=== Mali-G925 SIGSEGV — variant 4 — vkQueueWaitIdle ===

Device   : Samsung Galaxy Tab S11 (SM-X736B)
GPU      : Mali-G925-Immortalis MC12
Driver   : 49.1.0
Vulkan   : 1.3.278

App      : com.samsung.aifredo.debug
Source   : vulkan_swapchain.cpp:1070 — heavy-handed full-queue stall
           (vkQueueWaitIdle on the swapchain present queue) in place
           of any semaphore wait. Different API surface from variants
           1-3; intended to bypass the broken sync-object subsystem
           by waiting on the queue itself.

Rationale  : if semaphore + fence subsystems are corrupt, maybe the
             queue-drain API takes a different code path. Hypothesis
             FAILED — driver still crashes.

=== logcat -b crash excerpt ===

F libc    : Fatal signal 11 (SIGSEGV), code 1 (SEGV_MAPERR),
            fault addr 0xbea048453f5f7f8b in tid <Thread-2>
F DEBUG   : esr: 0000000092000004 (Data Abort Exception 0x24)

Fault address 0xbea048453f5f7f8b is a tagged-pointer-looking value
in the upper kernel range — consistent with the ICD blindly using
a corrupt struct field as a pointer and the kernel mapping table
rejecting the access.

=== backtrace ===

#00 pc 0x21594  /system/lib64/libvulkan.so
    vulkan::api::(anonymous namespace)::QueueWaitIdle(VkQueue_T*)+4
#01 pc 0x3b074c /data/app/.../librvmncnn.so
    aifredo_swapchain_present_real_frame+860
    (corresponds to vulkan_swapchain.cpp:1070 = vkQueueWaitIdle(s.queue))
#02 pc 0x369544 /data/app/.../librvmncnn.so
    NdkCameraWindow::on_image+3364
#03 pc 0x36af88 /data/app/.../librvmncnn.so
    NdkCameraWindow::rtsp_thread_func+1984
#04 pc 0x8aadc  /apex/com.android.runtime/lib64/bionic/libc.so
    __pthread_start+236

=== analysis ===

vkQueueWaitIdle delegates from libvulkan to ICD. Fault fires at
the entry +4 of the libvulkan QueueWaitIdle wrapper (same
delegation pattern as variant 1's WaitForFences).

Even the heaviest sync API in Vulkan triggers the same Mali
driver crash. The bug is in a shared internal helper that ALL
sync APIs route through after the compute queue submit
corrupts state.

Conclusion: the ICD's sync subsystem has a single broken
helper that all 4 caller-facing APIs reach, and no
combination of compute-and-present queue ordering avoids it
on this driver.