Hook dispatch re-enters itself since AGP 9 compiles null checks into `Object.getClass()`

[mustafammk9456]

Fields completed from the logs uploaded in this thread.

Steps to reproduce/复现步骤

1. HyperOS on Android 16, booting normally with Vector 3047 and the modules listed below.
2. Flash any Vector build after 3047 (confirmed on 3051, reported from 3048 on).
3. Reboot.

Expected behaviour/预期行为

The device boots.

Actual behaviour/实际行为

The device stays on the boot animation. com.miui.home starts and dies six times in three and a half minutes with java.lang.StackOverflowError, thrown while a module's onPackageLoaded runs: the stack alternates between a hooked Object.getClass() and the framework's hook dispatch until it is exhausted. The launcher never comes up, so the boot animation never ends.

The daemon starts once, injects into system_server once, and both stay up for the whole session — nothing on the daemon side reports an error. Flashing 3047 back boots normally, with the same modules loading into the same launcher process.

Xposed Module List/Xposed 模块列表

# loaded into com.miui.home, where the crash happens
com.yifeplayte.maxfreeform, com.yunzia.hyperstar, com.kiminonawa.HyperLight,
com.or10n.hyperosgesturehook, com.sevtinge.hyperceiler, dev.lackluster.mihelper,
com.xzakota.oshape

# also enabled elsewhere in the same boot
com.buildsession.betterYAMF, com.coderstory.toolkit, com.custombeta.fingerprintcataloge,
com.fan.edgex, com.jingyu233.miuiquickopenhook, com.keshav.capturesposed,
com.richardluo.globalIconPack, es.chiteroman.bootloaderspoofer,
io.github.howard20181.notificationiconfix, io.github.hyperisland,
io.github.jqssun.maceditor, io.github.soclear.edgex, me.connerowen.qspulldowntweak,
ru.sxbuIDfx.pFSOyagrG

Root implementation/Root 方案

KernelSU (ksud 33208), Zygisk Next 1.4.3 (817-e815170-release), Magic Mount-rs v4.0.6-853

System Module List/系统模块列表

Zygisk Next 1.4.3, Magic Mount-rs v4.0.6-853, .BRENE - SUSFS v0.0.55,
HMA-OSS Zygisk oss-164, AlwaysStrong v1.0.3, HyperUnlocked v2.2.2,
NavTweaks v30.0, Hide status bar v03, Disable apk signature vertification v1,
Hook for Inapp purchases (Lucky Patcher) 12.10.6, PMPatchLP 12.10.6

LSPosed version/LSPosed 版本

3051 fails; 3047 is the last confirmed working build

Android version/Android 版本

Android 16, SDK 36, arm64 — Redmi onyx, HyperOS OS3.0.303.0.WOLCNXM

Version requirement/版本要求

• I am using the latest debug build from GitHub Actions./我正在使用 GitHub Actions 中最新的调试版本。

Logs/日志

LSPosed_2026-07-29T10_02_11.800479.zip and LSPosed_2026-07-29T10_02_30.090146.zip, where log.old/ is the failing 3051 boot and log/ the working 3047 one.

[JingMatrix]

Which LSPosed / Vector version were you using before flashing the updates?

[mustafammk9456]

3047

[NMBlanco]

Is this something to be worried about? I'm a bit scared to install the new Ci builds now 😅

[JingMatrix]

@mustafammk9456 didn't provide any logs for me to debug. I will test on Android 16 emulators later to be sure.

Most likely, the crash is not caused by vector, or by an improper installation.

[mustafammk9456]

how can i provide log when the phone didnt boot😅🤣 i had to unintall the module fromrecovery and install the old version again multiple times

[mustafammk9456]

i also tried clean installation of the version 3052 and had the same result so i dont think its an installation problem

[JingMatrix]

It is tricky to get logs. Vector save logs for two boots, as explained in #123, hence, I can flash the problematic build, and then a good build to upload logs.

[JingMatrix]

@mustafammk9456 Cannot reproduce on Android emulator. Please upload logs from a working build for me to inspect.

[mustafammk9456]

LSPosed_2026-07-29T10_02_30.090146.zip
LSPosed_2026-07-29T10_02_11.800479.zip

[mustafammk9456]

one is verbose and the other is modules log of my current (3047) version

[mustafammk9456]

ok so is there a fix or should i stay on the 3047 version? thnx for ur hard work btw

[JingMatrix]

@mustafammk9456 Still investigating, and I will notify you when a fix is possible for you to test.

[JingMatrix]

@mustafammk9456 Please tell me. where did you download the 3047 version? It is not from tthe master branch.

And the crash can be stopped once you disable module com.kiminonawa.HyperLight, which is a bit buggy to me.