[Bug] VMPal GPU crashes (SIGSEGV in dxmt-native, geometry shader) — Revit 2027 DX11 mode can no longer open models (regression since 0.78) #106

Description

With GPU acceleration on, the host-side VMPal GPU renderer process crashes
with SIGSEGV inside dxmt-native while Autodesk Revit 2027 draws a model in
its standard DirectX 11 mode (Revit's "Accelerated Graphics" is off). The
Windows app then gets DXGI_ERROR_DEVICE_REMOVED, and Revit shows "Video
driver error occurred" and exits.

This is a regression. On 14 October with VMPal 0.78, the same model opened
and orbited fine in this mode (see #49, which covers a separate OpenGL issue).
Today Revit can't open any 3D model without crashing. It crashed twice today,
at two different places in dxmt-native.

Possibly related: #84 (renderer hang killed with signal 9). Here the
renderer crashes with signal 11, with symbolicated stacks below. Both
sessions show the same npt: object table: Create … failed on the host
warnings first.

Steps to Reproduce

1. Windows 11 ARM64 VM with GPU acceleration on.
2. Start Revit 2027 with default graphics options (DirectX 11 hardware mode).
3. Open the bundled sample
   C:\Program Files\Autodesk\Revit 2027\Samples\Snowdon Towers Sample Architectural.rvt
   (or its 3D view).
4. Within seconds of the model drawing, the VMPal GPU process crashes.

Current Behavior

macOS crash report VMPal GPU-2026-10-30-174651.ips
(EXC_BAD_ACCESS / SIGSEGV, KERN_INVALID_ADDRESS at 0x0000009de5801b58).
The faulting thread is:

dxmt-native  dxmt::dxbc::convert_dxbc_vertex_for_geometry_shader(SM50ShaderInternal const*, char const*, SM50ShaderInternal const*, llvm::LLVMContext&, llvm::Module&, SM50_SHADER_COMPILATION_ARGUMENT_DATA*)
dxmt-native  SM50CompileGeometryPipelineVertex
dxmt-native  dxmt::GeneralShaderCompileTask<…CreateVariantShader<dxmt::ShaderVariantGeometryVertex>…>::RunThreadpoolWork()
dxmt-native  dxmt::task_scheduler<dxmt::ThreadpoolWork*>::worker_func()

An earlier crash, VMPal GPU-2026-10-30-173811.ips (also SIGSEGV), faulted
in the encoding thread instead:

dxmt-native  …MTLD3D11DeviceContextImplBase<dxmt::ContextInternalState>::FinalizeCurrentRe…
dxmt-native  dxmt::CommandChunk::encode(WMT::CommandBuffer, dxmt::ArgumentEncodingContext&)
dxmt-native  dxmt::CommandQueue::CommitChunkInternal(dxmt::CommandChunk&, unsigned long long)
dxmt-native  dxmt::CommandQueue::EncodingThread()

The VM log shows the following for the 17:40 session (times in seconds since
VM start):

 365.397 [virgl] npt: object table: Create for id 0x0000000000000002 failed on the host; its calls will be dropped
 366.553 [virgl] npt: object table: Create for id 0x00000000000000e3 failed on the host; its calls will be dropped
 369.644 [virgl] npt: object table: Create for id 0x0000000000000cff failed on the host; its calls will be dropped
 370.138 [gpu] 3D context 39 stopped: its renderer process ended; Windows' app gets DEVICE_REMOVED
 370.142 [virgl] worker 73333 DIED on signal 11

The Revit journal shows the same timing (guest clock synced with the host):

17:46:27.358  File: Open
17:46:50.423  idle0_doc                      (model drawn)
17:46:53.187  DBG_WARN: DX Hardware Acceleration driver failed with Error - DXGI_ERROR_DEVICE_REMOVED
17:47:16.420  TaskDialog "Video driver error occurred."   (Revit exits)

Two more things in today's log:

• In the 17:31 session, 256 consecutive failures, all with
  npt: dispatch error for cmd_type=0xff00571e and
  npt: failed to read 8 bytes (remaining=4), followed by
  3D context N stopped … DEVICE_REMOVED.
• At 17:41:14, while Revit was running:
  VMPal Tools: display driver: 3D driver removed: oem4.inf (0), oem13.inf (0), held vgpusrv, ShellExperienceHost, viogpuap, explorer, RevitWorker, …
  The Tools replaced the 3D driver while Revit's worker still held it.

The first crash looks like a geometry-shader emulation bug: DXMT converts the
vertex stage of a D3D11 geometry-shader pipeline. Revit uses geometry shaders
in its 3D views.

Expected Behavior

Revit's DirectX 11 hardware mode keeps rendering, as it did with VMPal 0.78.
At minimum, a single shader DXMT can't translate shouldn't take down the
whole renderer process and every D3D app in the guest.

Environment

• App version: VMPal 0.112 (112), VMPal Tools 0.69 in the guest (worked with 0.78 / Tools 0.53)
• Mac: Mac17,9, Apple M5 Pro, 24 GB
• macOS version: macOS 27.2 (26B123)
• VM's OS: Windows 11 Pro 24H2 ARM64 (26100.9457), 12 vCPUs, 12 GB RAM, GPU acceleration on
• App: Autodesk Revit 2027.3 (build 20260228_1515, x64 under emulation), standard DirectX 11 hardware mode, Accelerated Graphics off

Log

Both .ips crash reports, the VM log for 30 October, the Revit journal and
both Revit crash dumps are available. They'll be emailed to nick@tableplus.com
with this issue's link.

Workaround for users: in Revit, File → Options → Hardware → turn off
"Use hardware acceleration". Revit then renders with WARP on the CPU and
VMPal's GPU path isn't used.