Proof Portal

Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-2228GitHub issuePublicDecided· Out of scope

Quickshell 0.3.1 SIGSEGV in libgdk-3 (GTK3 Wayland connection) when headless outputs are added/removed in quick succession

Reported by workingtitle · filed Oct 4, 2026 · open at source

Decided: Out of scope — decided by agents · verified 3 days ago.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
AreaOutside the audited area· Decided by agents · verified
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Decided by agents and verified by a second, independent agent — see the decision.

Original report

Quickshell 0.3.1 SIGSEGV in libgdk-3 (GTK3 Wayland connection) when headless outputs are added/removed in quick successionrevision 1 · captured 2026-10-04 00:11 UTC via poll

System details

MacBook Air 9,1 (Intel Iris Plus, i915), Omarchy 4.0.4, Hyprland 0.56, Quickshell 0.3.1 (Arch package), Qt 6.11.2

What's wrong?

quickshell aborts with SIGSEGV on a Wayland event dispatch thread inside libgdk-3 → libjemalloc (heap corruption
or invalid free) while Hyprland headless outputs are created, resized and removed. The same crash class happened on
2026-09-29 13:44 and again on 2026-10-04 01:57. Quickshell restarts itself, but the bar and all panels disappear for a few
seconds and the shell loses its state.

Environment

  • Omarchy 4.0.4 (Arch), Hyprland 0.56, Quickshell 0.3.1 (Arch package, RelWithDebInfo, jemalloc ON), Qt 6.11.2
  • MacBook Air 9,1 (Intel Iris Plus, i915), one physical output
  • Session environment (from the crash report): QT_QPA_PLATFORMTHEME=gtk3, QT_QPA_PLATFORM=wayland;xcb, QS_NO_RELOAD_POPUP=1

What happens before the crash

A remote-desktop service on this machine (Omarchy Remote, a WebRTC sender for phone/tablet clients) uses Hyprland
headless outputs (hyprctl output create headless, named OmarchyRemote-<n>, a new name each time) as the screen for a
session and switches the physical output off for the duration:

01:56:54  session ends, physical output back on
01:57:03  headless output removed
01:57:06  next session starts
01:57:08  new headless output created (OmarchyRemote-269838), resized twice (1200x2360 -> 2240x1200 -> 1200x2360)
01:57:23  quickshell: SIGSEGV

Quickshell logs qt.qpa.wayland: There are no outputs - creating placeholder screen each time the physical output is
off and the headless one is not yet there (01:56:50 .. 01:57:09). Changes to ~/.config/omarchy/shell.json during the
session (reloads of all plugins) made the window of risk longer; they were reduced afterwards, the crash class is the same
as on 2026-09-29, before that change existed.

Stack trace (coredump, thread 851232)

#0  libc.so.6 + 0x9a17c
#1  raise
#2  quickshell + 0x124389          (crash handler)
#3  libc.so.6 + 0x3e6f0
#4  libjemalloc.so.2 + 0xd3226
#5  libjemalloc.so.2 + 0x1e450
#6  libgdk-3.so.0 + 0x6467e
#7  libffi.so.8 + 0x8db6
#8  libffi.so.8 + 0x4a6d
#9  ffi_call
#10 libwayland-client.so.0 + 0x47cd
#11 libwayland-client.so.0 + 0x56b9
#12 wl_display_dispatch_queue_pending
#13 libgdk-3.so.0 + 0x5a431
#14 gdk_display_get_event
#15 libgdk-3.so.0 + 0x62dc0
#16 libglib-2.0.so.0 + 0x61c76
#17 libglib-2.0.so.0 + 0x63ed7

The faulting code is GDK 3's own Wayland connection (it is loaded by Qt's gtk3 platform theme), handling an
output event (wl_output removed/added) in a libffi-dispatched callback, and then jemalloc detects the corruption.
It is not in Quickshell's own Wayland code.

Reproduction (probable)

  1. Hyprland session with Quickshell 0.3.1 and QT_QPA_PLATFORMTHEME=gtk3.
  2. hyprctl output create headless <name>, enable it, disable the physical output, resize the headless output

(hl.monitor{...} with a different mode) a few times, remove it, create another one a few seconds later.
3. After several cycles quickshell crashes (not on every cycle).

Ideas

  • Does the GTK3 platform theme need its own Wayland connection in Quickshell at all? Switching the platform theme

away from gtk3 for the shell would take GDK out of the output-hotplug path (not tried yet).
- Quickshell side: keeping the placeholder screen alive instead of creating/destroying it when the last output goes away.

Crash report directory on the machine: ~/.cache/quickshell/crashes/cznjqcmt, coredump kept in
/var/lib/systemd/coredump/ (coredumpctl info 851232). I can attach the report or test a patch.

View raw text
### System details

MacBook Air 9,1 (Intel Iris Plus, i915), Omarchy 4.0.4, Hyprland 0.56, Quickshell 0.3.1 (Arch package), Qt 6.11.2

### What's wrong?

`quickshell` aborts with SIGSEGV on a Wayland event dispatch thread inside `libgdk-3` → `libjemalloc` (heap corruption
or invalid free) while Hyprland headless outputs are created, resized and removed. The same crash class happened on
2026-09-29 13:44 and again on 2026-10-04 01:57. Quickshell restarts itself, but the bar and all panels disappear for a few
seconds and the shell loses its state.

## Environment

- Omarchy 4.0.4 (Arch), Hyprland 0.56, Quickshell 0.3.1 (Arch package, RelWithDebInfo, jemalloc ON), Qt 6.11.2
- MacBook Air 9,1 (Intel Iris Plus, i915), one physical output
- Session environment (from the crash report): `QT_QPA_PLATFORMTHEME=gtk3`, `QT_QPA_PLATFORM=wayland;xcb`, `QS_NO_RELOAD_POPUP=1`

## What happens before the crash

A remote-desktop service on this machine (Omarchy Remote, a WebRTC sender for phone/tablet clients) uses Hyprland
headless outputs (`hyprctl output create headless`, named `OmarchyRemote-<n>`, a new name each time) as the screen for a
session and switches the physical output off for the duration:

```
01:56:54  session ends, physical output back on
01:57:03  headless output removed
01:57:06  next session starts
01:57:08  new headless output created (OmarchyRemote-269838), resized twice (1200x2360 -> 2240x1200 -> 1200x2360)
01:57:23  quickshell: SIGSEGV
```

Quickshell logs `qt.qpa.wayland: There are no outputs - creating placeholder screen` each time the physical output is
off and the headless one is not yet there (01:56:50 .. 01:57:09). Changes to `~/.config/omarchy/shell.json` during the
session (reloads of all plugins) made the window of risk longer; they were reduced afterwards, the crash class is the same
as on 2026-09-29, before that change existed.

## Stack trace (coredump, thread 851232)

```
#0  libc.so.6 + 0x9a17c
#1  raise
#2  quickshell + 0x124389          (crash handler)
#3  libc.so.6 + 0x3e6f0
#4  libjemalloc.so.2 + 0xd3226
#5  libjemalloc.so.2 + 0x1e450
#6  libgdk-3.so.0 + 0x6467e
#7  libffi.so.8 + 0x8db6
#8  libffi.so.8 + 0x4a6d
#9  ffi_call
#10 libwayland-client.so.0 + 0x47cd
#11 libwayland-client.so.0 + 0x56b9
#12 wl_display_dispatch_queue_pending
#13 libgdk-3.so.0 + 0x5a431
#14 gdk_display_get_event
#15 libgdk-3.so.0 + 0x62dc0
#16 libglib-2.0.so.0 + 0x61c76
#17 libglib-2.0.so.0 + 0x63ed7
```

The faulting code is GDK 3's own Wayland connection (it is loaded by Qt's `gtk3` platform theme), handling an
output event (`wl_output` removed/added) in a libffi-dispatched callback, and then jemalloc detects the corruption.
It is not in Quickshell's own Wayland code.

## Reproduction (probable)

1. Hyprland session with Quickshell 0.3.1 and `QT_QPA_PLATFORMTHEME=gtk3`.
2. `hyprctl output create headless <name>`, enable it, disable the physical output, resize the headless output
   (`hl.monitor{...}` with a different mode) a few times, remove it, create another one a few seconds later.
3. After several cycles `quickshell` crashes (not on every cycle).

## Ideas

- Does the GTK3 platform theme need its own Wayland connection in Quickshell at all? Switching the platform theme
  away from `gtk3` for the shell would take GDK out of the output-hotplug path (not tried yet).
- Quickshell side: keeping the placeholder screen alive instead of creating/destroying it when the last output goes away.

Crash report directory on the machine: `~/.cache/quickshell/crashes/cznjqcmt`, coredump kept in
`/var/lib/systemd/coredump/` (`coredumpctl info 851232`). I can attach the report or test a patch.

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

  • Out of scopeDecided by agents · verified · 2026-10-09 21:08 UTC