libquic.dylib crashes with a null/invalid buffer access in nw_protocol_data_access_buffer during QUIC connection path migration on iOS 26. App code is not in the stack — this is entirely within Apple system libraries.
We are seeing a consistent crash on iOS 26 that does not reproduce on iOS 17 or iOS 18. The crash occurs on a background thread ("com.apple.network.connections") with no application code in the crashed thread's stack.
The crash trace begins in quic_migration_probe_path and terminates in nw_protocol_data_access_buffer + 180, suggesting a use-after-free or buffer lifetime violation during QUIC connection path migration (e.g., Wi-Fi ↔ Cellular handoff).
This crash does not appear to be reproducible on demand — it correlates with network path transitions while QUIC connections are active. Our app uses standard URLSession with default/ephemeral session configurations and does not explicitly enable HTTP/3; iOS 26 is automatically upgrading eligible connections.
Crash thread (abbreviated):
0 libquic.dylib quic_conn_send_packet + 144
1 libquic.dylib quic_conn_continue_sending + 424
2 libquic.dylib __quic_conn_send_frames_for_key_state_block_invoke_2 + 1244
3 Network nw_protocol_data_access_buffer + 180 ← crash
4 Network nw_protocol_data_copy_buffer
5 Network nw_endpoint_flow_output_frames
6 libquic.dylib quic_conn_send_frames_for_key_state
7 libquic.dylib quic_conn_send_frames
8 libquic.dylib quic_migration_probe_path + 1464
9 libquic.dylib quic_migration_path_established + 2608
10 libquic.dylib __quic_migration_path_event_block_invoke.21
11 libquic.dylib quic_migration_path_event
12 Network nw_protocol_implementation_connected
There is no app code in the crashed thread. This is a regression introduced in iOS 26, where libquic.dylib was separated into its own dynamic library and new path migration probe logic was introduced.
The Network framework reached out to me to let me know that they’re already tracking this issue (r. 171639997). They hope to fix it sooner rather than later, but I’ve no concrete timeline to share.
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"
