[Bug] GET_PED_HEAD_BLEND_DATA instantly crashes the client; appearance getters return silent zeros (b96)

[Benazito]

Summary

Calling GetPedHeadBlendData on a freemode ped instantly crashes the game (full CTD,
no script error, not catchable). Related appearance getters (GetPedHeadOverlayData)
do not crash but always return zeros, even immediately after a successful SET on the
same ped. Setters work perfectly. This kills every character creator / barber /
clothing menu that reads the current ped appearance.

Issue type

Client

Repro rate

Always

Server build version

FXServer-early-access b94 / b95 / b96 (linux)

OS

Windows 11 25H2 (build 26200)

CPU

12th Gen Intel Core i7-12700F

GPU

NVIDIA GeForce RTX 4080 SUPER

RAM

64 GB

Storage type

SSD NVMe

Connection type

Ethernet

ISP and bandwidth

N/A

DxDiag

Network graph

N/A

Platform

Linux

OS version / distribution

Ubuntu 24.04.4 LTS

CPU

AMD Ryzen 7 9800X3D

RAM

128GB

Using txAdmin?

Yes

Hosting provider

Self-hosted

Machine type

Dedicated

/perf endpoint output

N/A (client-side crash)

DDoS protection

Self-protect

ulimit -n value (Linux only)

131072

Docker Compose file (Docker only)

N/A

Steps to Reproduce

First repro (silent crash)

1. Create a standalone resource with a single client script (lua):

   RegisterCommand('test_headblend', function()
       local r = { GetPedHeadBlendData(PlayerPedId()) }
   end, false)

2. Join the server with a freemode ped (mp_m/f_freemode_01) that has a head blend applied.
3. Run /test_headblend -> instant client crash, every time, anywhere on the map.

---

Secondary repro (silent zeros, no crash):

1. SetPedHeadOverlay(PlayerPedId(), 3, 5, 0.8) -- applies visually (wrinkles appear)
2. Wait(100) then GetPedHeadOverlayData(PlayerPedId(), 3)
3. Returns false, 0, 0, 0, 0, 0.0 regardless of what was just set.

Expected Behavior

GetPedHeadBlendData fills the head blend struct and returns, as on FiveM Legacy.
GetPedHeadOverlayData returns the overlay values that were just applied.

Actual Behavior

GetPedHeadBlendData: immediate full client crash (CTD), no script error.
Minidump analysis: EXCEPTION_ACCESS_VIOLATION, read at address 0x90 (null + 0x90),
crash at ntdll.dll+0x4415A; nearest resolvable frames on a heuristic stack scan
point into fivem-client.dll (+0x453FD9C, +0x1FB9B3D).
GetPedHeadOverlayData: silent zeros (see secondary repro). Setters work fine.
Game cache: gamecache_gen9\1158_13. Launcher up to date as of 2026-07-23

Evidence

(crash ID: c4b1a2ae-8488-49ab-ad27-0107456af332)

Additional Context

Same class as GetEntityArchetypeName hard-crashing the Enhanced client (#185) and
GetCamMatrix returning zeroed values before EA Hotfix 2 (#49). Hotfix 3 fixed the
appearance SETTERS (SetPedHairTint, SetPedHeadOverlayColor "work again"); the
GETTERS show two distinct failure modes:

• GET_PED_HEAD_BLEND_DATA (original R* native writing a padded out-struct): hard crash.
• CFX-implemented getters reading CPedHeadBlendData (GetPedHeadOverlayData, likely
  GetPedHairColor / GetPedFaceFeature / GetPedEyeColor siblings): silent zero returns.
  Impact: any script that scrapes ped appearance (character creators, barber/clothing
  menus, skin persistence) instantly kills the client on Enhanced.

[Gogsi]

Reproduction script from #256

RegisterCommand('repro_headblend_freeze', function()
    -- Preparation: first set a NON-freemode ped model, to replicate the real starting
    -- state (e.g. a multichar preview ped) before the creator takes over.
    local nonFreemodeHash = GetHashKey('a_m_y_business_01')
    RequestModel(nonFreemodeHash)
    local t1 = 0
    while not HasModelLoaded(nonFreemodeHash) and t1 < 5000 do Wait(10) t1 = t1 + 10 end
    SetPlayerModel(PlayerId(), nonFreemodeHash)
    SetModelAsNoLongerNeeded(nonFreemodeHash)

    print(('Preparation done: current model=%d (not freemode), waiting a moment...'):format(GetEntityModel(PlayerPedId())))
    Wait(2000) -- give it time so the non-freemode state is definitely "settled"

    -- Actual repro: switch to freemode + write head blend data + read it back
    local freemodeHash = GetHashKey('mp_m_freemode_01')
    RequestModel(freemodeHash)
    local t2 = 0
    while not HasModelLoaded(freemodeHash) and t2 < 5000 do Wait(10) t2 = t2 + 10 end
    SetPlayerModel(PlayerId(), freemodeHash)
    SetModelAsNoLongerNeeded(freemodeHash)

    local ped = PlayerPedId()
    print(('Freemode switch done: current model=%d, ped=%d'):format(GetEntityModel(ped), ped))

    SetPedHeadBlendData(ped, 0, 0, 0, 0, 0, 0, 0.5, 0.5, 0.0, false)
    print('SetPedHeadBlendData done, now calling GetPedHeadBlendData...')

    local ok = GetPedHeadBlendData(ped) -- client freezes here; this print is the LAST output
    print('GetPedHeadBlendData returned, ok=' .. tostring(ok)) -- never reached
end)

[Gogsi]

A fix for this bug has been implemented and is available in the August 4 patch. Please try again and let us know if the issue persists. Thanks for your help!