[oliverames]

What and why

A finding with no fix yet, written up so the next person who sees it can find it in the symptom index.

On my iPhone Duo, Mario Kart World 1.8.0 froze 2 to 3 seconds into a race: the last frame stayed on screen, the overlay read 0 fps, the process stayed alive, and the log had no [RED] line and no GPU error. Every thread was waiting and none was spinning. Fifteen minutes later the phone restarted itself.

It happened a second time an hour later on the same build, at the title's demo with no button pressed, with the same thread state. Both came during a scene load, so it needs neither driving nor input.

What the game's own state dump and the phone's stack report show:

• The replay thread was in the kernel inside [MTLResidencySet commit] (iokit_user_client_trap ← res_commit ← pool_res ← mtl_gpu_addr ← bind_vbufs ← draw_), and it never came back. pool_res runs with g_mu held by its caller, and res_commit holds g_res_mu across the call.
• The GPU's completion queue was waiting for a mutex in post_complete, so no fence completed after that (main fence submitted 206262 / completed 206256) and everything that waits for a fence waited for good.
• Ending the app didn't end the process. The system's stack report, 15 minutes after the freeze, still has it with one thread left (NVN queue replay) in an uninterruptible kernel wait with a read-write lock held, and a kernel thread blocked on it. The phone was at 7.2 GB wired and 34 MB free.

So the hang is on the kernel's side and the cause isn't known past that. It wasn't the GPU stopping (a fixed compute dispatch on its own queue kept completing every second) and it wasn't the game's own memory (4.2 GB of an 8.2 GB limit, the same as in the run before).

The PR adds the entry to docs/reference/rendering.md, next to the other residency commit entries, with what was ruled out, what the host could change (the game makes about five commits a frame in a race), and what to collect from the phone if it happens again. The game note links it under Open.

It may be related to the hangs that take WindowServer down on a Mac (#1326, #1605), but I haven't checked that and the entry doesn't claim it.

Checked

• Tests: test_docs.py passes, and docs_symptoms.py was run. env_switches.py --check lists only the three names it already lists on main.
• Games run, with title ID and version: Mario Kart World (0400C3F00006E000), update 1.8.0 (v917504). Four scripted runs on one build: main 04811a6 with PRs DM_GPU_CANARY=1 (opt-in): a fixed compute dispatch once a second, to tell a GPU clock fall from a heavier scene #1709, The first power line is preceded by the CPU's tiers (hw.perflevelN name, cores, L2) #1695, Start memory and CPU diagnostics after environment setup #1262, Soft textures: a large block-compressed texture kept without its finest level, its level-0 pages back #1599 and Opt-in pacing switches for the iPhone judder: DM_PCORE, DM_RT60, DM_ITV_LATCH (not fully tested) #1713 merged. Two races of 5 to 7 minutes ran through, one froze 2 to 3 s into the race, and a run with DM_PSO_MTL4=1 froze at the title before any input. On the same tree with main's 6f50de0 and 12a44e0 added, four more races of 5 to 7 minutes didn't freeze.
• Devices and OS: iPhone 19,4 (a Duo foldable), iOS 27.3 beta (24C5037i).
• Not checked: how often it happens, and whether main's 6f50de0 and 12a44e0 changed it. It's two events in four runs before them and none in four after, which is too few to tell. Nothing was changed in the host, so there's no regress.py run.

Docs

• The finding is in its docs/reference/rendering.md entry and the game note, and python3 dm/tools/docs_symptoms.py was run.
• A chain tool changed: dmsh_chain.py --header was run and dm/gfx/nvn/dmsh_chain.h is part of the change. Not applicable.
• No game files, keys or data extracted from a game in the change or the attachments.

Updated 2026-11-10 with the second occurrence. On Nov 12 main 0c23e0b59 was merged in (head 5a78847e); only the game note's list conflicted.