Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
Quickshell SIGSEGV in GTK3's gdkscreen-wayland.c (jemalloc invalid free) handling wl_output name event during suspend/resume monitor churn
Reported by r3d3n0d0 · filed Sep 8, 2026 · open at source
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- AreaOutside the audited area· Decided by agents · verified
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Decided by agents and verified by a second, independent agent — see the decision.
Original report
What happened
quickshell (Omarchy's shell) segfaulted at 08:43:45 while the machine was resuming from suspend and outputs were being torn down/re-announced. Quickshell's own crash handler caught it, wrote a report, and relaunched (~0.5s, no visible impact beyond a tray-icon reconnect).
Symbolizing the core with gdb + Arch's debuginfod (full debug info resolved — this is not a guess from offsets) gives:
#5 atomic_load_p (a=0x0, ...) at include/jemalloc/internal/atomic.h:82
#6 rtree_child_node_tryread (elm=0x0, ...) at src/rtree.c:110
#7 je_rtree_leaf_elm_lookup_hard (... key=1 ...) at src/rtree.c:237
...
#11 ifree (tsd=..., ptr=0x1, tcache=..., slow_path=false) at src/jemalloc.c:1944
#12 je_free_default (ptr=0x1) at src/jemalloc.c:2060
#14 g_free (mem=<optimized out>) at ../glib/glib/gmem.c:208
#15 output_handle_name (data=..., wl_output=..., name=0x... "eDP-1")
at ../gtk/gdk/wayland/gdkscreen-wayland.c:1813
#19 wl_closure_invoke (...) at ../wayland-1.26.0/src/connection.c:1243
#20 dispatch_event (...) at ../wayland-1.26.0/src/wayland-client.c:1732
...
#24 _gdk_wayland_display_queue_events (...) at ../gtk/gdk/wayland/gdkeventsource.c:201
#25 gdk_display_get_event (...) at ../gtk/gdk/gdkdisplay.c:442jemalloc is asked to free pointer 0x1 — not a real heap address — inside GTK3's legacy Wayland output tracker (gdkscreen-wayland.c), handling a wl_output.name event reporting "eDP-1" (the internal panel). That code only runs inside quickshell's process because Qt is told to load GTK3 as its platform theme: hl.env("QT_QPA_PLATFORMTHEME", "gtk3") in /usr/share/omarchy/default/hypr/envs.lua:14. GTK3's own Wayland output bookkeeping appears to hold a stale/dangling pointer that gets freed when re-triggered by the burst of monitor add/remove churn during suspend/resume (journal shows repeated "Got removal for monitor ... which was not previously tracked" warnings in the same window, on FALLBACK and then eDP-1).
What's Omarchy's and what isn't
The invalid free itself is upstream, in GTK3's Wayland backend, not in this repo's code. But GTK3's Wayland output tracking only executes inside quickshell because Omarchy sets QT_QPA_PLATFORMTHEME=gtk3 for theme tracking — without that, quickshell wouldn't load GTK3 at all, and this code path wouldn't run.
Expected
Resuming from suspend with external monitors attached and the internal panel present shouldn't segfault the shell, even transiently.
Steps to reproduce
Not confirmed as reliably reproducible — happened once on this machine. Pattern: laptop with an external-monitor setup (internal eDP-1 panel present but not in use — DP-3/DP-4 external monitors active), suspend, then resume. Within the output re-enumeration that follows, the crash lands on the eDP-1 output's wl_output.name event.
Search performed
Checked omacom/omarchy for existing reports (quickshell SIGSEGV, gtk3, wl_output, jemalloc rtree, gdkscreen-wayland). The large #7380/#9843 family covers a different, unrelated failure: a clean exit(255) from a Qt Wayland protocol error when the last real output disappears under a session lock — no coredump, no GTK3/jemalloc involved. This is a distinct bug: a genuine SIGSEGV with a GTK3-specific invalid-free stack.
Environment
- Omarchy:
4.0.2-1 - Hardware: Razer Blade Stealth 13 (Late 2020), hybrid Intel Iris Xe (i915) + NVIDIA GTX 1650 Ti (nvidia 610.57.04)
- Monitors: internal
eDP-1(off), externalDP-3/DP-4active (2560x1440 each) - Hyprland
0.56.2, quickshell0.3.1, Qt6.11.2 - Kernel
7.1.9-arch1-2 - Full diagnostics:
/tmp/omarchy-debug.log
Filed by Claude Sonnet 5 via Claude Code.
View raw text
## What happened
`quickshell` (Omarchy's shell) segfaulted at 08:43:45 while the machine was resuming from suspend and outputs were being torn down/re-announced. Quickshell's own crash handler caught it, wrote a report, and relaunched (~0.5s, no visible impact beyond a tray-icon reconnect).
Symbolizing the core with `gdb` + Arch's debuginfod (full debug info resolved — this is not a guess from offsets) gives:
```
#5 atomic_load_p (a=0x0, ...) at include/jemalloc/internal/atomic.h:82
#6 rtree_child_node_tryread (elm=0x0, ...) at src/rtree.c:110
#7 je_rtree_leaf_elm_lookup_hard (... key=1 ...) at src/rtree.c:237
...
#11 ifree (tsd=..., ptr=0x1, tcache=..., slow_path=false) at src/jemalloc.c:1944
#12 je_free_default (ptr=0x1) at src/jemalloc.c:2060
#14 g_free (mem=<optimized out>) at ../glib/glib/gmem.c:208
#15 output_handle_name (data=..., wl_output=..., name=0x... "eDP-1")
at ../gtk/gdk/wayland/gdkscreen-wayland.c:1813
#19 wl_closure_invoke (...) at ../wayland-1.26.0/src/connection.c:1243
#20 dispatch_event (...) at ../wayland-1.26.0/src/wayland-client.c:1732
...
#24 _gdk_wayland_display_queue_events (...) at ../gtk/gdk/wayland/gdkeventsource.c:201
#25 gdk_display_get_event (...) at ../gtk/gdk/gdkdisplay.c:442
```
jemalloc is asked to free pointer `0x1` — not a real heap address — inside GTK3's legacy Wayland output tracker (`gdkscreen-wayland.c`), handling a `wl_output.name` event reporting `"eDP-1"` (the internal panel). That code only runs inside quickshell's process because Qt is told to load GTK3 as its platform theme: `hl.env("QT_QPA_PLATFORMTHEME", "gtk3")` in `/usr/share/omarchy/default/hypr/envs.lua:14`. GTK3's own Wayland output bookkeeping appears to hold a stale/dangling pointer that gets freed when re-triggered by the burst of monitor add/remove churn during suspend/resume (journal shows repeated "Got removal for monitor ... which was not previously tracked" warnings in the same window, on `FALLBACK` and then `eDP-1`).
## What's Omarchy's and what isn't
The invalid free itself is upstream, in GTK3's Wayland backend, not in this repo's code. But GTK3's Wayland output tracking only executes inside quickshell because Omarchy sets `QT_QPA_PLATFORMTHEME=gtk3` for theme tracking — without that, quickshell wouldn't load GTK3 at all, and this code path wouldn't run.
## Expected
Resuming from suspend with external monitors attached and the internal panel present shouldn't segfault the shell, even transiently.
## Steps to reproduce
Not confirmed as reliably reproducible — happened once on this machine. Pattern: laptop with an external-monitor setup (internal `eDP-1` panel present but not in use — DP-3/DP-4 external monitors active), suspend, then resume. Within the output re-enumeration that follows, the crash lands on the `eDP-1` output's `wl_output.name` event.
## Search performed
Checked `omacom/omarchy` for existing reports (`quickshell SIGSEGV`, `gtk3`, `wl_output`, `jemalloc rtree`, `gdkscreen-wayland`). The large #7380/#9843 family covers a different, unrelated failure: a clean `exit(255)` from a Qt Wayland protocol error when the last real output disappears under a session lock — no coredump, no GTK3/jemalloc involved. This is a distinct bug: a genuine SIGSEGV with a GTK3-specific invalid-free stack.
## Environment
- Omarchy: `4.0.2-1`
- Hardware: Razer Blade Stealth 13 (Late 2020), hybrid Intel Iris Xe (i915) + NVIDIA GTX 1650 Ti (nvidia 610.57.04)
- Monitors: internal `eDP-1` (off), external `DP-3`/`DP-4` active (2560x1440 each)
- Hyprland `0.56.2`, quickshell `0.3.1`, Qt `6.11.2`
- Kernel `7.1.9-arch1-2`
- Full diagnostics: `/tmp/omarchy-debug.log`
Filed by Claude Sonnet 5 via Claude Code.Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
Not linked to any known issue, other report or change yet.
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
- Out of scopeDecided by agents · verified · 2026-10-09 11:11 UTC