Hello,
I can confirm this crash on stock trixie with the same signature, and here it is
100% reproducible: kwin_wayland dies every single time I unplug the USB-C hub
that drives my displays. Adding the data point in case it helps the proposed
update.
Hardware / software
-------------------
HP Elite x360 1040 14 inch G11 (Meteor Lake, Intel Arc iGPU on i915),
BIOS W90 Ver. 01.08.01
USB-C hub (VIA Labs based) driving two DisplayPort outputs over MST
(card0-DP-5 / card0-DP-6) plus a Jabra Link 390 USB headset
Debian 13 trixie, kernel 6.12.111+deb13-amd64, KDE Plasma 6.3.6 (Wayland)
kwin-common/kwin-data/kwin-wayland/libkwin6 4:6.3.6-1
Signature (identical in both recorded incidents, 2026-10-06 23:27 and
2026-10-07 19:00 CST)
19:00:58.055 pipewire: spa.alsa: front:1p: snd_pcm_start: Broken pipe
19:00:58.282 kwin_wayland_wrapper: KCrash: Application
'kwin_wayland' crashing... crashRecursionCounter = 2
19:00:59 systemd-coredump: Process 145998 (kwin_wayland) of user
1000 dumped core.
The compositor dies about 0.23 s after the dock's devices disappear: PipeWire
reports the ALSA devices going away and kded6 loses the
"alsa_input.usb-_Jabra_Link_390_..." objects, then every Wayland client dies
with it (Firefox, Zoom, PowerDevil, plasmashell). In the first incident the
same sequence is visible with "No such device" instead of "Broken pipe".
$ coredumpctl list kwin_wayland
Tue 2026-10-06 23:27:09 CST 1921 1000 1000 SIGSEGV /usr/bin/kwin_wayland
Wed 2026-10-07 19:00:59 CST 145998 1000 1000 SIGSEGV /usr/bin/kwin_wayland
The backtrace in the journal matches the one in the original report. Symbolising
libkwin6 (6.3.6-1) through debuginfod gives exactly the same frame:
#4 KWin::ColorManagementOutputV1::ColorManagementOutputV1(
wl_client*, unsigned int, unsigned int, KWin::Output*)
src/wayland/colormanagement_v1.cpp:580
#5-7 ffi_call (libffi)
#8-10 wl_event_loop_dispatch (libwayland-server)
#11 KWin::Display::dispatchEvents() src/wayland/display.cpp:121
The faulting instruction at that line is the member initialiser
`m_colorDescription(output->colorDescription())` with output == 0x0. Since
Output::colorDescription() is a trivial getter, the NULL `this` does not fault
inside the call: it returns a near-NULL source pointer and the subsequent
structure copy (rep movsq) is what raises SIGSEGV - which is precisely where
frame #4 points. So this is the same NULL `KWin::Output*` that the upstream
duplicates show.
The client triggering it on my system is Firefox: firefox-esr
153.4.0esr-1~deb13u1
is the only application in my session that speaks wp_color_manager_v1
(libxul.so references the interface; plasmashell, kded6, xdg-desktop-portal-kde
and OBS do not). In the second incident the last messages before the crash come
from firefox-esr, and in the first one Tor Browser's firefox.real (also
Gecko-based) coredumped immediately after kwin.
Testing the proposed update
---------------------------
I have built 4:6.3.6-1+deb13u1 from the debian/trixie branch in salsa: all 27
quilt patches, including upstream_e1fd647b and upstream_172f8f2e, applied
cleanly to the 6.3.6 source with no offsets and no fuzz. I am running the
patched libkwin6/kwin-wayland now and will follow up with the result of a
real-world test (several dock unplugs with Firefox open), as requested.
I can also provide the full core dumps or the relevant journal excerpts if that
is useful.
(For the record, I hit this in combination with the
Workspace::activateNextWindow() issue #1143050; as you noted, both are
output-removal races in 6.3.6 but they are clearly separate code paths.)
Thanks for preparing the update.
