Crash in interface dispatch on ARM64

[MichalStrehovsky]

I'm looking at a crash on Windows (specifically Watson CAB cdd29d04-257c-49b4-8c49-efcff075008a for those who want to and can follow along).

In all the dumps in the bucket I've seen, there's a thread trying to do a GC suspension at the time of the crash.

Here's the interesting part of the k command output:

0:000> k
 # Child-SP          RetAddr               Call Site
00 000000e7`11b6dd30 00007ff8`1a468eac     ntdll!ZwWaitForMultipleObjects+0x4 [minkernel\ntdll\daytona\objfre\arm64\usrstubs.asm @ 1094] 
01 000000e7`11b6dd30 00007ff8`1fad8748     KERNELBASE!WaitForMultipleObjectsEx+0x10c [minkernel\kernelbase\synch.c @ 1551] 
02 000000e7`11b6e010 00007ff8`1fad82f4     kernel32!WerpReportFaultInternal+0x418 [onecore\windows\feedback\core\faultrep\lib\faultrep.cpp @ 1077] 
03 000000e7`11b6e170 00007ff8`1faac254     kernel32!WerpReportFault+0xcc [onecore\windows\feedback\core\faultrep\lib\faultrep.cpp @ 1384] 
04 000000e7`11b6e1c0 00007ff8`1a4e7320     kernel32!BasepReportFault+0x24 [clientcore\base\win32\client\wer.c @ 44] 
05 000000e7`11b6e1e0 00007ff8`1fd84780     KERNELBASE!UnhandledExceptionFilter+0x2e0 [minkernel\kernelbase\xcpt.c @ 701] 
06 000000e7`11b6e2d0 00007ff8`1fd9a118     ntdll!TppExceptionFilter+0x38 [minkernel\threadpool\ntdll\tp.c @ 117] 
07 000000e7`11b6e2f0 00007ff8`1fd949b8     ntdll!RtlUserThreadStart$filt$0+0x10 [minkernel\ldr\rtlstrt.c @ 1185] 
08 000000e7`11b6e300 00007ff8`1fd14e5c     ntdll!__C_ExecuteExceptionFilter+0x38 [minkernel\crts\crtw32\misc\arm64\handler.asm @ 73] 
09 000000e7`11b6e360 00007ff8`1fd94744     ntdll!__C_specific_handler+0xbc [minkernel\crts\crtw32\misc\riscchandler.c @ 446] 
0a 000000e7`11b6e3c0 00007ff8`1fc75aa8     ntdll!RtlpExecuteHandlerForException+0x14 [minkernel\ntos\rtl\arm64\xcptmisc.asm @ 142] 
0b 000000e7`11b6e3e0 00007ff8`1fd945a4     ntdll!RtlDispatchException+0x468 [minkernel\ntos\rtl\arm64\exdsptch.c @ 780] 
0c 000000e7`11b6ea60 00000000`00000000     ntdll!KiUserExceptionDispatcher+0x24 [minkernel\ntos\rtl\arm64\trampoln.asm @ 800] 
0d 000000e7`11b6eef0 00007fff`b2b7edc8     0x0
0e 000000e7`11b6eef0 00007fff`b1eb3844     REDACTED_NET!S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1__GetMatchingCustomAttributesIterator_d__2<System___Canon>__MoveNext+0x208 [/_/src/runtime/src/coreclr/nativeaot/System.Private.CoreLib/src/Internal/Reflection/Extensions/NonPortable/CustomAttributeSearcher.cs @ 118] 
0f 000000e7`11b6ef40 00007fff`b2f14d80     REDACTED_NET!S_P_CoreLib_System_Attribute__OneOrNull+0x64 [/_/src/runtime/src/coreclr/nativeaot/System.Private.CoreLib/src/System/Reflection/Attribute.NativeAot.cs @ 121] 
10 000000e7`11b6ef60 00007fff`b216916c     REDACTED_NET!S_P_CoreLib_System_Reflection_CustomAttributeExtensions__GetCustomAttribute_9<System___Canon>+0x40 [/_/src/runtime/src/libraries/System.Private.CoreLib/src/System/Reflection/CustomAttributeExtensions.cs @ 56] 
11 000000e7`11b6ef90 00007fff`b216d088     REDACTED_NET!System_Text_Json_System_Text_Json_Serialization_Metadata_JsonPolymorphismOptions__CreateFromAttributeDeclarations+0x2c [/_/src/runtime/src/libraries/System.Text.Json/src/System/Text/Json/Serialization/Metadata/JsonPolymorphismOptions.cs @ 105] 
12 000000e7`11b6efd0 00007fff`b2f195e0     REDACTED_NET!System_Text_Json_System_Text_Json_Serialization_Metadata_JsonTypeInfo__PopulatePolymorphismMetadata+0x18 [/_/src/runtime/src/libraries/System.Text.Json/src/System/Text/Json/Serialization/Metadata/JsonTypeInfo.cs @ 1244] 
13 000000e7`11b6eff0 00007fff`b2232c0c     REDACTED_NET!System_Text_Json_System_Text_Json_Serialization_Metadata_JsonMetadataServices__CreateCore_0<System___Canon>+0xe0 [/_/src/runtime/src/libraries/System.Text.Json/src/System/Text/Json/Serialization/Metadata/JsonMetadataServices.Helpers.cs @ 60] 

Notice GetMatchingCustomAttributesIterator_d__2 ended up calling address 0x0.

Here is the relevant part of the disassembly:

    REDACTED_NET!S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1__GetMatchingCustomAttributesIterator_d__2<System___Canon>__MoveNext: CFG
00007fff`b2b7ebc0 fd7bbba9 stp     fp, lr, [sp, #-0x50]!
00007fff`b2b7ebc4 f35303a9 stp     x19, x20, [sp, #0x30]
00007fff`b2b7ebc8 f55b04a9 stp     x21, x22, [sp, #0x40]
00007fff`b2b7ebcc fd030091 mov     fp, sp
00007fff`b2b7ebd0 bfff01a9 stp     xzr, xzr, [fp, #0x18]
00007fff`b2b7ebd4 a01700f9 str     ___this (x0), [fp, #0x28]
00007fff`b2b7ebd8 a00b00f9 str     ___this (x0), [fp, #0x10]
00007fff`b2b7ebdc 015840b9 ldr     w1, [___this (x0), ___this (x0)+#0x58]
00007fff`b2b7ebe0 130840f9 ldr     x19, [___this (x0), ___this (x0)+#0x10]
00007fff`b2b7ebe4 3f0c0071 cmp     w1, #3
00007fff`b2b7ebe8 682d0054 bhi     REDACTED_NET!S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1__GetMatchingCustomAttributesIterator_d__2<System___Canon>__MoveNext+0x5d4 (7fffb2b7f194)
00007fff`b2b7ebec e103012a mov     w1, w1
00007fff`b2b7ebf0 22300010 adr     x2, REDACTED_NET!S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1__GetMatchingCustomAttributesIterator_d__2<System___Canon>__MoveNext+0x634 (7fffb2b7f1f4)
00007fff`b2b7ebf4 427861b8 ldr     w2, [x2, x1 lsl #2]
00007fff`b2b7ebf8 23ffff10 adr     x3, REDACTED_NET!S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1__GetMatchingCustomAttributesIterator_d__2<System___Canon>__MoveNext+0x1c (7fffb2b7ebdc)
00007fff`b2b7ebfc 4200038b add     x2, x2, x3
00007fff`b2b7ec00 40001fd6 br      x2
00007fff`b2b7ec04 41008012 mov     w1, #-3
00007fff`b2b7ec08 015800b9 str     w1, [___this (x0), ___this (x0)+#0x58]
00007fff`b2b7ec0c 001c40f9 ldr     x0, [x0, #0x38]
00007fff`b2b7ec10 b40b40f9 ldr     x20, [fp, ___this (fp+10h)]
00007fff`b2b7ec14 812640f9 ldr     x1, [___this (x20), ___this (x20)+#0x48]
00007fff`b2b7ec18 1f0040b9 ldr     wzr, [x0]
00007fff`b2b7ec1c f1dcff97 bl      REDACTED_NET!S_P_CoreLib_System_Collections_Generic_LowLevelList_1<System___Canon>__Add (7fffb2b75fe0)
00007fff`b2b7ec20 9f2600f9 str     xzr, [___this (x20), ___this (x20)+#0x48]
00007fff`b2b7ec24 26000014 b       REDACTED_NET!S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1__GetMatchingCustomAttributesIterator_d__2<System___Canon>__MoveNext+0xfc (7fffb2b7ecbc)
00007fff`b2b7ec28 01008012 mov     w1, #-1
00007fff`b2b7ec2c 015800b9 str     w1, [x0, #0x58]
00007fff`b2b7ec30 40dc00f0 adrp    x0, REDACTED_NET!S_P_CoreLib_System_Collections_Generic_IReadOnlyCollection_1<S_P_CoreLib_System_Reflection_ConstructorInfo>::`vftable'+0x8 (7fffb4709000)
00007fff`b2b7ec34 00c01d91 add     x0, x0, #0x770 (7fffb4709770 = REDACTED_NET!S_P_CoreLib_System_Collections_Generic_LowLevelList_1<S_P_CoreLib_System_Reflection_CustomAttributeData>::`vftable')
00007fff`b2b7ec38 163e1294 bl      REDACTED_NET!RhpNewFast (7fffb300e490)
00007fff`b2b7ec3c ee7601d0 adrp    x14, REDACTED_NET!__FrozenObj_S_P_CoreLib_System_Collections_Generic_List_1<S_P_CoreLib_System_Reflection_Metadata_TypeName>2+0x10 (7fffb5a5c000)
00007fff`b2b7ec40 ce211591 add     x14, x14, #0x548 (7fffb5a5c548 = REDACTED_NET!__FrozenObj_S_P_CoreLib_System_Collections_Generic_LowLevelList_1<S_P_CoreLib_System_Reflection_CustomAttributeData>2)
00007fff`b2b7ec44 0e0400f9 str     x14, [x0, #8]
00007fff`b2b7ec48 b40b40f9 ldr     x20, [fp, ___this (fp+10h)]
00007fff`b2b7ec4c 8ee20091 add     x14, ___this (x20), #0x38
00007fff`b2b7ec50 ef0300aa mov     x15, x0
00007fff`b2b7ec54 be3e1294 bl      REDACTED_NET!RhpAssignRefAVLocation (7fffb300e74c)
00007fff`b2b7ec58 810e40f9 ldr     x1, [___this (x20), ___this (x20)+#0x18]
00007fff`b2b7ec5c 6f0240f9 ldr     x15, [x19]
00007fff`b2b7ec60 ef2140f9 ldr     x15, [x15, #0x40]
00007fff`b2b7ec64 092800f0 adrp    x9, REDACTED_NET!__imp_CancelIoEx (7fffb3081000)
00007fff`b2b7ec68 29612091 add     x9, x9, #0x818 (7fffb3081818 = REDACTED_NET!__guard_check_icall_fptr)
00007fff`b2b7ec6c 290140f9 ldr     x9, [x9]
00007fff`b2b7ec70 20013fd6 blr     x9
00007fff`b2b7ec74 e2030faa mov     x2, x15
00007fff`b2b7ec78 e00313aa mov     x0, x19
00007fff`b2b7ec7c 40003fd6 blr     x2
00007fff`b2b7ec80 c18101d0 adrp    x1, REDACTED_NET!__InterfaceDispatchCell_S_P_CoreLib_System_Collections_Generic_IEnumerable_1<S_P_CoreLib_System_Reflection_CustomAttributeData>__GetEnumerator_WinRT_Runtime_WinRT_EnumTypeDetails_1<Windows_AI_AgentIsolationEnvironment_Windows_AI_AgentIsolationEnvironment_AgentIsolationEnvironmentBrokerApiVersion>__GetExposedInterfaces (7fffb5bb8000)
00007fff`b2b7ec84 21800391 add     x1, x1, #0xE0 (7fffb5bb80e0 = REDACTED_NET!__InterfaceDispatchCell_S_P_CoreLib_System_Collections_Generic_IEnumerable_1<S_P_CoreLib_System_Reflection_CustomAttributeData>__GetEnumerator_S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1__GetMatchingCustomAttributesIterator_d__2<System___Canon>__MoveNext)
00007fff`b2b7ec88 2f0040f9 ldr     x15, [x1]
00007fff`b2b7ec8c 092800f0 adrp    x9, REDACTED_NET!__imp_CancelIoEx (7fffb3081000)
00007fff`b2b7ec90 29612091 add     x9, x9, #0x818 (7fffb3081818 = REDACTED_NET!__guard_check_icall_fptr)
00007fff`b2b7ec94 290140f9 ldr     x9, [x9]
00007fff`b2b7ec98 20013fd6 blr     x9
00007fff`b2b7ec9c e2030faa mov     x2, x15
00007fff`b2b7eca0 eb0301aa mov     x11, x1
00007fff`b2b7eca4 40003fd6 blr     x2
00007fff`b2b7eca8 8e020191 add     x14, ___this (x20), #0x40
00007fff`b2b7ecac ef0300aa mov     x15, x0
00007fff`b2b7ecb0 a73e1294 bl      REDACTED_NET!RhpAssignRefAVLocation (7fffb300e74c)
00007fff`b2b7ecb4 4f008012 mov     w15, #-3
00007fff`b2b7ecb8 8f5a00b9 str     w15, [___this (x20), ___this (x20)+#0x58]
00007fff`b2b7ecbc 802240f9 ldr     x0, [___this (x20), ___this (x20)+#0x40]
00007fff`b2b7ecc0 c17f0190 adrp    x1, REDACTED_NET!__InterfaceDispatchCell_S_P_CoreLib_System_Collections_IEnumerator__MoveNext_S_P_CoreLib_System_Collections_Generic_List_1<S_P_CoreLib_System_ValueTuple_2<Int32__System___Canon>>__InsertRange (7fffb5b76000)
00007fff`b2b7ecc4 21c03d91 add     x1, x1, #0xF70 (7fffb5b76f70 = REDACTED_NET!__InterfaceDispatchCell_S_P_CoreLib_System_Collections_IEnumerator__MoveNext_S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1__GetMatchingCustomAttributesIterator_d__2<System___Canon>__MoveNext)
00007fff`b2b7ecc8 2f0040f9 ldr     x15, [x1]
00007fff`b2b7eccc 092800f0 adrp    x9, REDACTED_NET!__imp_CancelIoEx (7fffb3081000)
00007fff`b2b7ecd0 29612091 add     x9, x9, #0x818 (7fffb3081818 = REDACTED_NET!__guard_check_icall_fptr)
00007fff`b2b7ecd4 290140f9 ldr     x9, [x9]
00007fff`b2b7ecd8 20013fd6 blr     x9
00007fff`b2b7ecdc e2030faa mov     x2, x15
00007fff`b2b7ece0 eb0301aa mov     x11, x1
00007fff`b2b7ece4 40003fd6 blr     x2
00007fff`b2b7ece8 20050034 cbz     w0, REDACTED_NET!S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1__GetMatchingCustomAttributesIterator_d__2<System___Canon>__MoveNext+0x1cc (7fffb2b7ed8c)
00007fff`b2b7ecec 802240f9 ldr     x0, [___this (x20), ___this (x20)+#0x40]
00007fff`b2b7ecf0 c18101d0 adrp    x1, REDACTED_NET!__InterfaceDispatchCell_S_P_CoreLib_System_Collections_Generic_IEnumerable_1<S_P_CoreLib_System_Reflection_CustomAttributeData>__GetEnumerator_WinRT_Runtime_WinRT_EnumTypeDetails_1<Windows_AI_AgentIsolationEnvironment_Windows_AI_AgentIsolationEnvironment_AgentIsolationEnvironmentBrokerApiVersion>__GetExposedInterfaces (7fffb5bb8000)
00007fff`b2b7ecf4 21000991 add     x1, x1, #0x240 (7fffb5bb8240 = REDACTED_NET!__InterfaceDispatchCell_S_P_CoreLib_System_Collections_Generic_IEnumerator_1<S_P_CoreLib_System_Reflection_CustomAttributeData>__get_Current_S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1__GetMatchingCustomAttributesIterator_d__2<System___Canon>__MoveNext)
00007fff`b2b7ecf8 2f0040f9 ldr     x15, [x1]
00007fff`b2b7ecfc 092800f0 adrp    x9, REDACTED_NET!__imp_CancelIoEx (7fffb3081000)
00007fff`b2b7ed00 29612091 add     x9, x9, #0x818 (7fffb3081818 = REDACTED_NET!__guard_check_icall_fptr)
00007fff`b2b7ed04 290140f9 ldr     x9, [x9]
00007fff`b2b7ed08 20013fd6 blr     x9
00007fff`b2b7ed0c e2030faa mov     x2, x15
00007fff`b2b7ed10 eb0301aa mov     x11, x1
00007fff`b2b7ed14 40003fd6 blr     x2
00007fff`b2b7ed18 8e220191 add     x14, ___this (x20), #0x48
00007fff`b2b7ed1c ef0300aa mov     x15, x0
00007fff`b2b7ed20 8b3e1294 bl      REDACTED_NET!RhpAssignRefAVLocation (7fffb300e74c)
00007fff`b2b7ed24 951640f9 ldr     x21, [___this (x20), ___this (x20)+#0x28]
00007fff`b2b7ed28 802640f9 ldr     x0, [___this (x20), ___this (x20)+#0x48]
00007fff`b2b7ed2c 0f0040f9 ldr     x15, [x0]
00007fff`b2b7ed30 ef1940f9 ldr     x15, [x15, #0x30]
00007fff`b2b7ed34 092800f0 adrp    x9, REDACTED_NET!__imp_CancelIoEx (7fffb3081000)
00007fff`b2b7ed38 29612091 add     x9, x9, #0x818 (7fffb3081818 = REDACTED_NET!__guard_check_icall_fptr)
00007fff`b2b7ed3c 290140f9 ldr     x9, [x9]
00007fff`b2b7ed40 20013fd6 blr     x9
00007fff`b2b7ed44 e1030faa mov     x1, x15
00007fff`b2b7ed48 20003fd6 blr     x1
00007fff`b2b7ed4c e10300aa mov     x1, x0
00007fff`b2b7ed50 a00640f9 ldr     x0, [x21, #8]
00007fff`b2b7ed54 af1240f9 ldr     x15, [x21, #0x20]
00007fff`b2b7ed58 092800f0 adrp    x9, REDACTED_NET!__imp_CancelIoEx (7fffb3081000)
00007fff`b2b7ed5c 29612091 add     x9, x9, #0x818 (7fffb3081818 = REDACTED_NET!__guard_check_icall_fptr)
00007fff`b2b7ed60 290140f9 ldr     x9, [x9]
00007fff`b2b7ed64 20013fd6 blr     x9
00007fff`b2b7ed68 e2030faa mov     x2, x15
00007fff`b2b7ed6c 40003fd6 blr     x2
00007fff`b2b7ed70 80f5ff34 cbz     w0, REDACTED_NET!S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1__GetMatchingCustomAttributesIterator_d__2<System___Canon>__MoveNext+0x60 (7fffb2b7ec20)
00007fff`b2b7ed74 8f2640f9 ldr     x15, [___this (x20), ___this (x20)+#0x48]
00007fff`b2b7ed78 8e220091 add     x14, ___this (x20), #8
00007fff`b2b7ed7c 743e1294 bl      REDACTED_NET!RhpAssignRefAVLocation (7fffb300e74c)
00007fff`b2b7ed80 2f008052 mov     w15, #1
00007fff`b2b7ed84 8f5a00b9 str     w15, [___this (x20), ___this (x20)+#0x58]
00007fff`b2b7ed88 e0000014 b       REDACTED_NET!S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1__GetMatchingCustomAttributesIterator_d__2<System___Canon>__MoveNext+0x548 (7fffb2b7f108)
00007fff`b2b7ed8c 0f008012 mov     w15, #-1
00007fff`b2b7ed90 8f5a00b9 str     w15, [___this (x20), ___this (x20)+#0x58]
00007fff`b2b7ed94 8f2240f9 ldr     x15, [___this (x20), ___this (x20)+#0x40]
00007fff`b2b7ed98 8f0100b4 cbz     x15, REDACTED_NET!S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1__GetMatchingCustomAttributesIterator_d__2<System___Canon>__MoveNext+0x208 (7fffb2b7edc8)
00007fff`b2b7ed9c 802240f9 ldr     x0, [___this (x20), ___this (x20)+#0x40]
00007fff`b2b7eda0 617f01f0 adrp    x1, REDACTED_NET!__InterfaceDispatchCell_S_P_CoreLib_System_IDisposable__Dispose_S_P_CoreLib_System_Buffers_SharedArrayPool_1<S_P_CoreLib_System_ValueTuple_2<System___Canon__Int32>>__Trim (7fffb5b6d000)
00007fff`b2b7eda4 21002a91 add     x1, x1, #0xA80 (7fffb5b6da80 = REDACTED_NET!__InterfaceDispatchCell_S_P_CoreLib_System_IDisposable__Dispose_S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1__GetMatchingCustomAttributesIterator_d__2<System___Canon>__MoveNext)
00007fff`b2b7eda8 2f0040f9 ldr     x15, [x1]
00007fff`b2b7edac 092800f0 adrp    x9, REDACTED_NET!__imp_CancelIoEx (7fffb3081000)
00007fff`b2b7edb0 29612091 add     x9, x9, #0x818 (7fffb3081818 = REDACTED_NET!__guard_check_icall_fptr)
00007fff`b2b7edb4 290140f9 ldr     x9, [x9]
00007fff`b2b7edb8 20013fd6 blr     x9
00007fff`b2b7edbc e2030faa mov     x2, x15
00007fff`b2b7edc0 eb0301aa mov     x11, x1
00007fff`b2b7edc4 40003fd6 blr     x2
00007fff`b2b7edc8 9f2200f9 str     xzr, [___this (x20), ___this (x20)+#0x40]
00007fff`b2b7edcc 8f824139 ldrb    w15, [___this (x20), ___this (x20)+#0x60]
00007fff`b2b7edd0 2f1e0034 cbz     w15, REDACTED_NET!S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1__GetMatchingCustomAttributesIterator_d__2<System___Canon>__MoveNext+0x5d4 (7fffb2b7f194)
00007fff`b2b7edd4 810e40f9 ldr     x1, [___this (x20), ___this (x20)+#0x18]
00007fff`b2b7edd8 6f0240f9 ldr     x15, [x19]
00007fff`b2b7eddc ef1d40f9 ldr     x15, [x15, #0x38]
00007fff`b2b7ede0 092800f0 adrp    x9, REDACTED_NET!__imp_CancelIoEx (7fffb3081000)
00007fff`b2b7ede4 29612091 add     x9, x9, #0x818 (7fffb3081818 = REDACTED_NET!__guard_check_icall_fptr)
00007fff`b2b7ede8 290140f9 ldr     x9, [x9]
00007fff`b2b7edec 20013fd6 blr     x9
00007fff`b2b7edf0 e2030faa mov     x2, x15
00007fff`b2b7edf4 e00313aa mov     x0, x19
00007fff`b2b7edf8 40003fd6 blr     x2
00007fff`b2b7edfc 8e620091 add     x14, ___this (x20), #0x18
00007fff`b2b7ee00 ef0300aa mov     x15, x0
00007fff`b2b7ee04 523e1294 bl      REDACTED_NET!RhpAssignRefAVLocation (7fffb300e74c)
00007fff`b2b7ee08 800e40f9 ldr     x0, [___this (x20), ___this (x20)+#0x18]
00007fff`b2b7ee0c 401c00b4 cbz     x0, REDACTED_NET!S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1__GetMatchingCustomAttributesIterator_d__2<System___Canon>__MoveNext+0x5d4 (7fffb2b7f194)
00007fff`b2b7ee10 40d400d0 adrp    x0, REDACTED_NET!S_P_CoreLib_System_Runtime_CompilerServices_ConditionalWeakTable_2_Enumerator<S_P_CoreLib_System_Type____Array<Microsoft_Extensions_DependencyInjection_Abstractions_Microsoft_Extensions_DependencyInjection_ActivatorUtilities_ConstructorInfoEx>>::`vftable'+0x20 (7fffb4608000)
00007fff`b2b7ee14 00601991 add     x0, x0, #0x658 (7fffb4608658 = REDACTED_NET!S_P_CoreLib_System_Collections_Generic_LowLevelDictionary_2<S_P_CoreLib_System_TypeUnificationKey__S_P_CoreLib_System_AttributeUsageAttribute>::`vftable')
00007fff`b2b7ee18 9e3d1294 bl      REDACTED_NET!RhpNewFast (7fffb300e490)
00007fff`b2b7ee1c f50300aa mov     x21, x0
00007fff`b2b7ee20 a01640b9 ldr     w0, [x21, #0x14]
00007fff`b2b7ee24 00040011 add     w0, w0, #1
00007fff`b2b7ee28 a01600b9 str     w0, [x21, #0x14]
00007fff`b2b7ee2c c02701b0 adrp    x0, REDACTED_NET!__Array<System_Collections_Concurrent_System_Collections_Concurrent_ConcurrentDictionary_2_VolatileNode<S_P_CoreLib_System_Type__S_P_CoreLib_System_Func_2<String__Object>>>::`vftable'+0x18 (7fffb5077000)
00007fff`b2b7ee30 00c02191 add     x0, x0, #0x870 (7fffb5077870 = REDACTED_NET!__Array<S_P_CoreLib_System_Collections_Generic_LowLevelDictionary_2_Entry<S_P_CoreLib_System_TypeUnificationKey__S_P_CoreLib_System_AttributeUsageAttribute>>::`vftable')
00007fff`b2b7ee34 610180d2 mov     x1, #0xB
00007fff`b2b7ee38 003e1294 bl      REDACTED_NET!RhpNewPtrArrayFast (7fffb300e638)
00007fff`b2b7ee3c ef0300aa mov     x15, x0
00007fff`b2b7ee40 ae220091 add     x14, x21, #8
00007fff`b2b7ee44 423e1294 bl      REDACTED_NET!RhpAssignRefAVLocation (7fffb300e74c)
00007fff`b2b7ee48 bf1200b9 str     wzr, [x21, #0x10]
00007fff`b2b7ee4c 8e420191 add     x14, ___this (x20), #0x50
00007fff`b2b7ee50 ef0315aa mov     x15, x21
00007fff`b2b7ee54 3e3e1294 bl      REDACTED_NET!RhpAssignRefAVLocation (7fffb300e74c)
00007fff`b2b7ee58 f5031f2a mov     w21, wzr
00007fff`b2b7ee5c 8f1e40f9 ldr     x15, [___this (x20), ___this (x20)+#0x38]
00007fff`b2b7ee60 ef1140b9 ldr     w15, [x15, #0x10]
00007fff`b2b7ee64 ff010071 cmp     w15, #0
00007fff`b2b7ee68 8d040054 ble     REDACTED_NET!S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1__GetMatchingCustomAttributesIterator_d__2<System___Canon>__MoveNext+0x338 (7fffb2b7eef8)
00007fff`b2b7ee6c 8f1e40f9 ldr     x15, [___this (x20), ___this (x20)+#0x38]
00007fff`b2b7ee70 e11140b9 ldr     w1, [x15, #0x10]
00007fff`b2b7ee74 bf02016b cmp     w21, w1
00007fff`b2b7ee78 42190054 bhs     REDACTED_NET!S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1__GetMatchingCustomAttributesIterator_d__2<System___Canon>__MoveNext+0x5e0 (7fffb2b7f1a0)
00007fff`b2b7ee7c ef0540f9 ldr     x15, [x15, #8]
00007fff`b2b7ee80 e90940b9 ldr     w9, [x15, #8]
00007fff`b2b7ee84 bf02096b cmp     w21, w9
00007fff`b2b7ee88 62190054 bhs     REDACTED_NET!S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1__GetMatchingCustomAttributesIterator_d__2<System___Canon>__MoveNext+0x5f4 (7fffb2b7f1b4)
00007fff`b2b7ee8c ef410091 add     x15, x15, #0x10
00007fff`b2b7ee90 e05975f8 ldr     x0, [x15, w21 uxtw #3]
00007fff`b2b7ee94 0f0040f9 ldr     x15, [x0]
00007fff`b2b7ee98 ef1940f9 ldr     x15, [x15, #0x30]
00007fff`b2b7ee9c 092800f0 adrp    x9, REDACTED_NET!__imp_CancelIoEx (7fffb3081000)
00007fff`b2b7eea0 29612091 add     x9, x9, #0x818 (7fffb3081818 = REDACTED_NET!__guard_check_icall_fptr)
00007fff`b2b7eea4 290140f9 ldr     x9, [x9]
00007fff`b2b7eea8 20013fd6 blr     x9
00007fff`b2b7eeac e1030faa mov     x1, x15
00007fff`b2b7eeb0 20003fd6 blr     x1
00007fff`b2b7eeb4 f60300aa mov     x22, x0
00007fff`b2b7eeb8 802a40f9 ldr     x0, [___this (x20), ___this (x20)+#0x50]
00007fff`b2b7eebc a2830091 add     x2, fp, #0x20
00007fff`b2b7eec0 e10316aa mov     x1, x22
00007fff`b2b7eec4 1f0040b9 ldr     wzr, [x0]
00007fff`b2b7eec8 debded97 bl      REDACTED_NET!S_P_CoreLib_System_Collections_Generic_LowLevelDictionary_2<S_P_CoreLib_System_TypeUnificationKey__System___Canon>__TryGetValue (7fffb26ee640)
00007fff`b2b7eecc c0000035 cbnz    w0, REDACTED_NET!S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1__GetMatchingCustomAttributesIterator_d__2<System___Canon>__MoveNext+0x324 (7fffb2b7eee4)
00007fff`b2b7eed0 802a40f9 ldr     x0, [___this (x20), ___this (x20)+#0x50]
00007fff`b2b7eed4 e10316aa mov     x1, x22
00007fff`b2b7eed8 e2031faa mov     x2, xzr
00007fff`b2b7eedc 1f0040b9 ldr     wzr, [x0]
00007fff`b2b7eee0 ecbded97 bl      REDACTED_NET!S_P_CoreLib_System_Collections_Generic_LowLevelDictionary_2<S_P_CoreLib_System_TypeUnificationKey__System___Canon>__Add (7fffb26ee690)
00007fff`b2b7eee4 b5060011 add     w21, w21, #1
00007fff`b2b7eee8 801e40f9 ldr     x0, [___this (x20), ___this (x20)+#0x38]
00007fff`b2b7eeec 001040b9 ldr     w0, [x0, #0x10]
00007fff`b2b7eef0 bf02006b cmp     w21, w0
00007fff`b2b7eef4 cbfbff54 blt     REDACTED_NET!S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1__GetMatchingCustomAttributesIterator_d__2<System___Canon>__MoveNext+0x2ac (7fffb2b7ee6c)
00007fff`b2b7eef8 810e40f9 ldr     x1, [___this (x20), ___this (x20)+#0x18]
00007fff`b2b7eefc 6f0240f9 ldr     x15, [x19]
00007fff`b2b7ef00 ef2140f9 ldr     x15, [x15, #0x40]
00007fff`b2b7ef04 092800f0 adrp    x9, REDACTED_NET!__imp_CancelIoEx (7fffb3081000)
00007fff`b2b7ef08 29612091 add     x9, x9, #0x818 (7fffb3081818 = REDACTED_NET!__guard_check_icall_fptr)
00007fff`b2b7ef0c 290140f9 ldr     x9, [x9]
00007fff`b2b7ef10 20013fd6 blr     x9
00007fff`b2b7ef14 e2030faa mov     x2, x15
00007fff`b2b7ef18 e00313aa mov     x0, x19
00007fff`b2b7ef1c 40003fd6 blr     x2
00007fff`b2b7ef20 c18101d0 adrp    x1, REDACTED_NET!__InterfaceDispatchCell_S_P_CoreLib_System_Collections_Generic_IEnumerable_1<S_P_CoreLib_System_Reflection_CustomAttributeData>__GetEnumerator_WinRT_Runtime_WinRT_EnumTypeDetails_1<Windows_AI_AgentIsolationEnvironment_Windows_AI_AgentIsolationEnvironment_AgentIsolationEnvironmentBrokerApiVersion>__GetExposedInterfaces (7fffb5bb8000)
00007fff`b2b7ef24 21800391 add     x1, x1, #0xE0 (7fffb5bb80e0 = REDACTED_NET!__InterfaceDispatchCell_S_P_CoreLib_System_Collections_Generic_IEnumerable_1<S_P_CoreLib_System_Reflection_CustomAttributeData>__GetEnumerator_S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1__GetMatchingCustomAttributesIterator_d__2<System___Canon>__MoveNext)
00007fff`b2b7ef28 2f0040f9 ldr     x15, [x1]
00007fff`b2b7ef2c 092800f0 adrp    x9, REDACTED_NET!__imp_CancelIoEx (7fffb3081000)
00007fff`b2b7ef30 29612091 add     x9, x9, #0x818 (7fffb3081818 = REDACTED_NET!__guard_check_icall_fptr)
00007fff`b2b7ef34 290140f9 ldr     x9, [x9]
00007fff`b2b7ef38 20013fd6 blr     x9
00007fff`b2b7ef3c e2030faa mov     x2, x15
00007fff`b2b7ef40 eb0301aa mov     x11, x1
00007fff`b2b7ef44 40003fd6 blr     x2
00007fff`b2b7ef48 8e020191 add     x14, ___this (x20), #0x40
00007fff`b2b7ef4c ef0300aa mov     x15, x0
00007fff`b2b7ef50 ff3d1294 bl      REDACTED_NET!RhpAssignRefAVLocation (7fffb300e74c)
00007fff`b2b7ef54 e00314aa mov     x0, ___this (x20)
00007fff`b2b7ef58 6f008012 mov     w15, #-4
00007fff`b2b7ef5c 0f5800b9 str     w15, [___this (x0), ___this (x0)+#0x58]
00007fff`b2b7ef60 a00b40f9 ldr     x0, [fp, ___this (fp+10h)]
00007fff`b2b7ef64 002040f9 ldr     ___this (x0), [___this (x0), ___this (x0)+#0x40]
00007fff`b2b7ef68 c17f0190 adrp    x1, REDACTED_NET!__InterfaceDispatchCell_S_P_CoreLib_System_Collections_IEnumerator__MoveNext_S_P_CoreLib_System_Collections_Generic_List_1<S_P_CoreLib_System_ValueTuple_2<Int32__System___Canon>>__InsertRange (7fffb5b76000)
00007fff`b2b7ef6c 21c03d91 add     x1, x1, #0xF70 (7fffb5b76f70 = REDACTED_NET!__InterfaceDispatchCell_S_P_CoreLib_System_Collections_IEnumerator__MoveNext_S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1__GetMatchingCustomAttributesIterator_d__2<System___Canon>__MoveNext)
00007fff`b2b7ef70 2f0040f9 ldr     x15, [x1]
00007fff`b2b7ef74 092800f0 adrp    x9, REDACTED_NET!__imp_CancelIoEx (7fffb3081000)
00007fff`b2b7ef78 29612091 add     x9, x9, #0x818 (7fffb3081818 = REDACTED_NET!__guard_check_icall_fptr)
00007fff`b2b7ef7c 290140f9 ldr     x9, [x9]
00007fff`b2b7ef80 20013fd6 blr     x9
00007fff`b2b7ef84 e2030faa mov     x2, x15
00007fff`b2b7ef88 eb0301aa mov     x11, x1
00007fff`b2b7ef8c 40003fd6 blr     x2
00007fff`b2b7ef90 200c0034 cbz     w0, REDACTED_NET!S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1__GetMatchingCustomAttributesIterator_d__2<System___Canon>__MoveNext+0x554 (7fffb2b7f114)
00007fff`b2b7ef94 b40b40f9 ldr     x20, [fp, ___this (fp+10h)]
00007fff`b2b7ef98 802240f9 ldr     x0, [___this (x20), ___this (x20)+#0x40]
00007fff`b2b7ef9c c18101d0 adrp    x1, REDACTED_NET!__InterfaceDispatchCell_S_P_CoreLib_System_Collections_Generic_IEnumerable_1<S_P_CoreLib_System_Reflection_CustomAttributeData>__GetEnumerator_WinRT_Runtime_WinRT_EnumTypeDetails_1<Windows_AI_AgentIsolationEnvironment_Windows_AI_AgentIsolationEnvironment_AgentIsolationEnvironmentBrokerApiVersion>__GetExposedInterfaces (7fffb5bb8000)
00007fff`b2b7efa0 21000991 add     x1, x1, #0x240 (7fffb5bb8240 = REDACTED_NET!__InterfaceDispatchCell_S_P_CoreLib_System_Collections_Generic_IEnumerator_1<S_P_CoreLib_System_Reflection_CustomAttributeData>__get_Current_S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1__GetMatchingCustomAttributesIterator_d__2<System___Canon>__MoveNext)
00007fff`b2b7efa4 2f0040f9 ldr     x15, [x1]
00007fff`b2b7efa8 092800f0 adrp    x9, REDACTED_NET!__imp_CancelIoEx (7fffb3081000)
00007fff`b2b7efac 29612091 add     x9, x9, #0x818 (7fffb3081818 = REDACTED_NET!__guard_check_icall_fptr)
00007fff`b2b7efb0 290140f9 ldr     x9, [x9]
00007fff`b2b7efb4 20013fd6 blr     x9
00007fff`b2b7efb8 e2030faa mov     x2, x15
00007fff`b2b7efbc eb0301aa mov     x11, x1
00007fff`b2b7efc0 40003fd6 blr     x2
00007fff`b2b7efc4 f50300aa mov     x21, x0
00007fff`b2b7efc8 af0240f9 ldr     x15, [cad{->m_pEEType} (x21)]
00007fff`b2b7efcc ef1940f9 ldr     x15, [x15, #0x30]
00007fff`b2b7efd0 092800f0 adrp    x9, REDACTED_NET!__imp_CancelIoEx (7fffb3081000)
00007fff`b2b7efd4 29612091 add     x9, x9, #0x818 (7fffb3081818 = REDACTED_NET!__guard_check_icall_fptr)
00007fff`b2b7efd8 290140f9 ldr     x9, [x9]
00007fff`b2b7efdc 20013fd6 blr     x9
00007fff`b2b7efe0 e1030faa mov     x1, x15
00007fff`b2b7efe4 e00315aa mov     x0, cad (x21)
00007fff`b2b7efe8 20003fd6 blr     x1
00007fff`b2b7efec f60300aa mov     x22, x0
00007fff`b2b7eff0 8f1640f9 ldr     x15, [___this (x20), ___this (x20)+#0x28]
00007fff`b2b7eff4 e00540f9 ldr     x0, [x15, #8]
00007fff`b2b7eff8 ef1140f9 ldr     x15, [x15, #0x20]
00007fff`b2b7effc 092800f0 adrp    x9, REDACTED_NET!__imp_CancelIoEx (7fffb3081000)
00007fff`b2b7f000 29612091 add     x9, x9, #0x818 (7fffb3081818 = REDACTED_NET!__guard_check_icall_fptr)
00007fff`b2b7f004 290140f9 ldr     x9, [x9]
00007fff`b2b7f008 20013fd6 blr     x9
00007fff`b2b7f00c e2030faa mov     x2, x15
00007fff`b2b7f010 e10316aa mov     x1, attributeType (x22)
00007fff`b2b7f014 40003fd6 blr     x2
00007fff`b2b7f018 40faff34 cbz     w0, REDACTED_NET!S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1__GetMatchingCustomAttributesIterator_d__2<System___Canon>__MoveNext+0x3a0 (7fffb2b7ef60)
00007fff`b2b7f01c e00314aa mov     x0, ___this (x20)
00007fff`b2b7f020 002840f9 ldr     ___this (x0), [___this (x0), ___this (x0)+#0x50]
00007fff`b2b7f024 a2630091 add     x2, fp, #0x18
00007fff`b2b7f028 e10316aa mov     x1, attributeType (x22)
00007fff`b2b7f02c 1f0040b9 ldr     wzr, [x0]
00007fff`b2b7f030 84bded97 bl      REDACTED_NET!S_P_CoreLib_System_Collections_Generic_LowLevelDictionary_2<S_P_CoreLib_System_TypeUnificationKey__System___Canon>__TryGetValue (7fffb26ee640)
00007fff`b2b7f034 c0030034 cbz     w0, REDACTED_NET!S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1__GetMatchingCustomAttributesIterator_d__2<System___Canon>__MoveNext+0x4ec (7fffb2b7f0ac)
00007fff`b2b7f038 a00f40f9 ldr     x0, [fp, #0x18]
00007fff`b2b7f03c 000100b5 cbnz    x0, REDACTED_NET!S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1__GetMatchingCustomAttributesIterator_d__2<System___Canon>__MoveNext+0x49c (7fffb2b7f05c)
00007fff`b2b7f040 b40b40f9 ldr     x20, [fp, ___this (fp+10h)]
00007fff`b2b7f044 800240f9 ldr     x0, [___this(??) (x20)]
00007fff`b2b7f048 001840f9 ldr     x0, [x0, #0x30]
00007fff`b2b7f04c 000040f9 ldr     x0, [x0]
00007fff`b2b7f050 e10316aa mov     x1, attributeType (x22)
00007fff`b2b7f054 a3f4ff97 bl      REDACTED_NET!S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1<System___Canon>__GetAttributeUsage (7fffb2b7c2e0)
00007fff`b2b7f058 a00f00f9 str     x0, [fp, #0x18]
00007fff`b2b7f05c b40b40f9 ldr     x20, [fp, ___this (fp+10h)]
00007fff`b2b7f060 802a40f9 ldr     x0, [___this (x20), ___this (x20)+#0x50]
00007fff`b2b7f064 e10316aa mov     x1, x22
00007fff`b2b7f068 a20f40f9 ldr     x2, [fp, #0x18]
00007fff`b2b7f06c 1f0040b9 ldr     wzr, [x0]
00007fff`b2b7f070 58bded97 bl      REDACTED_NET!S_P_CoreLib_System_Collections_Generic_LowLevelDictionary_2<S_P_CoreLib_System_TypeUnificationKey__System___Canon>__set_Item (7fffb26ee5d0)
00007fff`b2b7f074 a00f40f9 ldr     x0, [fp, #0x18]
00007fff`b2b7f078 00344039 ldrb    w0, [x0, #0xD]
00007fff`b2b7f07c 20f7ff34 cbz     w0, REDACTED_NET!S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1__GetMatchingCustomAttributesIterator_d__2<System___Canon>__MoveNext+0x3a0 (7fffb2b7ef60)
00007fff`b2b7f080 e00314aa mov     x0, ___this (x20)
00007fff`b2b7f084 a10f40f9 ldr     x1, [fp, #0x18]
00007fff`b2b7f088 21304039 ldrb    w1, [x1, #0xC]
00007fff`b2b7f08c a1f6ff34 cbz     w1, REDACTED_NET!S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1__GetMatchingCustomAttributesIterator_d__2<System___Canon>__MoveNext+0x3a0 (7fffb2b7ef60)
00007fff`b2b7f090 0e200091 add     x14, ___this (x0), #8
00007fff`b2b7f094 ef0315aa mov     x15, x21
00007fff`b2b7f098 ad3d1294 bl      REDACTED_NET!RhpAssignRefAVLocation (7fffb300e74c)
00007fff`b2b7f09c 6e008052 mov     w14, #3
00007fff`b2b7f0a0 0e5800b9 str     w14, [___this (x0), ___this (x0)+#0x58]
00007fff`b2b7f0a4 f40300aa mov     x20, ___this (x0)
00007fff`b2b7f0a8 18000014 b       REDACTED_NET!S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1__GetMatchingCustomAttributesIterator_d__2<System___Canon>__MoveNext+0x548 (7fffb2b7f108)
00007fff`b2b7f0ac a00b40f9 ldr     x0, [fp, ___this (fp+10h)]
00007fff`b2b7f0b0 010040f9 ldr     x1, [x0]
00007fff`b2b7f0b4 211840f9 ldr     x1, [x1, #0x30]
00007fff`b2b7f0b8 200040f9 ldr     x0, [x1]
00007fff`b2b7f0bc e10316aa mov     x1, attributeType (x22)
00007fff`b2b7f0c0 88f4ff97 bl      REDACTED_NET!S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1<System___Canon>__GetAttributeUsage (7fffb2b7c2e0)
00007fff`b2b7f0c4 a00f00f9 str     x0, [fp, #0x18]
00007fff`b2b7f0c8 b40b40f9 ldr     x20, [fp, ___this (fp+10h)]
00007fff`b2b7f0cc 802a40f9 ldr     x0, [___this (x20), ___this (x20)+#0x50]
00007fff`b2b7f0d0 e10316aa mov     x1, x22
00007fff`b2b7f0d4 a20f40f9 ldr     x2, [fp, #0x18]
00007fff`b2b7f0d8 1f0040b9 ldr     wzr, [x0]
00007fff`b2b7f0dc 6dbded97 bl      REDACTED_NET!S_P_CoreLib_System_Collections_Generic_LowLevelDictionary_2<S_P_CoreLib_System_TypeUnificationKey__System___Canon>__Add (7fffb26ee690)
00007fff`b2b7f0e0 ae0f40f9 ldr     x14, [fp, #0x18]
00007fff`b2b7f0e4 ce354039 ldrb    w14, [x14, #0xD]
00007fff`b2b7f0e8 cef3ff34 cbz     w14, REDACTED_NET!S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1__GetMatchingCustomAttributesIterator_d__2<System___Canon>__MoveNext+0x3a0 (7fffb2b7ef60)
00007fff`b2b7f0ec e00314aa mov     x0, ___this (x20)
00007fff`b2b7f0f0 0e200091 add     x14, ___this (x0), #8
00007fff`b2b7f0f4 ef0315aa mov     x15, x21
00007fff`b2b7f0f8 953d1294 bl      REDACTED_NET!RhpAssignRefAVLocation (7fffb300e74c)
00007fff`b2b7f0fc 4f008052 mov     w15, #2
00007fff`b2b7f100 0f5800b9 str     w15, [___this (x0), ___this (x0)+#0x58]
00007fff`b2b7f104 f40300aa mov     x20, ___this (x0)
00007fff`b2b7f108 20008052 mov     w0, #1
00007fff`b2b7f10c e103002a mov     w1, w0
00007fff`b2b7f110 2b000014 b       REDACTED_NET!S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1__GetMatchingCustomAttributesIterator_d__2<System___Canon>__MoveNext+0x5fc (7fffb2b7f1bc)
00007fff`b2b7f114 0f008012 mov     w15, #-1
00007fff`b2b7f118 b40b40f9 ldr     x20, [fp, ___this (fp+10h)]
00007fff`b2b7f11c 8f5a00b9 str     w15, [___this (x20), ___this (x20)+#0x58]
00007fff`b2b7f120 8f2240f9 ldr     x15, [___this (x20), ___this (x20)+#0x40]
00007fff`b2b7f124 8f0100b4 cbz     x15, REDACTED_NET!S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1__GetMatchingCustomAttributesIterator_d__2<System___Canon>__MoveNext+0x594 (7fffb2b7f154)
00007fff`b2b7f128 802240f9 ldr     x0, [___this (x20), ___this (x20)+#0x40]
00007fff`b2b7f12c 617f01d0 adrp    x1, REDACTED_NET!__InterfaceDispatchCell_S_P_CoreLib_System_IDisposable__Dispose_S_P_CoreLib_System_Buffers_SharedArrayPool_1<S_P_CoreLib_System_ValueTuple_2<System___Canon__Int32>>__Trim (7fffb5b6d000)
00007fff`b2b7f130 21002a91 add     x1, x1, #0xA80 (7fffb5b6da80 = REDACTED_NET!__InterfaceDispatchCell_S_P_CoreLib_System_IDisposable__Dispose_S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1__GetMatchingCustomAttributesIterator_d__2<System___Canon>__MoveNext)
00007fff`b2b7f134 2f0040f9 ldr     x15, [x1]
00007fff`b2b7f138 092800d0 adrp    x9, REDACTED_NET!__imp_CancelIoEx (7fffb3081000)
00007fff`b2b7f13c 29612091 add     x9, x9, #0x818 (7fffb3081818 = REDACTED_NET!__guard_check_icall_fptr)
00007fff`b2b7f140 290140f9 ldr     x9, [x9]
00007fff`b2b7f144 20013fd6 blr     x9
00007fff`b2b7f148 e2030faa mov     x2, x15
00007fff`b2b7f14c eb0301aa mov     x11, x1
00007fff`b2b7f150 40003fd6 blr     x2
00007fff`b2b7f154 9f2200f9 str     xzr, [___this (x20), ___this (x20)+#0x40]
00007fff`b2b7f158 810e40f9 ldr     x1, [___this (x20), ___this (x20)+#0x18]
00007fff`b2b7f15c 6f0240f9 ldr     x15, [x19]
00007fff`b2b7f160 ef1d40f9 ldr     x15, [x15, #0x38]
00007fff`b2b7f164 092800d0 adrp    x9, REDACTED_NET!__imp_CancelIoEx (7fffb3081000)
00007fff`b2b7f168 29612091 add     x9, x9, #0x818 (7fffb3081818 = REDACTED_NET!__guard_check_icall_fptr)
00007fff`b2b7f16c 290140f9 ldr     x9, [x9]
00007fff`b2b7f170 20013fd6 blr     x9
00007fff`b2b7f174 e2030faa mov     x2, x15
00007fff`b2b7f178 e00313aa mov     x0, x19
00007fff`b2b7f17c 40003fd6 blr     x2
00007fff`b2b7f180 8e620091 add     x14, ___this (x20), #0x18
00007fff`b2b7f184 ef0300aa mov     x15, x0
00007fff`b2b7f188 713d1294 bl      REDACTED_NET!RhpAssignRefAVLocation (7fffb300e74c)
00007fff`b2b7f18c 60ebffb5 cbnz    x0, REDACTED_NET!S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1__GetMatchingCustomAttributesIterator_d__2<System___Canon>__MoveNext+0x338 (7fffb2b7eef8)
00007fff`b2b7f190 9f2a00f9 str     xzr, [___this (x20), ___this (x20)+#0x50]
00007fff`b2b7f194 a00b40f9 ldr     x0, [fp, ___this (fp+10h)]
00007fff`b2b7f198 e1031f2a mov     w1, wzr
00007fff`b2b7f19c 08000014 b       REDACTED_NET!S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1__GetMatchingCustomAttributesIterator_d__2<System___Canon>__MoveNext+0x5fc (7fffb2b7f1bc)
00007fff`b2b7f1a0 e003152a mov     w0, w21
00007fff`b2b7f1a4 027101f0 adrp    x2, REDACTED_NET!__Str_idempotentHint (7fffb59a2000)
00007fff`b2b7f1a8 42603091 add     x2, x2, #0xC18 (7fffb59a2c18 = REDACTED_NET!__Str_index)
00007fff`b2b7f1ac 19f90a94 bl      REDACTED_NET!S_P_CoreLib_System_ArgumentOutOfRangeException__ThrowGreaterEqual<UInt32> (7fffb2e3d610)
00007fff`b2b7f1b0 00003ed4 brk     #0xF000
00007fff`b2b7f1b4 9764a997 bl      REDACTED_NET!Markdig_Markdig_Helpers_ThrowHelper__ThrowIndexOutOfRangeException (7fffb15d8410)
00007fff`b2b7f1b8 00003ed4 brk     #0xF000
00007fff`b2b7f1bc e003012a mov     w0, w1
00007fff`b2b7f1c0 f55b44a9 ldp     x21, x22, [sp, #0x40]
00007fff`b2b7f1c4 f35343a9 ldp     x19, x20, [sp, #0x30]
00007fff`b2b7f1c8 fd7bc5a8 ldp     fp, lr, [sp], #0x50
00007fff`b2b7f1cc c0035fd6 ret     
00007fff`b2b7f1d0 fd7bbda9 stp     fp, lr, [sp, #-0x30]!
00007fff`b2b7f1d4 f35301a9 stp     x19, x20, [sp, #0x10]
00007fff`b2b7f1d8 f55b02a9 stp     x21, x22, [sp, #0x20]
00007fff`b2b7f1dc a00b40f9 ldr     x0, [fp, ___this (fp+10h)]
00007fff`b2b7f1e0 40feff97 bl      REDACTED_NET!S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1__GetMatchingCustomAttributesIterator_d__2<System___Canon>__System_IDisposable_Dispose (7fffb2b7eae0)
00007fff`b2b7f1e4 f55b42a9 ldp     x21, x22, [sp, #0x20]
00007fff`b2b7f1e8 f35341a9 ldp     x19, x20, [sp, #0x10]
00007fff`b2b7f1ec fd7bc3a8 ldp     fp, lr, [sp], #0x30
00007fff`b2b7f1f0 c0035fd6 ret     

The call to a null address is happening at b2b7edc4 40003fd6 blr x2.

The contents of the interface dispatch cell is:

0:000> ln poi(0x7fffb5b6da80)
Browse module
Set bu breakpoint

 [D:\a\_work\1\s\src\runtime\artifacts\obj\coreclr\windows.arm64.Release\nativeaot\Runtime\Full\StubDispatch.asm @ 5504] (00007fff`b300f0b4)   REDACTED_NET!RhpInterfaceDispatch4   |  (00007fff`b300f0b8)   REDACTED_NET!RhpInterfaceDispatchAVLocation4
Exact matches:
    REDACTED_NET!RhpInterfaceDispatch4 (void)

The other thread doing suspension looks like this:

0:005> k
 # Child-SP          RetAddr               Call Site
00 (Inline Function) --------`--------     REDACTED_NET!YieldProcessor [C:\Program Files (x86)\Windows Kits\10\include\10.0.26100.0\um\winnt.h @ 5845] 
01 000000e7`122fea20 00007fff`b3015514     REDACTED_NET!minipal_microdelay+0xbc [D:\a\_work\1\s\src\runtime\src\native\minipal\time.c @ 175] 
02 000000e7`122fea80 00007fff`b301c450     REDACTED_NET!ThreadStore::SuspendAllThreads+0x104 [D:\a\_work\1\s\src\runtime\src\coreclr\nativeaot\Runtime\threadstore.cpp @ 282] 
03 000000e7`122feae0 00007fff`b3027fe0     REDACTED_NET!GCToEEInterface::SuspendEE+0xa0 [D:\a\_work\1\s\src\runtime\src\coreclr\nativeaot\Runtime\gcenv.ee.cpp @ 52] 
04 000000e7`122feb10 00007fff`b304e998     REDACTED_NET!WKS::GCHeap::GarbageCollectGeneration+0x2a0 [D:\a\_work\1\s\src\runtime\src\coreclr\gc\gc.cpp @ 51694] 
05 000000e7`122feb90 00007fff`b30268a4     REDACTED_NET!WKS::gc_heap::trigger_gc_for_alloc+0x88 [D:\a\_work\1\s\src\runtime\src\coreclr\gc\gc.cpp @ 19229] 
06 (Inline Function) --------`--------     REDACTED_NET!WKS::gc_heap::try_allocate_more_space+0x164 [D:\a\_work\1\s\src\runtime\src\coreclr\gc\gc.cpp @ 19349] 
07 (Inline Function) --------`--------     REDACTED_NET!WKS::gc_heap::allocate_more_space+0x164 [D:\a\_work\1\s\src\runtime\src\coreclr\gc\gc.cpp @ 19849] 
08 (Inline Function) --------`--------     REDACTED_NET!WKS::gc_heap::allocate+0x1c0 [D:\a\_work\1\s\src\runtime\src\coreclr\gc\gc.cpp @ 19880] 
09 000000e7`122febb0 00007fff`b301084c     REDACTED_NET!WKS::GCHeap::Alloc+0x294 [D:\a\_work\1\s\src\runtime\src\coreclr\gc\gc.cpp @ 50630] 
0a 000000e7`122fec60 00007fff`b300e6d0     REDACTED_NET!GcAllocInternal+0x15c [D:\a\_work\1\s\src\runtime\src\coreclr\nativeaot\Runtime\GCHelpers.cpp @ 616] 
0b 000000e7`122fecd0 00007fff`b1ec0a98     REDACTED_NET!RhpNewVariableSizeObject+0x40 [D:\a\_work\1\s\src\runtime\artifacts\obj\coreclr\windows.arm64.Release\nativeaot\Runtime\Full\AllocFast.asm @ 5671] 
0c 000000e7`122fed50 00007fff`b1fcc320     REDACTED_NET!String__CreateStringFromEncoding+0x68 [/_/src/runtime/src/libraries/System.Private.CoreLib/src/System/String.cs @ 548] 
0d 000000e7`122fed90 00007fff`b201b2f0     REDACTED_NET!S_P_CoreLib_Internal_NativeFormat_NativeReader__DecodeString+0x90 [/_/src/runtime/src/coreclr/tools/Common/Internal/NativeFormat/NativeFormatReader.String.cs @ 76] 
0e 000000e7`122fedd0 00007fff`b201b2bc     REDACTED_NET!S_P_TypeLoader_Internal_Metadata_NativeFormat_MetadataTypeHashingAlgorithms__AppendNamespaceHashCode+0xa0 [/_/src/runtime/src/coreclr/tools/Common/Internal/Metadata/NativeFormat/MetadataTypeHashingAlgorithms.cs @ 22] 
0f 000000e7`122fee60 00007fff`b201b2bc     REDACTED_NET!S_P_TypeLoader_Internal_Metadata_NativeFormat_MetadataTypeHashingAlgorithms__AppendNamespaceHashCode+0x6c [/_/src/runtime/src/coreclr/tools/Common/Internal/Metadata/NativeFormat/MetadataTypeHashingAlgorithms.cs @ 22] 
10 000000e7`122feef0 00007fff`b201b3c4     REDACTED_NET!S_P_TypeLoader_Internal_Metadata_NativeFormat_MetadataTypeHashingAlgorithms__AppendNamespaceHashCode+0x6c [/_/src/runtime/src/coreclr/tools/Common/Internal/Metadata/NativeFormat/MetadataTypeHashingAlgorithms.cs @ 22] 
11 000000e7`122fef80 00007fff`b202f3d4     REDACTED_NET!S_P_TypeLoader_Internal_Metadata_NativeFormat_MetadataTypeHashingAlgorithms__ComputeHashCode+0xa4 [/_/src/runtime/src/coreclr/tools/Common/Internal/Metadata/NativeFormat/MetadataTypeHashingAlgorithms.cs @ 59] 
12 000000e7`122ff120 00007fff`b1fc2ee0     REDACTED_NET!S_P_TypeLoader_Internal_Runtime_TypeLoader_TypeLoaderEnvironment__TryGetNamedTypeForMetadata+0x74 [/_/src/runtime/src/coreclr/nativeaot/System.Private.TypeLoader/src/Internal/Runtime/TypeLoader/TypeLoaderEnvironment.Metadata.cs @ 161] 
13 000000e7`122ff1c0 00007fff`b1fb886c     REDACTED_NET!S_P_CoreLib_System_Reflection_Runtime_TypeInfos_NativeFormat_NativeFormatRuntimeNamedTypeInfo__GetRuntimeNamedTypeInfo+0x50 [/_/src/runtime/src/coreclr/nativeaot/System.Private.CoreLib/src/System/Reflection/Runtime/General/TypeUnifier.NativeFormat.cs @ 72] 
14 000000e7`122ff210 00007fff`b1fb8734     REDACTED_NET!S_P_CoreLib_System_Reflection_Runtime_General_TypeResolver__TryResolve_0+0x11c [/_/src/runtime/src/coreclr/nativeaot/System.Private.CoreLib/src/System/Reflection/Runtime/General/TypeResolver.NativeFormat.cs @ 34] 
15 000000e7`122ff270 00007fff`b1fbb3a0     REDACTED_NET!S_P_CoreLib_System_Reflection_Runtime_General_TypeResolver__Resolve_1+0x14 [/_/src/runtime/src/coreclr/nativeaot/System.Private.CoreLib/src/System/Reflection/Runtime/General/TypeResolver.NativeFormat.cs @ 24] 
16 000000e7`122ff290 00007fff`b2b7ed4c     REDACTED_NET!S_P_CoreLib_System_Reflection_Runtime_CustomAttributes_NativeFormat_NativeFormatCustomAttributeData__get_AttributeType+0x60 [/_/src/runtime/src/coreclr/nativeaot/System.Private.CoreLib/src/System/Reflection/Runtime/CustomAttributes/NativeFormat/NativeFormatCustomAttributeData.cs @ 43] 
17 000000e7`122ff2e0 00007fff`b1eb3844     REDACTED_NET!S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1__GetMatchingCustomAttributesIterator_d__2<System___Canon>__MoveNext+0x18c [/_/src/runtime/src/coreclr/nativeaot/System.Private.CoreLib/src/Internal/Reflection/Extensions/NonPortable/CustomAttributeSearcher.cs @ 114] 
18 000000e7`122ff330 00007fff`b2f14d80     REDACTED_NET!S_P_CoreLib_System_Attribute__OneOrNull+0x64 [/_/src/runtime/src/coreclr/nativeaot/System.Private.CoreLib/src/System/Reflection/Attribute.NativeAot.cs @ 121] 
19 000000e7`122ff350 00007fff`b216916c     REDACTED_NET!S_P_CoreLib_System_Reflection_CustomAttributeExtensions__GetCustomAttribute_9<System___Canon>+0x40 [/_/src/runtime/src/libraries/System.Private.CoreLib/src/System/Reflection/CustomAttributeExtensions.cs @ 56] 
1a 000000e7`122ff380 00007fff`b216d088     REDACTED_NET!System_Text_Json_System_Text_Json_Serialization_Metadata_JsonPolymorphismOptions__CreateFromAttributeDeclarations+0x2c [/_/src/runtime/src/libraries/System.Text.Json/src/System/Text/Json/Serialization/Metadata/JsonPolymorphismOptions.cs @ 105] 
1b 000000e7`122ff3c0 00007fff`b2f194ac     REDACTED_NET!System_Text_Json_System_Text_Json_Serialization_Metadata_JsonTypeInfo__PopulatePolymorphismMetadata+0x18 [/_/src/runtime/src/libraries/System.Text.Json/src/System/Text/Json/Serialization/Metadata/JsonTypeInfo.cs @ 1244] 
1c 000000e7`122ff3e0 00007fff`b21f84e8     REDACTED_NET!System_Text_Json_System_Text_Json_Serialization_Metadata_JsonMetadataServices__CreateCore<System___Canon>+0x3c [/_/src/runtime/src/libraries/System.Text.Json/src/System/Text/Json/Serialization/Metadata/JsonMetadataServices.Helpers.cs @ 19] 

It may or may not be relevant that we hit this while the thread is also doing something with custom attributes.

0:000> .ecxr
 x0=000001f9b4bf61e8   x1=00007fffb5b6da80   x2=00007fffb300f0b4   x3=00007fffb20012d0
 x4=0000000000000041   x5=00000000000019b0   x6=000001f9b4803850   x7=000001f9b4803850
 x8=0000000074099950   x9=0000000000000000  x10=00007fffb3e98390  x11=00007fffb5b6da80
x12=00007fffb3e98390  x13=0000000000000000  x14=000001f9b4bf6510  x15=00007fffb300f0b4
x16=0000000000000006  x17=0000000000000003  x18=0000000000000017  x19=00007fffb5ab0ce8
x20=000001f9b4bf6158  x21=000001f9b4bf6128  x22=000001f9b4bf5320  x23=000001f9b4bf0850
x24=000001f9b4bf0820  x25=00000000b3ec26ef  x26=0000000000000000  x27=0000000000000000
x28=0000000000000000   fp=000000e711b6eef0   lr=00007fffb2b7edc8   sp=000000e711b6eef0
 pc=0000000000000000  psr=60001440 -ZC- EL0
00000000`00000000 ?? ???

0:000> r
Last set context:
 x0=000001f9b4bf61e8   x1=00007fffb5b6da80   x2=00007fffb300f0b4   x3=00007fffb20012d0
 x4=0000000000000041   x5=00000000000019b0   x6=000001f9b4803850   x7=000001f9b4803850
 x8=0000000074099950   x9=0000000000000000  x10=00007fffb3e98390  x11=00007fffb5b6da80
x12=00007fffb3e98390  x13=0000000000000000  x14=000001f9b4bf6510  x15=00007fffb300f0b4
x16=0000000000000006  x17=0000000000000003  x18=0000000000000017  x19=00007fffb5ab0ce8
x20=000001f9b4bf6158  x21=000001f9b4bf6128  x22=000001f9b4bf5320  x23=000001f9b4bf0850
x24=000001f9b4bf0820  x25=00000000b3ec26ef  x26=0000000000000000  x27=0000000000000000
x28=0000000000000000   fp=000000e711b6eef0   lr=00007fffb2b7edc8   sp=000000e711b6eef0
 pc=0000000000000000  psr=60001440 -ZC- EL0
00000000`00000000 ?? ???

0:000> dps 0x7fffb5b6da80 L4
00007fff`b5b6da80  00007fff`b300f0b4 REDACTED_NET!RhpInterfaceDispatch4 [D:\a\_work\1\s\src\runtime\artifacts\obj\coreclr\windows.arm64.Release\nativeaot\Runtime\Full\StubDispatch.asm @ 5504]
00007fff`b5b6da88  00000201`808e0f00
00007fff`b5b6da90  00007fff`b300faa0 REDACTED_NET!RhpInitialInterfaceDispatch [D:\a\_work\1\s\src\runtime\artifacts\obj\coreclr\windows.arm64.Release\nativeaot\Runtime\Full\StubDispatch.asm @ 5520]
00007fff`b5b6da98  00000000`fe30f3d3

0:000> dps 0x7fffb3081818 L1
00007fff`b3081818  00007fff`b3014f30 REDACTED_NET!ThreadStore::Iterator::~Iterator [D:\a\_work\1\s\src\runtime\src\coreclr\nativeaot\Runtime\threadstore.cpp @ 49]

0:000> u poi(0x7fffb3081818) L10
REDACTED_NET!ThreadStore::Iterator::~Iterator [D:\a\_work\1\s\src\runtime\src\coreclr\nativeaot\Runtime\threadstore.cpp @ 49]:
00007fff`b3014f30 d65f03c0 ret
00007fff`b3014f34 00000000 ???
REDACTED_NET!ThreadStore::~ThreadStore [D:\a\_work\1\s\src\runtime\src\coreclr\nativeaot\Runtime\threadstore.cpp @ 77]:
00007fff`b3014f38 91004000 add         x0,x0,#0x10
00007fff`b3014f3c 1400299d b           REDACTED_NET!CrstStatic::Destroy (00007fff`b301f5b0)
REDACTED_NET!ThreadStore::AttachCurrentThread [D:\a\_work\1\s\src\runtime\src\coreclr\nativeaot\Runtime\threadstore.cpp @ 150]:
00007fff`b3014f40 a9bf53f3 stp         x19,x20,[sp,#-0x10]!
00007fff`b3014f44 a9bf7bfd stp         fp,lr,[sp,#-0x10]!
00007fff`b3014f48 910003fd mov         fp,sp
00007fff`b3014f4c d0016b88 adrp        x8,REDACTED_NET!WKS::gc_heap::poh_alloc_list+0x40 (00007fff`b5d86000)
00007fff`b3014f50 b94a3109 ldr         w9,[x8,#0xA30]
00007fff`b3014f54 f9402e48 ldr         x8,[xpr,#0x58]
00007fff`b3014f58 f8695908 ldr         x8,[x8,w9 uxtw #3]
00007fff`b3014f5c 91400108 add         x8,x8,#0,lsl #0xC
00007fff`b3014f60 9100c114 add         x20,x8,#0x30
00007fff`b3014f64 aa1403e0 mov         x0,x20
00007fff`b3014f68 97fff414 bl          REDACTED_NET!Thread::IsDetached (00007fff`b3011fb8)
00007fff`b3014f6c 360000e0 tbz         w0,#0,REDACTED_NET!ThreadStore::AttachCurrentThread+0x48 (00007fff`b3014f88)

0:000> ? 0x7fffb5b6da80 & f
Evaluate expression: 0 = 00000000`00000000

0:000> dps 0x00000201808e0f00 L12
00000201`808e0f00  00007fff`b3e7ce68 REDACTED_NET!S_P_CoreLib_System_IDisposable::`vftable'
00000201`808e0f08  00000000`00000000
00000201`808e0f10  00000000`00000000
00000201`808e0f18  00000000`00000004
00000201`808e0f20  00007fff`b3e979e0 REDACTED_NET!S_P_CoreLib_System_Reflection_Runtime_Assemblies_NativeFormat_NativeFormatRuntimeAssembly__get_CustomAttributes_d__2::`vftable'
00000201`808e0f28  00007fff`b1ffede0 REDACTED_NET!S_P_CoreLib_System_Reflection_Runtime_Assemblies_NativeFormat_NativeFormatRuntimeAssembly__get_CustomAttributes_d__2__System_IDisposable_Dispose
00000201`808e0f30  00007fff`b3e974b8 REDACTED_NET!S_P_CoreLib_System_Reflection_Runtime_ParameterInfos_RuntimeFatMethodParameterInfo__get_CustomAttributes_d__2::`vftable'
00000201`808e0f38  00007fff`b1ffdb70 REDACTED_NET!S_P_CoreLib_System_Reflection_Runtime_ParameterInfos_RuntimeFatMethodParameterInfo__get_CustomAttributes_d__2__System_IDisposable_Dispose
00000201`808e0f40  00007fff`b3e977e8 REDACTED_NET!S_P_CoreLib_System_Reflection_Runtime_CustomAttributes_RuntimeCustomAttributeData__GetCustomAttributes_d__16::`vftable'
00000201`808e0f48  00007fff`b1ffea20 REDACTED_NET!S_P_CoreLib_System_Reflection_Runtime_CustomAttributes_RuntimeCustomAttributeData__GetCustomAttributes_d__16__System_IDisposable_Dispose
00000201`808e0f50  00007fff`b3e98390 REDACTED_NET!S_P_CoreLib_System_Reflection_Runtime_TypeInfos_RuntimeNamedTypeInfo__get_CustomAttributes_d__4::`vftable'
00000201`808e0f58  00007fff`b2001250 REDACTED_NET!S_P_CoreLib_System_Reflection_Runtime_TypeInfos_RuntimeNamedTypeInfo__get_CustomAttributes_d__4__System_IDisposable_Dispose
00000201`808e0f60  00007fff`b4709868 REDACTED_NET!S_P_CoreLib_System_Collections_Generic_IEnumerable_1<S_P_CoreLib_System_Reflection_CustomAttributeData>::`vftable'
00000201`808e0f68  00000000`00000004
00000201`808e0f70  00000201`809100c0
00000201`808e0f78  00000000`00000002
00000201`808e0f80  00007fff`b4706898 REDACTED_NET!S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1__GetMatchingCustomAttributesIterator_d__2<S_P_CoreLib_System_Reflection_Assembly>::`vftable'
00000201`808e0f88  00007fff`b2b7f210 REDACTED_NET!S_P_CoreLib_Internal_Reflection_Extensions_NonPortable_CustomAttributeSearcher_1__GetMatchingCustomAttributesIterator_d__2<System___Canon>__System_Collections_Generic_IEnumerable_System_Reflection_CustomAttributeData__GetEnumerator

[MichalStrehovsky]

Claude Opus 4.6 with the above data and 42 premium requests later:

ARM64: Torn read in interface dispatch cache causes jump to null address

Summary

A race condition in the NativeAOT ARM64 interface dispatch cache read path can cause a null function pointer call. The CHECK_CACHE_ENTRY macro in src/coreclr/runtime/arm64/StubDispatch.asm (and .S) reads m_pInstanceType and m_pTargetCode from a cache entry using two separate ldr instructions separated by a control dependency (cmp/bne). On ARM64's weakly-ordered memory model, a control dependency does not order loads, so the hardware can speculatively satisfy the second load (target) before the first load (type) commits. When a concurrent thread is atomically populating that entry via UpdateCacheEntryAtomically (128-bit CAS: stlxp/casp), the reader can observe the new m_pInstanceType (match) but the old m_pTargetCode (zero), then br to address 0.

Crash mechanism (confirmed from dump)

1. Thread 0 enters RhpInterfaceDispatch4 for an IDisposable.Dispose dispatch.
2. The stub reads cache entry 3: ldr x12, [x9, #0x50] → gets the new m_pInstanceType (0x7fffb3e98390, matching the object's MethodTable).
3. The type matches, so the stub reads the target: ldr x9, [x9, #0x58] → gets the old m_pTargetCode (0) due to load reordering.
4. br x9 → jumps to address 0 → crash.

Key evidence: At crash time, registers show x2=x15=RhpInterfaceDispatch4 (the stub was entered successfully) and x9=0, x10=x12=0x7fffb3e98390 (cache hit with null target). Dumping the cache entry post-crash shows a valid non-zero target (0x7fffb2001250), confirming the stlxp committed the full pair but the reader saw only half.

Why it correlates with GC suspension

Every dump shows another thread in SuspendAllThreads. This is not the direct cause — it's because the same workload that creates the race (concurrent custom attribute iteration hitting the same IDisposable.Dispose dispatch cell with different types) also allocates, which triggers GC. The crashing thread never responds to the suspend request because it's already dead.

Why it's ARM64-only and non-deterministic

• ARM64-only: x86/x64 have a strong memory model that guarantees load-load ordering. ARM64 does not order loads across control dependencies.
• Non-deterministic: Requires the hardware to reorder two specific loads during the narrow window of a concurrent cache entry write — a rare microarchitectural event.

Fix

In src/coreclr/runtime/arm64/StubDispatch.asm and StubDispatch.S, replace the two separate ldr instructions in CHECK_CACHE_ENTRY with:

ldp     x12, x13, [x9, #(entry_offset)]   // load type and target as a pair
cmp     x10, x12
bne     skip
cbz     x13, skip                          // guard against torn read on pre-LSE2
br      x13

• ldp: Loads both fields in a single instruction. On FEAT_LSE2 hardware (ARMv8.4+, all ARM64 Windows devices, Apple Silicon, modern Linux ARM64), ldp to a 16-byte aligned address is guaranteed single-copy atomic for the pair, eliminating the torn read entirely.
• cbz guard: On pre-LSE2 hardware where ldp pair atomicity is not architecturally guaranteed, a torn read can only produce target=0 (entries transition from (0,0) → (type,target) and are never modified after). The cbz catches this and falls through to the slow resolution path. This makes the fix correct on all ARM64 hardware.

[dotnet-policy-service]

Tagging subscribers to this area: @agocke, @dotnet/ilc-contrib
See info in area-owners.md if you want to be subscribed.