Crash on Launch – iPad Air (5th Gen) – iPadOS 18.6 – Address Size Fault (Case-ID: 15374981)

We are dealing with a launch-time crash that happens every time in Apple’s review environment, but does not occur in any of our local or TestFlight testing.

• Case-ID: 15374981
• Device in Review: iPad Air (5th generation)
• OS in Review: iPadOS 18.6
• Build Environment: Xcode 15.x → Archive → Export for App Store Connect
• Deployment Target: iOS 14.0+
• Architecture: arm64

What Happens

• In Apple’s review environment: app launches → no UI → immediate crash.

• We have 8 crash logs from App Review — all with identical stack signatures.

• In our testing: the same build runs without issue on:

  • iPad Air (5th gen) – iPadOS 18.5, 18.6
  • iPad Pro 11" – iPadOS 18.5, 18.6
  • Multiple iPhone models – iOS 17.x / 18.x

Crash Log Signature (main thread)

Exception Type:     EXC_BAD_ACCESS (SIGSEGV)
Exception Subtype:  KERN_INVALID_ADDRESS
Termination Reason: Address size fault
Crashed Thread:     com.apple.main-thread

0   libsystem_kernel.dylib      mach_msg2_trap + 8
1   libsystem_kernel.dylib      mach_msg_overwrite + 428
2   CoreFoundation              __CFRunLoopServiceMachPort + 160
3   CoreFoundation              __CFRunLoopRun + 1208
4   CoreFoundation              CFRunLoopRunSpecific + 572
5   UIKitCore                   -[UIApplication _run] + …
6   UIKitCore                   UIApplicationMain + …

libobjc-trampolines.dylib appears in several traces immediately before the crash.

Included Frameworks

• SZAVPlayer
• Toast_Swift
• FBSDKCoreKit / FBAEMKit
• Firebase Crashlytics (enabled)

Already Tried

• Clean build / archive from scratch.
• Disabled On-Demand Resources.
• Verified entitlements & provisioning.
• Created minimal (<50 MB) repro build — still works fine locally.
• Tested across multiple devices and OS versions — no local repro.

Request

Looking for:

1. Known iPadOS 18.6 launch-time regressions on iPad Air 5th Gen.
2. Any Apple-internal tooling/config differences in the review environment that could trigger Address size fault at launch.
3. Guidance on how to replicate the review environment for debugging.

All 8 .ips crash logs and the minimal reproducible project are here: [https://github.com/rthomas83x/testproject]