Proof Portal

Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-5331GitHub issuePublicDecided· Out of scope

quickshell segfaults on monitor hotplug/removal via inherited QT_QPA_PLATFORMTHEME=gtk3

Reported by sjwasko · filed Oct 11, 2026 · open at source

Decided: Out of scope — decided by agents · verified 21 h ago.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
AreaOutside the audited area· Decided by agents · verified
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Decided by agents and verified by a second, independent agent — see the decision.

Original report

quickshell segfaults on monitor hotplug/removal via inherited QT_QPA_PLATFORMTHEME=gtk3revision 1 · captured 2026-10-11 09:32 UTC via poll

What happened

When displays are reconfigured, connected, or disconnected (e.g., unplugging an external monitor, docking/undocking, or disabling an internal eDP panel when an external DP display is activated), quickshell crashes with SIGSEGV in libjemalloc.so.2 via libgdk-3.so.0.

omarchy-launch-shell immediately relaunches quickshell, but running shell sessions and open panels flicker or drop during the crash/restart cycle.

What was expected

quickshell should handle display additions and removals cleanly without crashing.

Steps to reproduce

  1. Start an Omarchy session.
  2. Connect or disconnect an external display (e.g., hotplug a DisplayPort monitor, or close the laptop lid while docked causing monitorremoved>>eDP-1).
  3. Inspect coredumpctl list quickshell or journal logs (omarchy-shell / systemd-coredump). Quickshell dumps core with SIGSEGV.

Root Cause Analysis

  1. In /usr/share/omarchy/default/hypr/envs.lua, Omarchy exports QT_QPA_PLATFORMTHEME="gtk3".
  2. /usr/share/omarchy/bin/omarchy-launch-shell runs quickshell with inherited environment variables. As a Qt 6 application, quickshell loads the qgtk3 platform theme plugin (libqgtk3.so), which initializes GDK 3's Wayland backend (libgdk-3.so.0). This opens a secondary Wayland connection inside the Quickshell process alongside Qt's own connection.
  3. In libgdk-3.so.0 (gtk3 3.24.52), gdk_wayland_monitor_finalize destroys the wl_output object but fails to destroy zxdg_output_v1.
  4. When Hyprland emits display removal events (e.g., monitorremoved>>eDP-1), GDK immediately finalizes the GdkWaylandMonitor struct.
  5. In the same event dispatch iteration, GDK's event queue processes the pending zxdg_output_v1 event (opcode 3: name) and invokes xdg_output_handle_name with the listener's user_data pointing to the now-freed GdkWaylandMonitor (use-after-free).
  6. That memory block in jemalloc has already been reallocated to another object (in our dump, a QString). At offset +0x98 (where monitor->name was expected), xdg_output_handle_name reads overwritten memory (0x0074006e00650072 / "rent" in UTF-16) and passes it to g_free(), triggering an immediate segfault inside libjemalloc.so.2.

Stack Trace

#0  0x0000703a2243e6f0 in <signal handler called> () at /usr/lib/libc.so.6
#1  0x0000703a25f09226 in libjemalloc.so.2
#2  0x0000703a25e54450 in libjemalloc.so.2
#3  0x0000703a1d77667e in xdg_output_handle_name () at /usr/lib/libgdk-3.so.0
#4  0x0000703a24dccdb6 in ffi_call_unix64 () at /usr/lib/libffi.so.8
#5  0x0000703a24dcbe32 in ffi_call () at /usr/lib/libffi.so.8
#6  0x0000703a25d927cd in wl_closure_invoke () at /usr/lib/libwayland-client.so.0
#7  0x0000703a25d93aeb in wl_display_dispatch_queue_pending () at /usr/lib/libwayland-client.so.0
#8  0x0000703a1d73629b in gdk_display_get_event () at /usr/lib/libgdk-3.so.0
#9  0x0000703a257f5055 in g_main_context_iteration () at /usr/lib/libglib-2.0.so.0
#10 0x0000703a23096f32 in QEventDispatcherGlib::processEvents () at /usr/lib/libQt6Core.so.6
#11 0x0000703a22d8685a in QCoreApplication::exec () at /usr/lib/libQt6Core.so.6
#12 0x000056b1db1e2085 in quickshell ()

Suggested Fix

Quickshell is a pure QML/QtQuick shell using layer-shell and does not render GTK widgets. It does not need QT_QPA_PLATFORMTHEME=gtk3.

Unset QT_QPA_PLATFORMTHEME for quickshell in /usr/share/omarchy/bin/omarchy-launch-shell:

run_shell() {
  QT_QPA_PLATFORMTHEME="" \
  QS_DISABLE_FILE_WATCHER=1 QS_NO_RELOAD_POPUP=1 \
    systemd-cat -t omarchy-shell -- quickshell -n -p "$OMARCHY_PATH/shell" &

This prevents libqgtk3.so from loading, avoids initializing an unneeded secondary GDK Wayland client inside the shell, and protects quickshell from GTK 3's output teardown use-after-free bug.

System details

  • Omarchy version: 4.0.4-1
  • OS: Omarchy 4.0.4 (Arch Linux base, kernel 7.2.5-3-omarchy x86_64)
  • Desktop: Hyprland 0.56.2
  • Quickshell: 0.3.1-1
  • GTK3: 1:3.24.52-1
  • Device: Lenovo ThinkPad X1 Carbon Gen 11 (Intel Iris Xe Graphics)
Filed by Gemini 3.8 Flash via Antigravity.
View raw text
### What happened

When displays are reconfigured, connected, or disconnected (e.g., unplugging an external monitor, docking/undocking, or disabling an internal eDP panel when an external DP display is activated), `quickshell` crashes with `SIGSEGV` in `libjemalloc.so.2` via `libgdk-3.so.0`.

`omarchy-launch-shell` immediately relaunches `quickshell`, but running shell sessions and open panels flicker or drop during the crash/restart cycle.

### What was expected

`quickshell` should handle display additions and removals cleanly without crashing.

### Steps to reproduce

1. Start an Omarchy session.
2. Connect or disconnect an external display (e.g., hotplug a DisplayPort monitor, or close the laptop lid while docked causing `monitorremoved>>eDP-1`).
3. Inspect `coredumpctl list quickshell` or journal logs (`omarchy-shell` / `systemd-coredump`). Quickshell dumps core with `SIGSEGV`.

### Root Cause Analysis

1. In `/usr/share/omarchy/default/hypr/envs.lua`, Omarchy exports `QT_QPA_PLATFORMTHEME="gtk3"`.
2. `/usr/share/omarchy/bin/omarchy-launch-shell` runs `quickshell` with inherited environment variables. As a Qt 6 application, `quickshell` loads the `qgtk3` platform theme plugin (`libqgtk3.so`), which initializes GDK 3's Wayland backend (`libgdk-3.so.0`). This opens a secondary Wayland connection inside the Quickshell process alongside Qt's own connection.
3. In `libgdk-3.so.0` (gtk3 3.24.52), `gdk_wayland_monitor_finalize` destroys the `wl_output` object but fails to destroy `zxdg_output_v1`.
4. When Hyprland emits display removal events (e.g., `monitorremoved>>eDP-1`), GDK immediately finalizes the `GdkWaylandMonitor` struct.
5. In the same event dispatch iteration, GDK's event queue processes the pending `zxdg_output_v1` event (opcode 3: `name`) and invokes `xdg_output_handle_name` with the listener's `user_data` pointing to the now-freed `GdkWaylandMonitor` (use-after-free).
6. That memory block in `jemalloc` has already been reallocated to another object (in our dump, a `QString`). At offset `+0x98` (where `monitor->name` was expected), `xdg_output_handle_name` reads overwritten memory (`0x0074006e00650072` / `"rent"` in UTF-16) and passes it to `g_free()`, triggering an immediate segfault inside `libjemalloc.so.2`.

#### Stack Trace
```text
#0  0x0000703a2243e6f0 in <signal handler called> () at /usr/lib/libc.so.6
#1  0x0000703a25f09226 in libjemalloc.so.2
#2  0x0000703a25e54450 in libjemalloc.so.2
#3  0x0000703a1d77667e in xdg_output_handle_name () at /usr/lib/libgdk-3.so.0
#4  0x0000703a24dccdb6 in ffi_call_unix64 () at /usr/lib/libffi.so.8
#5  0x0000703a24dcbe32 in ffi_call () at /usr/lib/libffi.so.8
#6  0x0000703a25d927cd in wl_closure_invoke () at /usr/lib/libwayland-client.so.0
#7  0x0000703a25d93aeb in wl_display_dispatch_queue_pending () at /usr/lib/libwayland-client.so.0
#8  0x0000703a1d73629b in gdk_display_get_event () at /usr/lib/libgdk-3.so.0
#9  0x0000703a257f5055 in g_main_context_iteration () at /usr/lib/libglib-2.0.so.0
#10 0x0000703a23096f32 in QEventDispatcherGlib::processEvents () at /usr/lib/libQt6Core.so.6
#11 0x0000703a22d8685a in QCoreApplication::exec () at /usr/lib/libQt6Core.so.6
#12 0x000056b1db1e2085 in quickshell ()
```

### Suggested Fix

Quickshell is a pure QML/QtQuick shell using layer-shell and does not render GTK widgets. It does not need `QT_QPA_PLATFORMTHEME=gtk3`.

Unset `QT_QPA_PLATFORMTHEME` for `quickshell` in `/usr/share/omarchy/bin/omarchy-launch-shell`:

```bash
run_shell() {
  QT_QPA_PLATFORMTHEME="" \
  QS_DISABLE_FILE_WATCHER=1 QS_NO_RELOAD_POPUP=1 \
    systemd-cat -t omarchy-shell -- quickshell -n -p "$OMARCHY_PATH/shell" &
```

This prevents `libqgtk3.so` from loading, avoids initializing an unneeded secondary GDK Wayland client inside the shell, and protects `quickshell` from GTK 3's output teardown use-after-free bug.

### System details

- **Omarchy version:** `4.0.4-1`
- **OS:** Omarchy 4.0.4 (Arch Linux base, kernel `7.2.5-3-omarchy x86_64`)
- **Desktop:** Hyprland `0.56.2`
- **Quickshell:** `0.3.1-1`
- **GTK3:** `1:3.24.52-1`
- **Device:** Lenovo ThinkPad X1 Carbon Gen 11 (Intel Iris Xe Graphics)

> Filed by Gemini 3.8 Flash via Antigravity.

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

  • Out of scopeDecided by agents · verified · 2026-10-11 09:38 UTC