[BUG] Bun 1.4.0 segfault at address 0x54 on background thread (KERNEL32/ntdll frames) ~6 min into session — CLI 2.1.234 native, Windows 10 x64, two consecutive sessions

Preflight Checklist

• [x] I have searched existing issues — closest matches are #77579, #83124, #75538 (all Bun 1.4.0 segfaults on Windows x64); this trace differs (background-thread panic, KERNEL32/ntdll frames) so filing separately per the maintainers' one-bug-per-report guidance
• [x] This is a single bug report
• [x] I am using the latest version of Claude Code (2.1.234)

What's Wrong?

Two consecutive interactive CLI sessions crashed with a Bun runtime segfault mid-session. The most recent one died ~6 minutes in (Elapsed: 364605ms) with:

panic(thread 23956): Segmentation fault at address 0x54
oh no: Bun has crashed. This indicates a bug in Bun, not your code.

Unlike the main-thread JSC GC crash in #77579 (address 0x...00000050), this panic is on a non-main thread and the bun.report trace frames are in KERNEL32.DLL and ntdll.dll. Same near-null address family though (0x54 vs 0x50 — reads of adjacent fields off a null base), same "ordinary session, low memory" conditions, so possibly the same underlying use-after-free surfacing on a different thread.

Not OOM: RSS was 0.60 GB on a 17.1 GB machine at time of death.

Environment

| | |
|---|---|
| Claude Code | 2.1.234 (commit 7215ba60b06d), auto-update channel: latest |
| Install | native installer, C:\Users\<user>\.local\bin\claude.exe |
| Bundled runtime | Bun v1.4.0 (StandaloneExecutable, win x86_64) |
| OS | Windows 10 Home 10.0.19045 |
| CPU | Intel Core i5-9300H |
| RAM | 17.1 GB |
| Host | plain claude in Command Prompt (no IDE extension) |

Bun crash dump (transcribed from terminal)

Args: "claude"
Features: Bun.stderr(2) Bun.stdin(2) Bun.stdout(2) abort_signal(108) fetch(155) jsc spawn(60) standalone_executable yaml_parse(85) claude_code
Builtins: "bun:ffi" "bun:main" "node:assert" "node:async_hooks" "node:buffer" "node:child_process" "node:constants" "node:crypto" "node:dns" "node:dns/promises" "node:events" "node:fs" "node:fs/promises" "node:http" "node:http2" "node:https" "node:module" "node:net" "node:os" "node:path" "node:path/posix" "node:path/win32" "node:perf_hooks" "node:process" "node:readline" "node:stream" "node:stream/consumers" "node:stream/promises" "node:string_decoder" "node:timers/promises" "node:tls" "node:tty" "node:url" "node:util" "node:vm" "node:zlib" "ws"
Elapsed: 364605ms | User: 22703ms | Sys: 4343ms
RSS: 0.60 GB | Peak: 0.61 GB | Commit: 0.65 GB | Faults: 319495 | Machine: 17.1 GB

panic(thread 23956): Segmentation fault at address 0x54

bun.report trace URL (transcribed by OCR from a screenshot of the terminal, so a character may be off — the visible frame names are KERNEL32.DLL and ntdll.dll):

https://bun.report/1.4.0/w_1939d432mgggkIuhogC0o55tD6wg1tD2n0pxDglwpxDwp2kxD+uys2Dwv/nqDw9uo7C+/t/+Cgtp54Cy1zquCms1riECYKERNEL32.DLLo35FCSntdll.dllipmTA2AoF

What the session was doing

Ordinary interactive coding session in a git repo (a mobile app project on a secondary drive). Nothing unusual running — no MCP servers beyond defaults, no background subagent fan-out. The feature counters (fetch(155), spawn(60)) reflect normal API traffic and tool calls over ~6 minutes. The previous session crashed the same way.

Repro

No deterministic repro; both crashes happened several minutes into normal interactive use. Happy to provide more info or run an instrumented build if useful.

Related

• #77579 — Bun 1.4.0 JSC GC use-after-free at 0x...00000050, main thread, symbolized trace
• #83124 — Bun 1.4.0 segfault at 0xFFFFFFFFFFFFFFFF on network fetch
• #75538 — Bun 1.4.0 segfault under concurrent subagent fetch/spawn churn