The crash is not on demand. The code I post is very independent, it just load and release DS, why CFRelease crash even null was checked and release DS right after copy?

Is there any other system API or any other way to get process static code by skipping endpoint security check?