We root-caused a launch crash that only affects ARCHIVED builds (Run/Debug works, simulator works) and filed it as FB23528109. Posting the details here because the crash signatures are hard to search for and other teams are likely to hit this as they adopt Swift 6.3 toolchains.
SYMPTOM
The archived app crashes before main() on device, on every launch. Depending on which orphaned pointer gets read first, the crash looks like one of these:
EXC_BREAKPOINT, "pointer authentication trap DA", inside swift_conformsToProtocolMaybeInstantiateSuperclasses / _searchConformancesByMangledTypeName (often with a Firebase or other +load frame below it; that frame is just the first conformance scan at launch, not the cause)
EXC_BAD_ACCESS KERN_INVALID_ADDRESS at a small, raw unslid address (e.g. 0xc118), inside dyld: resolveRebase <- objc_visitor::forEachClass <- dyld4::PrebuiltObjC::make
Debug builds, simulator builds and Xcode Run builds are all fine, because the corruption happens in the Strip build phase, which only runs for Archive/install builds.
ROOT CAUSE (two defects combine)
strip -S -T (what Xcode runs on embedded frameworks during Archive when STRIP_SWIFT_SYMBOLS = YES) corrupts dyld chained fixups. When strip removes a Swift weak-definition symbol that has a GOT bind, it converts the bind into a rebase to the local definition (correct) but writes the converted entry with next = 0 (incorrect). That terminates the 16 KB page's fixup chain early, and every fixup after the converted slot in the same page is orphaned: dyld never processes it, so raw chain-encoding bytes get read as pointers at launch. The bug is present in every strip we tested: Xcode 26.3, 26.4, 26.4.1, 26.5, 26.6 and 27.0 beta 2. strip -S and strip -S -x (without -T) do not corrupt.
Starting with Swift 6.3.0 (Xcode 26.4.0), the compiler emits the trigger pattern for ordinary code: cross-module references to a non-final class's stored-property accessors become weak-def-coalesce binds (Swift 6.2.4 emits none). So apps that embed a multi-module Swift dynamic framework (e.g. an SPM package built as one dynamic framework) started getting corrupted by their own default Archive pipeline when they moved past Xcode 26.3.
HOW TO CHECK IF YOU ARE AFFECTED
Compare the fixups of a framework binary inside your archive against a Run build of the same code:
xcrun dyld_info -fixups YourApp.app/Frameworks/YourKit.framework/YourKit
If fixups that exist in the Run build are missing after the archive's strip step (in particular __got slots and anything after them in the same 16 KB page), you are affected. Also: any GOT bind of a Swift ($s...) symbol in the pre-strip binary is a red flag.
WORKAROUND
Set STRIP_SWIFT_SYMBOLS = NO (optionally STRIP_STYLE = non-global, i.e. strip -S -x, which kept the size cost to about +4% for us). Important: if the affected framework is a Swift package product, these must be passed as xcodebuild command-line overrides (e.g. xcodebuild ... STRIP_SWIFT_SYMBOLS=NO STRIP_STYLE=non-global); xcconfig files do not apply to package targets.
REPRO
FB23528109 contains a complete minimal reproducer (4 small C files + 1 trivial Swift file, no proprietary code): a 30-second CLI script whose host binary segfaults through an orphaned pointer, and a default-settings Xcode project whose Run build works while its archived build crashes pre-main on device, identically for archives produced by Xcode 26.3.0, 26.4.0 and 26.6 (crash logs for each attached in the FB).
Happy to share more details from the investigation if anyone is debugging the same signatures.
