ARK: Survival Ascended (UE5.5) reliably faults the GPU when opening the native in-game **creature tracking list** ("track dinos"). 100% reproducible.

ARK: Survival Ascended (UE5.5) reliably faults the GPU when opening the native in-game creature tracking list ("track dinos"). 100% reproducible.

vkd3dclosed FSR use after free jank

HansKristian-Work/vkd3d-proton#3078 · opened 2026-05-30 by fhiltscher · updated 2026-06-10 · 5 comments · github

Ffhiltscher 2026-05-30 github

A RADV_DEBUG=hang capture identifies a use-after-free: a VkImage and its backing VK_OBJECT_TYPE_DEVICE_MEMORY are unbound/freed, then the GPU reads a page inside that just-freed VA range from a compute shader (indirect dispatch). RADV's own verdict: "Potential use-after-free detected!"

vm_fault.log (full dump attached):

Failing VM page: 0x80058226f000   CLIENT_ID: (TCP) 0x8   PERMISSION_FAULTS: 3
VA=0000800582200000-0000800582668000  bind    DEVICE_MEMORY  handle 0x7066a803bf10
VA=0000800582200000-0000800582668000  bind    IMAGE          handle 0x7066a88bce30
VA=0000800582200000-0000800582668000  unbind  IMAGE          handle 0x7066a88bce30
VA=0000800582200000-0000800582668000  unbind  DEVICE_MEMORY  handle 0x7066a803bf10
Potential use-after-free detected!

pipeline.log — the faulting work is a compute shader (VkDispatchIndirectCommand: x=158, pipeline hash 61b094d5eeb9e8d1).

Reproduced on both vkd3d-proton 3.0.1 (Proton Experimental, fault client TCP) and the vkd3d 2.x in GE-Proton10-33 (fault client SQC (data)) — same gfxhub page fault on vkd3d_queue / ring:24, only the cache client differs. Possibly related: #2906 (Squad UE5), #3032/#3033 (Forza Horizon 6 image/buffer descriptor aliasing).

Repro steps: load a singleplayer session → open the in-game creature tracking list → GPU page fault + ring reset within seconds (with RADV_DEBUG=hang it freezes and dumps instead).

Software information

ARK: Survival Ascended (Steam AppID 2399830), UE5.5.4 (++ARK1+Rel-1.87, CL 813614), D3D12. Default graphics settings. Trigger is the native creature tracking list; reproduced with and without game mods.

System information

GPU: AMD Radeon RX 7800 XT (RADV NAVI32, RDNA3, gfx11.0)
Driver: Mesa 26.1.1 (kisak-mesa PPA), kernel 7.0.0-22-generic (Kubuntu 26.04)
Wine version: wine-11.0 (Proton Experimental experimental-11.0-20260522b); also reproduced on GE-Proton10-33 / wine-10.0 (Staging)
VKD3D-Proton version: 3.0.1 (build 84a46a2360326cc) on Proton Experimental; also reproduced on the older 2.x bundled in GE-Proton10-33

Log files

Full PROTON_LOG=1 log is ~8.4 GB (bloated by RADV_DEBUG=hang + Wine tracing) — attaching a trimmed excerpt (proton-log-auszug.txt, version banner + vkd3d-proton init) instead; can provide a clean full log on request.

Attached ark-asa-vkd3d-uaf-artefakte.zip contains:

radv_dumps_.../ — full RADV_DEBUG=hang dump (vm_fault.log, pipeline.log, addr_binding_report.log, bo_history.log, trace.log, registers.log, gpu_info.log, …)
dmesg-*.txt — matching kernel amdgpu page-fault log
proton-log-auszug.txt — Proton/DXVK/vkd3d-proton version banner + init excerpt

ark-asa-vkd3d-uaf-artefakte.zip

Ffhiltscher 2026-05-30 github

Additional data point: I tested VKD3D_CONFIG=single_queue to see whether this is an async compute/transfer queue lifetime race. It does not help — same crash, on the first open of the creature tracking list, with the identical signature:

amdgpu: [gfxhub] page fault (ring:24 vmid:5) Process GameThread thread vkd3d_queue
        Faulty UTCL2 client ID: TCP (0x8)
amdgpu: ring gfx_0.0.0 timeout → ring reset → device wedged, but recovered through reset

HHansKristian-Work maintainer 2026-06-01 github

Try https://github.com/HansKristian-Work/vkd3d-proton/pull/3074 with VKD3D_CONFIG=defer_resource_destruction.

Ffhiltscher 2026-06-01 github

Followed up on the #3074 suggestion and then isolated the trigger. Results:

Proton / vkd3d	defer flag	FSR	Result
stock GE-Proton10-33	off	on	device-lost on 1st open (deterministic)
#3074 build (3.0.0)	on	on	device-lost after several opens
#3074 build (3.0.0)	on	off	no crash
stock GE-Proton10-33	off	off	no crash

Two takeaways:

#3074 helps but doesn't fully fix it. With FSR on it went from a 100% first-open fault to an intermittent fault after repeated opens — the retention window shrinks but the UAF still happens.
Disabling the FSR upscaler in-game avoids the crash on stock vkd3d, with no VKD3D_CONFIG at all. So the residual lifetime issue appears to live specifically in the FSR resource path.

This matches the log: every fault is immediately preceded by a flood of

d3d12_resource_SetName: FSR resource detected. Forcing retained GPU reference
to work around broken integration code in either game or UE5.

and when it faults:

VK_ERROR_DEVICE_LOST (reason 0x887a0005)
GCVM_L2_PROTECTION_FAULT_STATUS: 0x501431
radv/amdgpu: The CS has been cancelled because the context is lost. This context is innocent.

Thanks a lot for the quick response on this, and for all the work you put into vkd3d-proton — it's a huge part of what makes gaming on Linux actually possible. Much appreciated.

HHansKristian-Work maintainer 2026-06-01 github

Are you using FSR4? I can reproduce the FSR3 use after free errors being detected once I click the tracker, but no hang. Does this reproduce on stock Proton Experimental?

HHansKristian-Work maintainer 2026-06-10 github

Should be resolved now. All descriptor qa errors were gone with these fixes and if it still hangs, I need to see VKD3D_CONFIG=fault logs.

Proton versions