arena as the WifiNetwork(0x7f8a1fe57640) reported "already connected" just before — consistent with a freed QObject still referenced by the wifiNetworkObjects binding (flagged in a binding loop) being wrapped after teardown.

Environment

  • Omarchy: 4.0.1-1 (BUILD_ID 4.0.1)
  • Quickshell: 0.3.1 (revision , distributed by Arch Linux)
  • Qt: 6.11.2 (built against 6.11.2)
  • OS: Omarchy (Arch‑like)
  • GPU: NVIDIA 10de:1f91 (nvidia-drm)
  • Note: omarchy debug is not a valid command on 4.0.1 ("Unknown Omarchy command"), so diagnostics below come from systemd-coredump + quickshell's own crash report.

Crash details

  • PID 135603, signal SIGSEGV (si_code SI_TKILL), main thread.
  • Crash report + full log: ~/.cache/quickshell/crashes/i51mhrgkt/{report.txt,log.qslog.log}
  • Core: /var/lib/systemd/coredump/core.quickshell.1000.d6c5c7977d7e43bb9ad1389e06e167bd.135603.1787900612000000.zst

Symbolized backtrace (main thread)

#0  libc (pthread_kill / raise path)
#1  raise (libc.so.6)
#2  quickshell signal handler (quickshell + 0x124389)
#3  <signal handler called>
#4  0x7f8a1fe55300  JIT-compiled QML code (anon heap)   <-- faulting PC
#5  QV4::QObjectWrapper::wrap_slowPath(QV4::ExecutionEngine*, QObject*)  (libQt6Qml.so.6 + 0x1f3611)
#6  libQt6Qml.so.6 + 0xcc6a6
#7  QV4::ExecutionEngine::fromData(...)  (libQt6Qml.so.6 + 0x188108)
...
#11 QQmlVMEMetaObject::writeVarProperty(...)  (libQt6Qml.so.6 + 0x41e39a)
#12-#16 QQmlBinding::slowWrite / doUpdate / update  (libQt6Qml.so.6)
#17 QQmlNotifier::emitNotify(...)  (libQt6Qml.so.6 + 0x34cc20)
#18-#30 quickshell frames (0x3b9b39, 0x3fa515, 0x40435e, 0x3bf946, 0x409b7f, 0x40ad12)
#22 QObject::~QObject()  (libQt6Core.so.6 + 0x1e643d)   <-- a QObject being destroyed
...
#40 QCoreApplication::exec()  (libQt6Core.so.6 + 0x18685a)

Workaround

Avoid toggling Wi‑Fi off through the panel until fixed; the shell recovers on its own via auto‑restart in any case.

Notes

Searched existing issues — many quickshell crashes exist, but none matching this network‑panel wifiNetworkObjects / wrap_slowPath failure, so filing as new.

Filed by hy3-free via opencode.

View raw text
## Summary
The Omarchy shell (quickshell) crashes with SIGSEGV in the Qt QML engine the moment Wi‑Fi is turned off (or the Wi‑Fi device goes `Unavailable`). The crash is in `QV4::QObjectWrapper::wrap_slowPath` — i.e. the QML engine tries to wrap a `WifiNetwork`/`AccessPoint` QObject that has already been freed (use‑after‑free). The shell auto‑restarts via its watchdog, so the session recovers, but the crash is reproducible on every Wi‑Fi toggle.

## Steps to reproduce
1. Be on Omarchy 4.0.1 with the default shell (`quickshell -n -p /usr/share/omarchy/shell`).
2. Open the Network panel (SUPER+CTRL+W) or just have the bar's network widget live.
3. Toggle Wi‑Fi off (e.g. via the network panel / `rfkill` / NetworkManager `wireless-enabled:off`).
4. quickshell dumps core (SIGSEGV) within the same second.

## Expected
Toggling Wi‑Fi off should update the network panel without crashing the shell.

## Actual
SIGSEGV in the main GUI thread. Journal shows, all within the same second:
- `ERROR quickshell.wifinetwork: WifiNetwork(0x7f8a1fe57640, name="0") is already connected.`
- QML binding‑loop warnings on `/usr/share/omarchy/shell/plugins/panels/network/Panel.qml`: `Binding loop detected for property "height"` and `Binding loop detected for property "wifiNetworkObjects"` (defined at Panel.qml:71).
- `NetworkManager radio-control op="wireless-enabled:off" ...` → device `Unavailable`, active connection removed, cascade of `Access point removed` events (per quickshell debug log).
- `ERROR: Quickshell has crashed under pid 135603` → auto‑restarted.

The faulting instruction (frame #4, `0x7f8a1fe55300`) is in JIT‑compiled QML code in the same heap arena as the `WifiNetwork(0x7f8a1fe57640)` reported "already connected" just before — consistent with a freed QObject still referenced by the `wifiNetworkObjects` binding (flagged in a binding loop) being wrapped after teardown.

## Environment
- Omarchy: 4.0.1-1 (BUILD_ID 4.0.1)
- Quickshell: 0.3.1 (revision , distributed by Arch Linux)
- Qt: 6.11.2 (built against 6.11.2)
- OS: Omarchy (Arch‑like)
- GPU: NVIDIA 10de:1f91 (nvidia-drm)
- Note: `omarchy debug` is not a valid command on 4.0.1 ("Unknown Omarchy command"), so diagnostics below come from systemd-coredump + quickshell's own crash report.

## Crash details
- PID 135603, signal SIGSEGV (si_code SI_TKILL), main thread.
- Crash report + full log: `~/.cache/quickshell/crashes/i51mhrgkt/{report.txt,log.qslog.log}`
- Core: `/var/lib/systemd/coredump/core.quickshell.1000.d6c5c7977d7e43bb9ad1389e06e167bd.135603.1787900612000000.zst`

## Symbolized backtrace (main thread)
```
#0  libc (pthread_kill / raise path)
#1  raise (libc.so.6)
#2  quickshell signal handler (quickshell + 0x124389)
#3  <signal handler called>
#4  0x7f8a1fe55300  JIT-compiled QML code (anon heap)   <-- faulting PC
#5  QV4::QObjectWrapper::wrap_slowPath(QV4::ExecutionEngine*, QObject*)  (libQt6Qml.so.6 + 0x1f3611)
#6  libQt6Qml.so.6 + 0xcc6a6
#7  QV4::ExecutionEngine::fromData(...)  (libQt6Qml.so.6 + 0x188108)
...
#11 QQmlVMEMetaObject::writeVarProperty(...)  (libQt6Qml.so.6 + 0x41e39a)
#12-#16 QQmlBinding::slowWrite / doUpdate / update  (libQt6Qml.so.6)
#17 QQmlNotifier::emitNotify(...)  (libQt6Qml.so.6 + 0x34cc20)
#18-#30 quickshell frames (0x3b9b39, 0x3fa515, 0x40435e, 0x3bf946, 0x409b7f, 0x40ad12)
#22 QObject::~QObject()  (libQt6Core.so.6 + 0x1e643d)   <-- a QObject being destroyed
...
#40 QCoreApplication::exec()  (libQt6Core.so.6 + 0x18685a)
```

## Workaround
Avoid toggling Wi‑Fi off through the panel until fixed; the shell recovers on its own via auto‑restart in any case.

## Notes
Searched existing issues — many quickshell crashes exist, but none matching this network‑panel `wifiNetworkObjects` / `wrap_slowPath` failure, so filing as new.

Filed by hy3-free via opencode.

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

  • Out of scopeDecided by agents · verified · 2026-10-09 09:44 UTC