=== Mali-G925 SIGSEGV — variant 3 — vkGetSemaphoreCounterValue (poll) ===

Device   : Samsung Galaxy Tab S11 (SM-X736B)
GPU      : Mali-G925-Immortalis MC12
Driver   : 49.1.0
Vulkan   : 1.3.278

App      : com.samsung.aifredo.debug
Source   : vulkan_swapchain.cpp:1081 — non-blocking poll loop using
           vkGetSemaphoreCounterValue (Vulkan 1.2 + KHR_timeline_semaphore)
           in place of blocking vkWaitSemaphores. Tight spin with
           usleep(10) per iteration, max ~50ms spin then bail.

Rationale  : if Mali ICD crashes on blocking semaphore wait, maybe it
             handles non-blocking counter-value introspection without
             the corrupting state-machine path. Hypothesis FAILED —
             same ICD region.

=== logcat -b crash excerpt ===

F libc    : Fatal signal 11 (SIGSEGV), code 1 (SEGV_MAPERR),
            fault addr 0x0000005ffffa67f0 in tid <Thread-2>
F DEBUG   : esr: 0000000092000007 (Data Abort Exception 0x24)

=== register dump (key) ===

x0  b4000079e0289ee0   <- VkSemaphore handle (probably valid)
x1  b400007ae02e7ba0   <- pValue output pointer (probably valid)
x8  0000005ffffa67f0   <- ICD attempted to write here (fault)
pc  0000007902ead3a4   <- inside libGLES_mali.so deeper handler

=== backtrace ===

#00 pc 0x1dd63a4 /vendor/lib64/egl/mt6991/libGLES_mali.so
    BuildId: 8ffcdf0fe7b476c1
#01 pc 0x994fd4  /vendor/lib64/egl/mt6991/libGLES_mali.so
    BuildId: 8ffcdf0fe7b476c1
    (note: ~0x99xxxx region — same general code as variant 2's 0x995098)
#02 pc 0x3b0814  /data/app/.../librvmncnn.so
    aifredo_swapchain_present_real_frame+912
    (corresponds to vulkan_swapchain.cpp:1081 = pfn_GetSemaphoreCounterValue)
#03 pc 0x369584  /data/app/.../librvmncnn.so
    NdkCameraWindow::on_image+3364
#04 pc 0x36afc8  /data/app/.../librvmncnn.so
    NdkCameraWindow::rtsp_thread_func+1984
#05 pc 0x8aadc   /apex/com.android.runtime/lib64/bionic/libc.so
    __pthread_start+236

=== analysis ===

Two libGLES_mali.so frames now visible:
  - outer: 0x1dd63a4 (higher-level dispatcher)
  - inner: 0x994fd4 (counter-value read path)

The 0x99xxxx address range matches variants 2 and 5 — strong
indicator of a single broken function or struct in the ICD's
sync subsystem. Whether the caller uses blocking wait or
non-blocking poll, control reaches the same corrupted state.

App-side conclusion: ARM driver patch required. No app-visible
sync API on Mali survives the post-compute-submit period.