libquic.dylib crash during QUIC path migration on iOS 26 (quic_migration_probe_path / nw_protocol_data_access_buffer)

We are seeing a consistent crash on iOS 26 that does not reproduce on iOS 17 or iOS 18. The crash occurs on a background thread ("com.apple.network.connections") with no application code in the crashed thread's stack.

The crash trace begins in quic_migration_probe_path and terminates in nw_protocol_data_access_buffer + 180, suggesting a use-after-free or buffer lifetime violation during QUIC connection path migration (e.g., Wi-Fi ↔ Cellular handoff).

This crash does not appear to be reproducible on demand — it correlates with network path transitions while QUIC connections are active. Our app uses standard URLSession with default/ephemeral session configurations and does not explicitly enable HTTP/3; iOS 26 is automatically upgrading eligible connections.

Crash thread (abbreviated):
  0  libquic.dylib    quic_conn_send_packet + 144
  1  libquic.dylib    quic_conn_continue_sending + 424
  2  libquic.dylib    __quic_conn_send_frames_for_key_state_block_invoke_2 + 1244
  3  Network          nw_protocol_data_access_buffer + 180   ← crash
  4  Network          nw_protocol_data_copy_buffer
  5  Network          nw_endpoint_flow_output_frames
  6  libquic.dylib    quic_conn_send_frames_for_key_state
  7  libquic.dylib    quic_conn_send_frames
  8  libquic.dylib    quic_migration_probe_path + 1464
  9  libquic.dylib    quic_migration_path_established + 2608
  10 libquic.dylib    __quic_migration_path_event_block_invoke.21
  11 libquic.dylib    quic_migration_path_event
  12 Network          nw_protocol_implementation_connected

There is no app code in the crashed thread. This is a regression introduced in iOS 26, where libquic.dylib was separated into its own dynamic library and new path migration probe logic was introduced.

iOS → iOS 26

Networking → URLSession / Network.framework