SIGSEGV (use-after-free) in FUSE session teardown: MFMount Channel.close / dispatch_channel_cancel

[kernelzeroday]

Crash: SIGSEGV (use-after-free) in FUSE session teardown

Environment

• VeraCrypt: 1.26.29
• macOS: 26.6.2 (25G83), Apple Silicon (arm64)
• macFUSE: 5.3.3

Crash

• Exception: EXC_BAD_ACCESS (SIGSEGV), KERN_INVALID_ADDRESS at 0x0000000000000110
• Faulting thread (single-threaded child, fork pre-exec):

libdispatch  _dispatch_root_queue_push+228
libdispatch  dispatch_channel_cancel+52
MFMount      Channel.close()+160
MFMount      closure #1 in MFChannelClose(_:)+84
MFMount      _MFChannelClose+32
MFMount      MFChannelClose+40
libfuse.2    fuse_chan_destroy+104
libfuse.2    fuse_session_destroy+44
libfuse.2    fuse_destroy+428
VeraCrypt    (mount/unmount flow)

Looks like a use-after-free of a dispatch channel in the FUSE session teardown path (Channel.close() -> dispatch_channel_cancel).

Repro hint: after sustained I/O on a mounted volume, the volume returns Device not configured (ENXIO); session teardown then intermittently faults as above. macFUSE 5.1.3 exhibits the same behavior.

Full .ips crash report available on request.

[kernelzeroday]

Same crash filed at macfuse/macfuse#1193 — the faulting frames (MFMount Channel.close, libfuse fuse_destroy) are in macFUSE's framework/libfuse binaries, not VeraCrypt's.