NullReferenceException crash in PortableThreadPool.IOCompletionPoller Event.Invoke (inlined in ThreadPoolTypedWorkItemQueue.Execute) on .NET 10.0.12, win-x64 #136827

minidump available on request

Title

NullReferenceException crash in PortableThreadPool.IOCompletionPoller Event.Invoke
(inlined in ThreadPoolTypedWorkItemQueue.Execute) on .NET 10.0.12, win-x64

Description

A long-running .NET Windows service (targets net8.0, rollForward=LatestMajor,
thus running on .NET 10.0.12 runtime) crashed with an unhandled
System.NullReferenceException while processing a native IO completion event.

No application frames are on the faulting stack - the exception is thrown
entirely inside System.Private.CoreLib.

Faulting stack (from crash minidump)

System.NullReferenceException: Object reference not set to an instance of an object.
at System.Threading.ThreadPoolTypedWorkItemQueue.System.Threading.IThreadPoolWorkItem.Execute()
at System.Threading.ThreadPoolWorkQueue.Dispatch()
at System.Threading.PortableThreadPool.WorkerThread.WorkerThreadStart()

Runtime / environment

• .NET Runtime 10.0.12 (coreclr.dll 10.0.1226.42308), win-x64, Windows 10 build 26200
• Faulting thread: threadpool worker, managed ID 59
• Faulting IP: JIT code of ThreadPoolTypedWorkItemQueue.Execute()+0x1f7

Analysis details (cdb + SOS)

• EXR: ExceptionCode c0000005, read access at address 0x0000000000000010
  (re-raised via coreclr second-pass; original fault at Execute()+0x1f7)
• Faulting instruction (Tier1 JIT of ThreadPoolTypedWorkItemQueue.Execute,
  IL_0052 Event.Invoke() inlined):
  mov rdx, qword ptr [r13+28h] ; load from native overlapped-related state
  and rdx, 0FFFFFFFFFFFFFFFEh ; strip low tag bit
  mov rdx, qword ptr [rdx]
  mov rax, rdx
  test rax, rax
  je ; null -> skip MT check, fall into load
  cmp qword ptr [rax], ; MT == System.Threading.ThreadPoolBoundHandleOverlapped
  mov rdx, qword ptr [rax+10h] ; FAULT: rax==0 -> reads 0x10 -> NRE
• !ip2md: MethodDesc 00007ffc7ffa9030,
  System.Threading.ThreadPoolTypedWorkItemQueue.Execute()
• IL of Execute: dequeue from ConcurrentQueue<IOCompletionPoller+Event>,
  then Event.Invoke()
• Heap at crash: 13 live PreAllocatedOverlapped + ThreadPoolBoundHandleOverlapped
  pairs (SocketAsyncEventArgs / HttpClient socket IO in flight).
  One ThreadPoolBoundHandleOverlapped instance has _boundHandle == null
  (teardown in progress).
• Both IOCompletionPoller event queues are empty (head==tail); crash occurred
  while invoking the last dequeued event.

Reproducibility

Not reproducible on demand; occurred once after ~37 minutes of service uptime
under sustained HttpClient (socket overlapped IO) traffic.

Attachments

Full minidump (256 MB) available on request. Symbol-matched cdb/SOS transcripts
of !pe -nested, !clrstack -p -l, !ip2md, !dumpmt, !dumpil, !dumpobj available.