## System details

- **Omarchy:** 4.0.4-1
- **Kernel:** 7.2.5-3-omarchy
- **Compositor:** Hyprland 0.56.2-2
- **GPU:** Intel Raptor Lake-P Iris Xe (i915)
- **Display:** Huawei ZQE-CAA over HDMI-A-1
- **gtk4 installed:** 1:4.22.4-1 (from `stable-mirror.omarchy.org`, sync db dated 2026-09-08)
- **gtk4 in Arch extra:** 1:4.22.5-1 since 2026-09-10
- (`omarchy debug` does not exist in 4.0.4, so no debug log attached)

## What's wrong?

GTK 4.22.4 has a use-after-free in its Wayland dmabuf feedback handling: `linux_dmabuf_format_table()` calls `munmap()` on the wrong pointer. It usually fails silently, but when `malloc()` returned a page-aligned chunk it unmaps live heap and the next `zwp_linux_dmabuf_feedback_v1.done` event segfaults the client. Hyprland resends the format table on every monitor hotplug, so any GTK4 app can die whenever an output is removed or re-added.

GTK fixed this in 4.22.5 (NEWS: "wayland: Fix munmap() of the wrong pointer in the dmabuf format table", !10166 / !10305). Arch has shipped 1:4.22.5-1 since 2026-09-10. The Omarchy stable mirror still serves 1:4.22.4-1, so `checkupdates` on an up-to-date Omarchy machine shows nothing and every Omarchy install stays exposed.

## Evidence

Two ghostty crashes here (2026-09-18 22:29:20 and 22:34:53), both during the lock-screen output flapping described in #12208. Symbolized from the core with libwayland debuginfo:

```
#0  0x00007b082b6c2c46 in ?? () from /usr/lib/libgtk-4.so.1
#1  ffi_call_unix64 ()
#2  ffi_call_int ()
#3  ffi_call ()
#4  wl_closure_invoke (closure=0x5d96d4750970, target=0x5d96d14700e0, opcode=0, ...) at wayland-1.26.0/src/connection.c:1243
#5  dispatch_event () at wayland-client.c:1732
#6  dispatch_queue () / wl_display_dispatch_queue_pending ()
#7  ?? () from libgtk-4.so.1
#8  ?? () from libgtk-4.so.1
#9  g_main_dispatch () at gmain.c:3591
...
```

The target proxy's interface, read from the core, is `zwp_linux_dmabuf_feedback_v1`; opcode 0 is `done`. Frame 0 loads a pointer at offset 0x28 of the display struct, zeroes it, then dereferences it and faults on an unmapped heap page (`segfault at 5d96d4756008 ... error 4 in libgtk-4.so.1.2200.4`). That matches the upstream description exactly. localsend (also GTK4) logged `gtk_widget_get_scale_factor: assertion 'GTK_IS_WIDGET (widget)' failed` on every hotplug cycle in the same window.

## Expected

gtk4 1:4.22.5-1 available from the Omarchy stable mirror.

## Actual

Mirror pinned at 1:4.22.4-1, which crashes GTK4 clients on monitor hotplug.

## Reproduce

1. Omarchy 4.0.4 with gtk4 1:4.22.4-1, any GTK4 app open (ghostty, nautilus, localsend).
2. Cause repeated output hotplugs, e.g. the lock/DPMS loop in #12208, or unplug/replug an HDMI monitor a few dozen times.
3. Some GTK4 clients segfault in the dmabuf feedback `done` handler.

Filed by Claude Fable 5.1 via Claude Code.