@DTS Engineer , I don't assume that we have correctly identified the problem, But to us it seems like a failed negotiation for TCP SYN, i.e., Apple network framework not doing fallback to a basic TCP SYN. Then it was our idea/hope to get a domain expert from Apple to give their five cents on it. But it sounds like that is not possible before I try that disableECN and so I will try to look into that one day... 🥹 Cheers!

After days of trying all kinds of weird stuff I finally got something to work! 😅 Findings: I never got qlmanage -t to trigger anything for my Thumbnail Extension 😑 Even though I used qlmanage -r, qlmanage -r cache and killall -9 QuickLookThumbnailing QuickLookUIService Finder I never got it to trigger. Even though I used pluginkit to see that my plugin thumbnail extension was registered AND enabled I never got it to trigger. log stream --predicate 'subsystem == "com.apple.quicklook"' was basically useless to me. Logging out and in of my compute made no difference. But then finally I tried to REBOOT my computer and then suddenly it started to work if I used the Finder app only! (qlmanage -t is still useless.) Holy cow I spent forever on that... 🙈 (macOS 15.4.1)

We have created feedback FB17767223 now. Here we have attached two crash-reports, as well as a sysdiagnose and CI_PRINT_TREE PDFs... When the latter was enabled we didn't get the crash though. Thanks :)

@DTS Engineer thanks for noticing that... arghh, maybe I attached it as 'Text': 2025-10-08_10-13-45.1128_+0200-8acf1536892bf0576f963e1534419cd29e6e10b8.crash :)

@DTS Engineer it seems like .crash-files gets translated into text-file... so I can no longer attach it. I will try to upload it and share a link instead...

@dhoerl great that you could use my 'you need to reboot your Mac' finding... 😅 As I understand it Thumbnails and Previews are related. Thumbnails are small and quick to render. Previews are for bigger/better examples of your file, e.g., if you hit space-bar in the Finder on the file. If Preview is not implemented it may fall back to the Thumbnails-based solution. 😀

Hey Quinn and thanks, I've managed to get an iPhone 17 Pro and enabled MTE, which is super awesome! 🤤 Looking forward to get that on MBPs and iPads... Not sure how to present the finding other than dumping some screenshots. But here the memory corruption doesn't seem to happen in URLRequest but in the UI stack alone. But I could be wrong 😅 So imagine the three screenshot below glued together... We are using CATiledLayer. Wondering if it could be related to that...

@DTS Engineer / Quinn, forgot to tag you on my reply yesterday, and so this extra comment today :)

Hi @DTS Engineer and thanks :) I hope that your boss will get you a iPhone 17 😅 I'm trying to attach the ips-file again. I added the.txt extension to make it possible to attach it. I hope it will not screw up and make it an inline text-box when I git 'Reply' 😬 Looking at the ips-file I found that it does not show the finding that Xcode show, e.g., "Thread X: Use of deallocated memory" but it then misses "Memory allocated by Thread 1" and "Memory deallocated by Thread 1", so I am not sure the ips-file is that useful for MTE :( CrashReport-2025-11-28-141148.ips.txt

Phew, I already feel bad asking you again 😅 It turns out that MTE and Malloc Stack Logging cannot be enabled at the same time. But I've tried to enabled Malloc Stack Logging, and then get delayed crash somewhere else. Unfortunately, I didn't really understand where/what to look for in Xcode. I tried to hit the 'Memory Graph Debug' but then the crash context seemed to get lost... most likely I am doing it wrong... A little context of our app: An UIPageViewController where you can swipe left/right to see the next/previous image. An UIViewController that has a TileImageView subview TileImageView that shows an image. This view is using CATileLayer. When draw(rect:) is called for a specific tile, we either show a cached tile or send a network request to a local server for the tile data. When the network response is received (callback in draw(rect:) we call the view's draw(rect:) to update with tile. Now if I scroll through the pages the crash may occur. As stated before this code was working fine before iOS 26. But of course I am unsure if the callback in draw(rect:) could somehow screw-up if e.g., the TileImageView was deallocated. But we should check for weak-self, etc. By trying to disable code I've found that if I pull out the code in the callback we still crash, i.e., we don't update the draw(rect:). But if I pull out the actual call we don't crash... wondering why the async network call seems to have this side-effect on this...