Feedback Assistant: FB25454822
On iOS 27, our app (com.netshort.abroad) crashes inside FrontBoardServices while releasing an object saved across a synchronous scene-update callout. The stack has only system frames. A build shipped in September 2025 (1.8.3) hits the same crash as soon as the device is updated to iOS 27, so this is not a recent app change.
OS: iOS 27.0.0 (24A435), iOS 27.0.1 (24A446)
On build 2.3.4: 1264 events, 1216 users
0 libobjc.A.dylib objc_release_x26 + 8
1 FrontBoardServices -[FBSScene updater:didUpdateSettings:withDiff:transitionContext:completion:] + 780
2 FrontBoardServices _queue_updateScene…_block_invoke_2.cold.1 + 352
3 FrontBoardServices _queue_updateScene…_block_invoke_2 + 96
4 FrontBoardServices _calloutQueue_executeCalloutFromSource:withBlock: + 168
On 27.0.0 these frames show as <redacted> in Crashlytics. FrontBoardServices 0x19a88 is this method at 0x1977c plus 780, matching symbolicated 27.0.1 reports.
In the 27.0.1 FrontBoardServices binary, +776 is objc_release(x26) and +780 is the return address. x26 is transitionContext.actions. The callout into UIKit is the bl at +0x2ac. The crash happens after that callout returns.
34 Apple crash reports with register state show the same pattern: the low byte of saved x26 is 0x01.
- 20 reports: objc_release_x26 + 8, x26 = 0x1
- 14 reports: objc_release_x26 + 16, x26 ends in 0x01 (for example 0x13c373a01)
A nil actions value 0x0 becomes 0x1. A real pointer only has its low byte changed, so the isa read is off by one. In the +16 reports, x16 (0x8001000001fa8d89) is that isa shifted by one byte. This looks like a one-byte store of YES into the stack slot where x26 was saved across the callout.
There is no single user action that reproduces it. It happens when the system delivers a scene settings update. The frame that wrote the byte is already gone, because the crash is recorded after the callout returns.
Has anyone else seen this on iOS 27? I attached three .crash files with full register state to FB25454822.