Unhandled exception
Program: -
Reason: Access violation. Illegal read by 0x7ff7120a5aca at 0xffffffffffffffff
[CDPInitServer]: ??? addr:0x7ff7120a5aca
[CDPInitServer]: ??? addr:0x7ff71207dfec
[CDPInitServer]: ??? addr:0x7ff712079a76
[CDPInitServer]: ??? addr:0x7ff7120c9909
SymGetSymFromAddr:487, addr:0x7ff711d8418b
SymGetSymFromAddr:487, addr:0x7ff711e3eebe
SymGetSymFromAddr:487, addr:0x7ff711e348a4
[CDPInitServer]: ??? addr:0x7ff7121f2d8b
SymGetSymFromAddr:487, addr:0x7ff711e407be
SymGetSymFromAddr:487, addr:0x7ff71198d5b0
[CDPInitServer]: ??? addr:0x7ff71284763a
[BaseThreadInitThunk]: ??? addr:0x7ff87f974cb0
[RtlUserThreadStart]: ??? addr:0x7ff88059edcb
[RtlUserThreadStart]: ??? addr:0x7ff88059edcb
Five different servers (Chernarus and Livonia, different mod sets) crashed within two days. All five crashes are byte-identical.
Signature:
- ENGINE (F): Crashed. The last RPT line before the crash is NETWORK : Removing timed out inventory junctures.
- Fault code bytes: 48 8B 02 48 85 C0 0F 84 A5 00 00 00 (mov rax,[rdx]).
- Fault RVA: 0x875ACA relative to the DayZServer_x64.exe 1.30.164200 image base.
- Stack: 0x875ACA - 0x84DFEC - 0x849A76 - 0x899909 (Network simulation) - … - WinMain.
- The read address differs every time: 0x34BDA6, 0x100000020, 0xFFFFFFFFFFFFFFFF. This looks like a stale or freed pointer, not a null.
What the server code does (disassembly, function at RVA 0x84DE80):
1. Every frame the server iterates over timed-out inventory junctures.
2. If a juncture has a script owner, it calls OnJunctureTimedOut(). If that returns > 0, the juncture is extended ("Juncture is extended for %f seconds").
3. After extending, the server takes the player pointer from an internal table, using the player index stored in the juncture, and resolves it by network ID.
4. The only check is that the slot is non-null. The slot holds a non-null invalid pointer, and the read at ptr + 0x20 crashes.
In the vanilla 1.30 scripts, ActionData.OnJunctureTimedOut() always returns 1.0 (4_World/Classes/UserActionsComponent/ActionBase.c). So an action juncture is extended forever while its ActionData object is alive, even after its player is gone: disconnected, deleted, or with the slot freed.