Client crash (GTA5_Enhanced.exe AV in RtlVirtualUnwind) only after server-restart reconnect, at specific coordinates

[dejavu0189]

I'm running a RAGE MP server (Enhanced Edition) and we've narrowed down a reproducible client crash to a very specific scenario.

Crash:
- EXCEPTION_ACCESS_VIOLATION (0xc0000005)
- Triggers inside RtlVirtualUnwind / RtlVirtualUnwind2 (ntdll), with frames going through GTA5_Enhanced.exe and coreclr.dll
- Secondary AV in GTA5_Enhanced.exe update thread, read at 0x0
- Stack also touches bass.dll

main_logs

Spoiler

[585609] Loading DLL: c:\windows\system32\symsrv.dll
[585742] SE EXCEPTION_ACCESS_VIOLATION (0xc0000005) at address 0x00007FFDADA179C1 (0x179c1) thread 1796 inside C:\WINDOWS\SYSTEM32\ntdll.dll loaded at base address 0x00007FFDADA00000
Invalid operation: read at address 0x48

0x179C1 (RtlVirtualUnwind2) at C:\WINDOWS\SYSTEM32\ntdll.dll 0x00007FFDADA00000
0x16D39 (RtlVirtualUnwind2) at C:\WINDOWS\SYSTEM32\ntdll.dll 0x00007FFDADA00000
0x18D69 (RtlVirtualUnwind) at C:\WINDOWS\SYSTEM32\ntdll.dll 0x00007FFDADA00000
0x2D85B6B5F31 at C:\RAGEMP\GTA5_Enhanced.exe 0x0000000000000000
0x4AC653FA at C:\RAGEMP\GTA5_Enhanced.exe 0x0000000000000000
0x0 at C:\RAGEMP\bass.dll 0x00007FFD39DE0000
0x3A00 at C:\RAGEMP\bass.dll 0x00007FFD39DE0000
0xA54859A6A5CB21AE at C:\RAGEMP\GTA5_Enhanced.exe 0x0000000000000000
0xA54859AAA5DB21AE at C:\RAGEMP\GTA5_Enhanced.exe 0x0000000000000000
0xA54859DEA54959A7 at C:\RAGEMP\GTA5_Enhanced.exe 0x0000000000000000
0xA54859B0A5E7C4BC at C:\RAGEMP\GTA5_Enhanced.exe 0x0000000000000000
0xA54859A6A5D3C4BC at C:\RAGEMP\GTA5_Enhanced.exe 0x0000000000000000
0xA54859A6A5B73863 at C:\RAGEMP\GTA5_Enhanced.exe 0x0000000000000000
0xA54859A6A5D5C4BC at C:\RAGEMP\GTA5_Enhanced.exe 0x0000000000000000
0xA54859A768636952 at C:\RAGEMP\GTA5_Enhanced.exe 0x0000000000000000
0xA54859A768636952 at C:\RAGEMP\GTA5_Enhanced.exe 0x0000000000000000

[585829] SE EXCEPTION_ACCESS_VIOLATION (0xc0000005) at address 0x00007FFDADA17877 (0x17877) thread 1796 inside C:\WINDOWS\SYSTEM32\ntdll.dll loaded at base address 0x00007FFDADA00000
Invalid operation: read at address 0x140

0x17877 (RtlVirtualUnwind2) at C:\WINDOWS\SYSTEM32\ntdll.dll 0x00007FFDADA00000
0x16D39 (RtlVirtualUnwind2) at C:\WINDOWS\SYSTEM32\ntdll.dll 0x00007FFDADA00000
0x18D69 (RtlVirtualUnwind) at C:\WINDOWS\SYSTEM32\ntdll.dll 0x00007FFDADA00000
0x2D85B6B5F31 at C:\RAGEMP\GTA5_Enhanced.exe 0x0000000000000000
0x4AC653FA at C:\RAGEMP\GTA5_Enhanced.exe 0x0000000000000000
0x0 at C:\RAGEMP\dotnet\coreclr.dll 0x00007FFCD82D0000
0xC1A87 (coreclr_shutdown_2) at C:\RAGEMP\dotnet\coreclr.dll 0x00007FFCD82D0000
0x17C800 at C:\RAGEMP\GTA5_Enhanced.exe 0x0000000000000000
0x100000145010 at C:\RAGEMP\GTA5_Enhanced.exe 0x0000000000000000
0x0 at C:\RAGEMP\dotnet\coreclr.dll 0x00007FFCD82D0000
0x20000001000 at C:\RAGEMP\GTA5_Enhanced.exe 0x0000000000000000
0x10006 at C:\RAGEMP\GTA5_Enhanced.exe 0x0000000000000000
0x10006 at C:\RAGEMP\GTA5_Enhanced.exe 0x0000000000000000
0x400005C6000 at C:\RAGEMP\GTA5_Enhanced.exe 0x0000000000000000
0x4160000200000000 at C:\RAGEMP\GTA5_Enhanced.exe 0x0000000000000000
0x100000 at C:\RAGEMP\GTA5_Enhanced.exe 0x0000000000000000
0x1000 at C:\RAGEMP\GTA5_Enhanced.exe 0x0000000000000000
0x100000 at C:\RAGEMP\GTA5_Enhanced.exe 0x0000000000000000
0x1000 at C:\RAGEMP\GTA5_Enhanced.exe 0x0000000000000000
0x1000000000 at C:\RAGEMP\GTA5_Enhanced.exe 0x0000000000000000
0x1FC0056CC50 at C:\RAGEMP\GTA5_Enhanced.exe 0x0000000000000000
0x1680056CE4C at C:\RAGEMP\GTA5_Enhanced.exe 0x0000000000000000
0x950005BE000 at C:\RAGEMP\GTA5_Enhanced.exe 0x0000000000000000
0x32FE800589000 at C:\RAGEMP\GTA5_Enhanced.exe 0x0000000000000000
0x32FE800589000 at C:\RAGEMP\GTA5_Enhanced.exe 0x0000000000000000

[978638] SE EXCEPTION_ACCESS_VIOLATION (0xc0000005) at address 0x00007FFC8C0CE7BF (0x1ee7bf) thread 30624 (RageRQStreamer) inside C:\RAGEMP\multiplayer_g9.dll loaded at base address 0x00007FFC8BEE0000
Invalid operation: read at address 0x0

0x1EE7BF at C:\RAGEMP\multiplayer_g9.dll 0x00007FFC8BEE0000
0x7FF74460011D at C:\RAGEMP\GTA5_Enhanced.exe 0x0000000000000000
0x6A9E at C:\RAGEMP\GTA5_Enhanced.exe 0x0000000000000000
0x2D80022F100 at C:\RAGEMP\GTA5_Enhanced.exe 0x0000000000000000
0x560 at C:\RAGEMP\GTA5_Enhanced.exe 0x0000000000000000
0x560 at C:\RAGEMP\GTA5_Enhanced.exe 0x0000000000000000

cef_game_logs

Spoiler

= 258
[0518/210313.339:ERROR:command_buffer_proxy_impl.cc(128)] ContextResult::kTransientFailure: Failed to send GpuControl.CreateCommandBuffer.
[0518/210313.341:ERROR:command_buffer_proxy_impl.cc(331)] GPU state invalid after WaitForGetOffsetInRange.
[0518/210313.342:ERROR:command_buffer_proxy_impl.cc(128)] ContextResult::kTransientFailure: Failed to send GpuControl.CreateCommandBuffer.
[0518/211823.402:INFO:render_frame_host_impl.cc(11505)] RenderFrameHostImpl::MaybeGenerateCrashReport url = package://cef/index.html, status = 4, exit_code = 258
[0518/211859.607:ERROR:command_buffer_proxy_impl.cc(128)] ContextResult::kTransientFailure: Failed to send GpuControl.CreateCommandBuffer.
[0518/212429.729:INFO:CONSOLE(1)] "Uncaught SyntaxError: Unexpected token ':'", source: rui://main/index.html (1)
[0518/212441.198:INFO:render_frame_host_impl.cc(11505)] RenderFrameHostImpl::MaybeGenerateCrashReport url = package://cef/index.html, status = 4, exit_code = 258
[0518/212633.746:INFO:render_frame_host_impl.cc(11505)] RenderFrameHostImpl::MaybeGenerateCrashReport url = package://cef/index.html, status = 4, exit_code = 258
[0518/214523.053:INFO:render_frame_host_impl.cc(11505)] RenderFrameHostImpl::MaybeGenerateCrashReport url = package://cef/index.html, status = 4, exit_code = 258
[0518/214540.753:ERROR:command_buffer_proxy_impl.cc(128)] ContextResult::kTransientFailure: Failed to send GpuControl.CreateCommandBuffer.
[0518/214540.763:ERROR:command_buffer_proxy_impl.cc(128)] ContextResult::kTransientFailure: Failed to send GpuControl.CreateCommandBuffer.

Exact reproduction steps:

1. Server is running, I connect normally — no crash, can play for hours
2. Close the game completely and reconnect — no crash
3. But: if the server restarts while I keep the RAGE MP launcher open and just wait for it to come back up, then reconnect when it's ready
4. After reconnecting, the client runs fine — until I travel near a specific coordinate: (-2189.56, 2242.95, 242.67) (North Chumash area, mostly empty terrain)
5. As soon as I get close to that area, the client crashes 100% of the time

What I've verified:

- Soft restart (game fully closed → reopened → connect) never crashes, even at that coordinate
- Cold connect on a freshly-started server never crashes
- The crash only fires in the exact sequence: server restart → client stays in launcher → client reconnects → travels to that coordinate
- That coordinate has no server-side entities within 500 units (checked DB: properties, furniture, vehicles, markers, etc.) — it's open terrain
- Our client code doesn't create anything special at that coordinate (no hardcoded refs there)
- Deleted custom game_resources / game_resources_g9 folders — crash still happens, so it's not our custom assets
- No memory-density reductions on our side (setPedDensityMultiplier etc. are not used)