Ask HN: Clipboard overflows causing system crashes in macOS Tahoe 26.3 beta 2?

[nhubbard]

I'm submitting this because I'm not sure if something is wrong with my machine, or if there's a kernel bug that can be reproduced on another machine. I've been able to reproduce this issue on my machine twice in a row.

I have a 16-inch Nov 2024 M4 Pro MacBook Pro for my job. It's enrolled in AppleSeed as part of our internal beta testing.

One of the tasks I'm working on is building an IntelliJ IDEA plugin for our internal configuration system. As part of an enhancement I've been working on, I've needed to get several samples of PSI structures from the IDE. If you've worked with the IntelliJ Platform SDK, you know these PSI structures can be absolutely massive, especially if you need to copy and paste them to save them to files.

I tried to save one of these PSI structures to a file so I could analyze it more closely. I pressed Copy PSI in the IDE, opened Neovim in Ghostty to paste, and pressed the paste shortcut... and my system locked up and hard-crashed.

I tried it again when I rebooted, and the system hard crashed again.

I'm not sure how long the actual string I was copying and pasting is, but I know it's probably absolutely massive.

The problem is that I can't figure out if this is a Ghostty issue or a system issue. Ghostty is fully up to date.

Is anyone able to reproduce this issue?

[nhubbard]

Update: Several reproduction sessions later, it appears that the content of one specific YAML file's PSI structure is causing a negative interaction with the system's EndpointSecurity extension process. Either one of the AV products on my work machine or the EndpointSecurity extension itself are panicking when the Pasteboard daemon attempts to output the contents. My work's IT team is awesome, so they upgraded a testing machine to 26.3b2, ran the same test, and it was also affected.

The issue was happening in Ghostty, iTerm2, and Terminal.app. It happened by (a) pasting directly into the terminal prompt with Command-V, (b) using `pbpaste` in any way (like piping it into `wc -c`), or (c) pasting into an editor like Neovim with Command-V.

It doesn't happen with any other file I tested it with. It also doesn't happen if I try to paste into another app, like Visual Studio Code, TextEdit, or IntelliJ IDEA itself.

Nothing is inherently wrong with the binary/text content of the file. It's all ASCII characters.

[Someone]

> Either one of the AV products on my work machine or the EndpointSecurity extension itself are panicking when the Pasteboard daemon attempts to output the contents

I guess the first step would be to disable those “AV products” to see whether they affect the issue (aside: I would already find “AV product” too much, but productS?). That way, you know who to report the issue to.

Next, reading your next comment, would be try and make the string shorter to try and find the shirted example.

[tredntstedhn]

The macos dev forum is very responsive to questions like these, I suggest you ask this there too https://developer.apple.com/forums/tags/macos

[nhubbard]

I would normally do something like that; however, we opted to open an AppleCare Enterprise case for it, since it gets an engineer to look into the issue.

Both our Mac IT manager and I are thinking that it's the AV engine (Microsoft Defender) seeing fragments of YAML in the PSI tree and then blowing up after trying to parse the next line (which is not a truly valid YAML tree, it's a YAML tree with all the semantic details produced by IntelliJ). That in and of itself shouldn't be an issue, but I guess they weren't expecting random fragments of YAML to be copied and pasted.

We're still not sure why it only triggers in terminal emulators, though. That one is a total mystery.