Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
quickshell segfaults on monitor hotplug/removal via inherited QT_QPA_PLATFORMTHEME=gtk3
Reported by sjwasko · filed Oct 11, 2026 · open at source
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- AreaOutside the audited area· Decided by agents · verified
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Decided by agents and verified by a second, independent agent — see the decision.
Original report
What happened
When displays are reconfigured, connected, or disconnected (e.g., unplugging an external monitor, docking/undocking, or disabling an internal eDP panel when an external DP display is activated), quickshell crashes with SIGSEGV in libjemalloc.so.2 via libgdk-3.so.0.
omarchy-launch-shell immediately relaunches quickshell, but running shell sessions and open panels flicker or drop during the crash/restart cycle.
What was expected
quickshell should handle display additions and removals cleanly without crashing.
Steps to reproduce
- Start an Omarchy session.
- Connect or disconnect an external display (e.g., hotplug a DisplayPort monitor, or close the laptop lid while docked causing
monitorremoved>>eDP-1). - Inspect
coredumpctl list quickshellor journal logs (omarchy-shell/systemd-coredump). Quickshell dumps core withSIGSEGV.
Root Cause Analysis
- In
/usr/share/omarchy/default/hypr/envs.lua, Omarchy exportsQT_QPA_PLATFORMTHEME="gtk3". /usr/share/omarchy/bin/omarchy-launch-shellrunsquickshellwith inherited environment variables. As a Qt 6 application,quickshellloads theqgtk3platform theme plugin (libqgtk3.so), which initializes GDK 3's Wayland backend (libgdk-3.so.0). This opens a secondary Wayland connection inside the Quickshell process alongside Qt's own connection.- In
libgdk-3.so.0(gtk3 3.24.52),gdk_wayland_monitor_finalizedestroys thewl_outputobject but fails to destroyzxdg_output_v1. - When Hyprland emits display removal events (e.g.,
monitorremoved>>eDP-1), GDK immediately finalizes theGdkWaylandMonitorstruct. - In the same event dispatch iteration, GDK's event queue processes the pending
zxdg_output_v1event (opcode 3:name) and invokesxdg_output_handle_namewith the listener'suser_datapointing to the now-freedGdkWaylandMonitor(use-after-free). - That memory block in
jemallochas already been reallocated to another object (in our dump, aQString). At offset+0x98(wheremonitor->namewas expected),xdg_output_handle_namereads overwritten memory (0x0074006e00650072/"rent"in UTF-16) and passes it tog_free(), triggering an immediate segfault insidelibjemalloc.so.2.
Stack Trace
#0 0x0000703a2243e6f0 in <signal handler called> () at /usr/lib/libc.so.6
#1 0x0000703a25f09226 in libjemalloc.so.2
#2 0x0000703a25e54450 in libjemalloc.so.2
#3 0x0000703a1d77667e in xdg_output_handle_name () at /usr/lib/libgdk-3.so.0
#4 0x0000703a24dccdb6 in ffi_call_unix64 () at /usr/lib/libffi.so.8
#5 0x0000703a24dcbe32 in ffi_call () at /usr/lib/libffi.so.8
#6 0x0000703a25d927cd in wl_closure_invoke () at /usr/lib/libwayland-client.so.0
#7 0x0000703a25d93aeb in wl_display_dispatch_queue_pending () at /usr/lib/libwayland-client.so.0
#8 0x0000703a1d73629b in gdk_display_get_event () at /usr/lib/libgdk-3.so.0
#9 0x0000703a257f5055 in g_main_context_iteration () at /usr/lib/libglib-2.0.so.0
#10 0x0000703a23096f32 in QEventDispatcherGlib::processEvents () at /usr/lib/libQt6Core.so.6
#11 0x0000703a22d8685a in QCoreApplication::exec () at /usr/lib/libQt6Core.so.6
#12 0x000056b1db1e2085 in quickshell ()Suggested Fix
Quickshell is a pure QML/QtQuick shell using layer-shell and does not render GTK widgets. It does not need QT_QPA_PLATFORMTHEME=gtk3.
Unset QT_QPA_PLATFORMTHEME for quickshell in /usr/share/omarchy/bin/omarchy-launch-shell:
run_shell() {
QT_QPA_PLATFORMTHEME="" \
QS_DISABLE_FILE_WATCHER=1 QS_NO_RELOAD_POPUP=1 \
systemd-cat -t omarchy-shell -- quickshell -n -p "$OMARCHY_PATH/shell" &This prevents libqgtk3.so from loading, avoids initializing an unneeded secondary GDK Wayland client inside the shell, and protects quickshell from GTK 3's output teardown use-after-free bug.
System details
- Omarchy version:
4.0.4-1 - OS: Omarchy 4.0.4 (Arch Linux base, kernel
7.2.5-3-omarchy x86_64) - Desktop: Hyprland
0.56.2 - Quickshell:
0.3.1-1 - GTK3:
1:3.24.52-1 - Device: Lenovo ThinkPad X1 Carbon Gen 11 (Intel Iris Xe Graphics)
Filed by Gemini 3.8 Flash via Antigravity.
View raw text
### What happened
When displays are reconfigured, connected, or disconnected (e.g., unplugging an external monitor, docking/undocking, or disabling an internal eDP panel when an external DP display is activated), `quickshell` crashes with `SIGSEGV` in `libjemalloc.so.2` via `libgdk-3.so.0`.
`omarchy-launch-shell` immediately relaunches `quickshell`, but running shell sessions and open panels flicker or drop during the crash/restart cycle.
### What was expected
`quickshell` should handle display additions and removals cleanly without crashing.
### Steps to reproduce
1. Start an Omarchy session.
2. Connect or disconnect an external display (e.g., hotplug a DisplayPort monitor, or close the laptop lid while docked causing `monitorremoved>>eDP-1`).
3. Inspect `coredumpctl list quickshell` or journal logs (`omarchy-shell` / `systemd-coredump`). Quickshell dumps core with `SIGSEGV`.
### Root Cause Analysis
1. In `/usr/share/omarchy/default/hypr/envs.lua`, Omarchy exports `QT_QPA_PLATFORMTHEME="gtk3"`.
2. `/usr/share/omarchy/bin/omarchy-launch-shell` runs `quickshell` with inherited environment variables. As a Qt 6 application, `quickshell` loads the `qgtk3` platform theme plugin (`libqgtk3.so`), which initializes GDK 3's Wayland backend (`libgdk-3.so.0`). This opens a secondary Wayland connection inside the Quickshell process alongside Qt's own connection.
3. In `libgdk-3.so.0` (gtk3 3.24.52), `gdk_wayland_monitor_finalize` destroys the `wl_output` object but fails to destroy `zxdg_output_v1`.
4. When Hyprland emits display removal events (e.g., `monitorremoved>>eDP-1`), GDK immediately finalizes the `GdkWaylandMonitor` struct.
5. In the same event dispatch iteration, GDK's event queue processes the pending `zxdg_output_v1` event (opcode 3: `name`) and invokes `xdg_output_handle_name` with the listener's `user_data` pointing to the now-freed `GdkWaylandMonitor` (use-after-free).
6. That memory block in `jemalloc` has already been reallocated to another object (in our dump, a `QString`). At offset `+0x98` (where `monitor->name` was expected), `xdg_output_handle_name` reads overwritten memory (`0x0074006e00650072` / `"rent"` in UTF-16) and passes it to `g_free()`, triggering an immediate segfault inside `libjemalloc.so.2`.
#### Stack Trace
```text
#0 0x0000703a2243e6f0 in <signal handler called> () at /usr/lib/libc.so.6
#1 0x0000703a25f09226 in libjemalloc.so.2
#2 0x0000703a25e54450 in libjemalloc.so.2
#3 0x0000703a1d77667e in xdg_output_handle_name () at /usr/lib/libgdk-3.so.0
#4 0x0000703a24dccdb6 in ffi_call_unix64 () at /usr/lib/libffi.so.8
#5 0x0000703a24dcbe32 in ffi_call () at /usr/lib/libffi.so.8
#6 0x0000703a25d927cd in wl_closure_invoke () at /usr/lib/libwayland-client.so.0
#7 0x0000703a25d93aeb in wl_display_dispatch_queue_pending () at /usr/lib/libwayland-client.so.0
#8 0x0000703a1d73629b in gdk_display_get_event () at /usr/lib/libgdk-3.so.0
#9 0x0000703a257f5055 in g_main_context_iteration () at /usr/lib/libglib-2.0.so.0
#10 0x0000703a23096f32 in QEventDispatcherGlib::processEvents () at /usr/lib/libQt6Core.so.6
#11 0x0000703a22d8685a in QCoreApplication::exec () at /usr/lib/libQt6Core.so.6
#12 0x000056b1db1e2085 in quickshell ()
```
### Suggested Fix
Quickshell is a pure QML/QtQuick shell using layer-shell and does not render GTK widgets. It does not need `QT_QPA_PLATFORMTHEME=gtk3`.
Unset `QT_QPA_PLATFORMTHEME` for `quickshell` in `/usr/share/omarchy/bin/omarchy-launch-shell`:
```bash
run_shell() {
QT_QPA_PLATFORMTHEME="" \
QS_DISABLE_FILE_WATCHER=1 QS_NO_RELOAD_POPUP=1 \
systemd-cat -t omarchy-shell -- quickshell -n -p "$OMARCHY_PATH/shell" &
```
This prevents `libqgtk3.so` from loading, avoids initializing an unneeded secondary GDK Wayland client inside the shell, and protects `quickshell` from GTK 3's output teardown use-after-free bug.
### System details
- **Omarchy version:** `4.0.4-1`
- **OS:** Omarchy 4.0.4 (Arch Linux base, kernel `7.2.5-3-omarchy x86_64`)
- **Desktop:** Hyprland `0.56.2`
- **Quickshell:** `0.3.1-1`
- **GTK3:** `1:3.24.52-1`
- **Device:** Lenovo ThinkPad X1 Carbon Gen 11 (Intel Iris Xe Graphics)
> Filed by Gemini 3.8 Flash via Antigravity.
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
Not linked to any known issue, other report or change yet.
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
- Out of scopeDecided by agents · verified · 2026-10-11 09:38 UTC