[BUG] Ctrl+V image paste deterministically crashes CLI — Bun 1.4.0 SIGBUS at 0xBAD4007 on macOS 26.5 (any image, 3/3 repro)

Description

Pressing ctrl+v to paste an image from the clipboard deterministically crashes the entire Claude Code CLI with a Bun runtime panic:

panic(main thread): Bus error at address 0xBAD4007
oh no: Bun has crashed. This indicates a bug in Bun, not your code.
fish: Job 1, 'claude' terminated by signal SIGBUS (Misaligned address error)

Reproduced 3 out of 3 attempts, with two different images, identical crash signature every time.

Environment

• Claude Code: 2.1.237 (latest at time of filing; also observed on the same day's earlier build)
• Bun: 1.4.0 (bundled), M_1fdb5e06 build
• OS: macOS 26.5.2, arm64 (Apple Silicon)
• Terminal: kitty 0.41.1 (no custom keymaps), fish shell, inside a herdr 0.8.2 pane — the multiplexer only forwards the keypress; the crash occurs inside Claude Code's clipboard read
• editorMode: default (not vim — this is not #76072's key-swallowing; the paste handler is reached and then panics)

Reproduction (100% on this machine)

1. Copy any image to the clipboard. Tested with:

• a ~186 KB image copied from a browser, and
• a 3.6 KB macOS system PNG set via osascript -e 'set the clipboard to (read (POSIX file ".../shadow-light-4px.png") as «class PNGf»)'

1. Run claude, focus the input.
2. Press ctrl+v.
3. Instant SIGBUS panic; the whole CLI process dies.

Crash report URLs emitted by Bun (two separate runs, near-identical traces):

• https://bun.report/1.4.0/M_1fdb5e06mgkgkIugogC_______+o1yF_mmxwuDmr2nuDuo6u/Cuw0t/Cupv3kD+8wvnD2ipxM__mr2nuD+ihv1CA4Augg11L
• https://bun.report/1.4.0/M_1fdb5e06mgkgkIuhogC_______+o1yF_mmxwuDmr2nuDuo6u/Cuw0t/Cupv3kD+8wvnD2ipxM__mr2nuD+ihv1CA4Augg11L

Analysis

A likely relevant detail: on macOS 26.5, the pasteboard auto-promises nine representations for any copied image. Even for the 3.6 KB system PNG above, osascript -e 'clipboard info' reports:

«class PNGf», 3660, «class AVIF», 5100, «class 8BPS», 5160, GIF picture, 64,
«class jp2 », 4924, JPEG picture, 5054, TIFF picture, 5912, «class BMP », 2554, «class TPIC», 392

So every image paste on this OS version presents AVIF / Photoshop (8BPS) / JPEG-2000 / TPIC flavors alongside PNG/TIFF. If the clipboard reader enumerates or converts promised flavors, one of the newer ones is a plausible trigger — which would explain why the crash is image-independent and size-independent on macOS 26.5 while most users (on older macOS) don't see it.

0xBAD4007 looks like a poisoned-pointer sentinel rather than a wild pointer.

Ruled out

• Image size/content/source (a 3.6 KB system PNG crashes identically to a browser image)
• vim editor mode, terminal keymaps, multiplexer key handling
• Image ingestion in general: drag-and-drop of an image file and file-path references work perfectly — only the clipboard-read path crashes

Possibly related

• #85102 — identical crash signature (Bun 1.4.0 SIGBUS, macOS 26, arm64), attributed there to heavy file I/O; may share the underlying memory bug.

Workaround

Drag the image file onto the terminal, or reference the image path in the prompt.