Hello Apple Support Team,
We are seeing a production crash on iOS 26 devices that appears to originate from Apple system frameworks rather than application code.
1. Crash Details
OS Version: iOS 26.x
App built with: Xcode 16
Devices: Multiple models (not device-specific)
Exception Type: SIGSEGV SEGV_ACCERR
Fault Address: 0x0000000000000100
Crashed Thread: 4 (network background queue)
Crash trace summary:
Last Exception :
0 libobjc.A.dylib _objc_release_x8 + 8
1 libboringssl.dylib _nw_protocol_boringssl_deallocate_options + 92
2 Network 0x000000019695207c 0x00000001968dc000 + 483452
3 libswiftCore.dylib __swift_release_dealloc + 56
4 libswiftCore.dylib bool swift::RefCounts<swift::RefCountBitsT<(swift::RefCountInlinedness)1> >::doDecrementSlow<(swift::PerformDeinit)1>(swift::RefCountBitsT<(swift::RefCountInlinedness)1>, unsigned int) + 152
5 Network 0x0000000196951f6c 0x00000001968dc000 + 483180
6 Network 0x0000000196952000 0x00000001968dc000 + 483328
7 libswiftCore.dylib __swift_release_dealloc + 56
8 libswiftCore.dylib bool swift::RefCounts<swift::RefCountBitsT<(swift::RefCountInlinedness)1> >::doDecrementSlow<(swift::PerformDeinit)1>(swift::RefCountBitsT<(swift::RefCountInlinedness)1>, unsigned int) + 152
9 libswiftCore.dylib void multiPayloadEnumFN<&handleRefCountsDestroy>(swift::TargetMetadata<swift::InProcess> const*, swift::LayoutStringReader1&, unsigned long&, unsigned char*) + 248
10 libswiftCore.dylib swift::swift_cvw_arrayDestroy(swift::OpaqueValue*, unsigned long, unsigned long, swift::TargetMetadata<swift::InProcess> const*) + 1172
11 libswiftCore.dylib _$sSp12deinitialize5countSvSi_tF + 40
12 CollectionsInternal ___swift_instantiateGenericMetadata + 1236
13 CollectionsInternal ___swift_instantiateGenericMetadata + 388
14 CollectionsInternal ___swift_instantiateGenericMetadata + 1044
15 libswiftCore.dylib __swift_release_dealloc + 56
16 libswiftCore.dylib bool swift::RefCounts<swift::RefCountBitsT<(swift::RefCountInlinedness)1> >::doDecrementSlow<(swift::PerformDeinit)1>(swift::RefCountBitsT<(swift::RefCountInlinedness)1>, unsigned int) + 152
17 Network 0x000000019695f9fc 0x00000001968dc000 + 539132
18 Network 0x000000019695f9bc 0x00000001968dc000 + 539068
19 libswiftCore.dylib __swift_release_dealloc + 56
20 libswiftCore.dylib bool swift::RefCounts<swift::RefCountBitsT<(swift::RefCountInlinedness)1> >::doDecrementSlow<(swift::PerformDeinit)1>(swift::RefCountBitsT<(swift::RefCountInlinedness)1>, unsigned int) + 152
21 libswiftCore.dylib swift_cvw_destroyImpl(swift::OpaqueValue*, swift::TargetMetadata<swift::InProcess> const*) + 212
22 Network 0x0000000196def5d8 0x00000001968dc000 + 5322200
23 Network 0x0000000196ded130 0x00000001968dc000 + 5312816
24 libswiftCore.dylib __swift_release_dealloc + 56
25 libswiftCore.dylib bool swift::RefCounts<swift::RefCountBitsT<(swift::RefCountInlinedness)1> >::doDecrementSlow<(swift::PerformDeinit)1>(swift::RefCountBitsT<(swift::RefCountInlinedness)1>, unsigned int) + 152
26 Network 0x000000019695fde0 0x00000001968dc000 + 540128
27 libobjc.A.dylib object_cxxDestructFromClass(objc_object*, objc_class*) + 116
28 libobjc.A.dylib objc_destructInstance_nonnull_realized(objc_object*) + 76
29 libobjc.A.dylib __objc_rootDealloc + 72
30 Network 0x000000019695f99c 0x00000001968dc000 + 539036
31 Network 0x000000019695fae4 0x00000001968dc000 + 539364
32 Network 0x0000000196b078b8 0x00000001968dc000 + 2275512
33 libobjc.A.dylib object_cxxDestructFromClass(objc_object*, objc_class*) + 116
34 libobjc.A.dylib objc_destructInstance_nonnull_realized(objc_object*) + 76
35 libobjc.A.dylib __objc_rootDealloc + 72
36 Network 0x0000000196b07658 0x00000001968dc000 + 2274904
37 Network 0x00000001968e51d4 nw_queue_context_async_if_needed + 92
38 Network 0x0000000197686ea0 0x00000001968dc000 + 14331552
39 libswiftCore.dylib swift::swift_cvw_arrayDestroy(swift::OpaqueValue*, unsigned long, unsigned long, swift::TargetMetadata<swift::InProcess> const*) + 436
40 libswiftCore.dylib _$sSp12deinitialize5countSvSi_tF + 40
41 CollectionsInternal ___swift_instantiateGenericMetadata + 1236
42 CollectionsInternal ___swift_instantiateGenericMetadata + 388
43 CollectionsInternal ___swift_instantiateGenericMetadata + 1044
44 libswiftCore.dylib __swift_release_dealloc + 56
45 libswiftCore.dylib bool swift::RefCounts<swift::RefCountBitsT<(swift::RefCountInlinedness)1> >::doDecrementSlow<(swift::PerformDeinit)1>(swift::RefCountBitsT<(swift::RefCountInlinedness)1>, unsigned int) + 152
46 Network 0x000000019694a010 0x00000001968dc000 + 450576
47 libobjc.A.dylib object_cxxDestructFromClass(objc_object*, objc_class*) + 116
48 libobjc.A.dylib objc_destructInstance_nonnull_realized(objc_object*) + 76
49 libobjc.A.dylib __objc_rootDealloc + 72
50 Network 0x0000000196a330e0 0x00000001968dc000 + 1405152
51 Network 0x00000001974378e0 0x00000001968dc000 + 11909344
52 Network 0x0000000196a17178 0x00000001968dc000 + 1290616
53 libdispatch.dylib __dispatch_call_block_and_release + 32
54 libdispatch.dylib __dispatch_client_callout + 16
55 libdispatch.dylib _dispatch_workloop_invoke.cold.4 + 32
56 libdispatch.dylib __dispatch_workloop_invoke + 1980
57 libdispatch.dylib __dispatch_root_queue_drain_deferred_wlh + 292
58 libdispatch.dylib __dispatch_workloop_worker_thread + 692
59 libsystem_pthread.dylib __pthread_wqthread + 292
------
Exception Type: SIGSEGV SEGV_ACCERR
Exception Codes: fault addr: 0x0000000000000100
Crashed Thread: 4
2. Behavior & Context
The crash occurs during normal HTTPS networking using standard URLSession (no direct usage of Network.framework nor boringssl APIs). It appears to be triggered during QUIC connection establishment or TLS fallback. The stack trace contains no application code frames — all symbols are from system libraries. The crash strongly indicates double-free, over-release, or dangling pointer inside nw_protocol_boringssl_options deallocation.
3. Questions for Apple
Is this a known issue in iOS 26 within Network.framework / boringssl related to nw_protocol_boringssl_deallocate_options?
What is the root cause of the over‑release / invalid objc_release in this path?
Is there a workaround we can implement from the app side (e.g., disabling QUIC, adjusting TLS settings, or queue configuration)?
Do you have a target iOS version or patch where this issue will be fixed?
We can provide full crash logs and additional metrics upon request.
4. Additional Information
Developed using Swift 5, with a deployment target of iOS 12+.
Thank you for your support.