Title / Summary Crash in libquic.dylib when app is backgrounded and issues an HTTP/3 request Description On iOS 26, the app crashes inside libquic.dylib while performing a network request using HTTP/3 (QUIC) after the app has moved to the background. The crash happens within low-level QUIC / libquic internals. Reproduction Steps Launch the app, perform normal operations. Background the app (press home / switch away). While in background, trigger a network request that uses HTTP/3 / QUIC. Observe that the app crashes (stack trace pointing into libquic.dylib). Expected Behavior The HTTP/3 request in background should either be handled gracefully (fail or complete) without causing a crash; the app must not be terminated due to internal libquic failures. Actual Behavior The app crashes with signals/exceptions coming from libquic.dylib (in the QUIC / packet building / encryption / key state logic) when a HTTP/3 request is made in background. Environment / Device Information • OS: iOS 26 • Device: iPhone 13 Pro Max • Network environment: (Wi-Fi / Cellular) • HTTP/3 support: enabled in URLSession / Network framework Stack Trace： 8eedc0df3d914b0faf8def9af3b21574-symbolicated.crash

panic(cpu 4 caller 0xffffff80113199a4): zone_require failed: address not in a zone (addr: 0xfffffff568e9bde8) @zalloc.c:1488 Panicked task 0xffffff86fbe313b0: 3 threads: pid 85512: debugserver Backtrace (CPU 4), panicked thread: 0xffffff8bbb860aa0, Frame : Return Address 0xfffffff568e9b420 : 0xffffff8010a7fd6d  0xfffffff568e9b470 : 0xffffff8010be1086  0xfffffff568e9b4b0 : 0xffffff8010bd03f3  0xfffffff568e9b500 : 0xffffff8010a1fa70  0xfffffff568e9b520 : 0xffffff8010a8013d  0xfffffff568e9b640 : 0xffffff8010a7f8f6  0xfffffff568e9b6a0 : 0xffffff8011314e03  0xfffffff568e9b790 : 0xffffff80113199a4  0xfffffff568e9b7d0 : 0xffffff8011319a1b  0xfffffff568e9b7e0 : 0xffffff8010aee53f  0xfffffff568e9b7f0 : 0xffffff8011054a3c  0xfffffff568e9b810 : 0xffffff7faac418e4  0xfffffff568e9b8c0 : 0xffffff7faac3e9c8  0xfffffff568e9bd20 : 0xffffff7faac3e4ce  0xfffffff568e9bd50 : 0xffffff80112e1213  0xfffffff568e9bdc0 : 0xffffff80110800b5  0xfffffff568e9be30 : 0xffffff8011014e03  0xfffffff568e9be60 : 0xffffff8011015812  0xfffffff568e9bec0 : 0xffffff801107f83b  0xfffffff568e9bf40 : 0xffffff801118918b  0xfffffff568e9bfa0 : 0xffffff8010a20236     Kernel Extensions in backtrace:      com.skyguard.endpoint.systemprotect(3.5.55)[99B8DF88-E244-3158-A5D0-A7F71E3C95EE]@0xffffff7faac3d000->0xffffff7faac45fff Process name corresponding to current thread (0xffffff8bbb860aa0): debugserver Boot args: chunklist-security-epoch=0 -chunklist-no-rev2-dev chunklist-security-epoch=0 -chunklist-no-rev2-dev Mac OS version: 21G83 Kernel version: Darwin Kernel Version 21.6.0: Wed Aug 10 14:25:27 PDT 2022; root:xnu-8020.141.5~2/RELEASE_X86_64 Kernel UUID: D0DC2052-71F4-3DCB-B189-BEE5A59B3B42 KernelCache slide: 0x0000000010800000 KernelCache base: 0xffffff8010a00000 Kernel slide:   0x0000000010810000 Kernel text base: 0xffffff8010a10000 __HIB text base: 0xffffff8010900000 System model name: Macmini8,1 (Mac-7BA5B2DFE22DDD8C) System shutdown begun: NO Hibernation exit count: 6 System uptime in nanoseconds: 142395213728877 Last Sleep:      absolute      base_tsc     base_nano  Uptime : 0x00008181f821cf0f  Sleep  : 0x00007ab3e2c674ce 0x00000000c6e2ad08 0x00007aa53275c2cb  Wake  : 0x00007ab3f1cf7854 0x00000000c6e6907c 0x00007ab3ecbf3a14 Compressor Info: 1% of compressed pages limit (OK) and 3% of segments limit (OK) with 1 swapfiles and OK swap space Zone info:  Zone map: 0xffffff80838c3000 - 0xffffffa0838c3000  . PGZ  : 0xffffff80838c3000 - 0xffffff80878c4000  . VM  : 0xffffff80878c4000 - 0xffffff8553bf7000  . RO  : 0xffffff8553bf7000 - 0xffffff86ed25d000  . GEN0 : 0xffffff86ed25d000 - 0xffffff8bb9590000  . GEN1 : 0xffffff8bb9590000 - 0xffffff90858c3000  . GEN2 : 0xffffff90858c3000 - 0xffffff9551bf6000  . GEN3 : 0xffffff9551bf6000 - 0xffffff9a1df29000  . DATA : 0xffffff9a1df29000 - 0xffffffa0838c3000  Metadata: 0xffffffca84f28000 - 0xffffffcaa4f28000  Bitmaps : 0xffffffcaa4f28000 - 0xffffffcab0f28000