The dedicated server crashes with an access violation (C0000005) on the thread named "Navmesh Regeneration Job". Several minidumps show the same faulting instruction at DayZServer_x64.exe + 0x51E9BC (cmp dword ptr [r8+10h], eax). One dump faulted in the routine that function calls straight afterwards.

In the dumps, the value used to index the tile's door-part table is larger than the number of door parts in the tile, so the read goes past the end of the table. Whether it crashes depends on what memory sits past the table, so it's intermittent.

It only happens in navmesh tiles that contain both:

• trees standing on ground below sea level (for example trees in a river, flooded area or shoreline), and

• at least one building with doors.

The index looks like it's left over from a tree obstacle: the tree's ground is relabelled as sea water during the rebuild, but its obstacle id is kept and then treated as a door part id. When we moved the in-water trees out of the water, the problem went away in testing. Removing the doors should do the same, but we didn't test that.

Expected: the rebuild should ignore (or clear) part ids that aren't door parts, instead of reading past the table.

1. Use a terrain where one 50 m navmesh tile contains a building with doors and several trees whose trunk base is below sea level (around 0–1 m above sea level or lower; the higher the tide, the more trees qualify).

2. Start the dedicated server.

3. Trigger a runtime navmesh rebuild of that tile, for example by placing a base-building object or tent there, spawning an object with ECE_UPDATEPATHGRAPH, or calling GetGame().UpdatePathgraphRegion() over the tile.

4. Repeat if needed (it's intermittent). The server crashes in the "Navmesh Regeneration Job" thread at +0x51E9BC