protonscr

God of War Ragnarök - 10 FPS drops caused by unchecked NULL pointer dereference in win32u/rawinput.c (NtUserGetRawInputData) with 1000 Hz mice

protonclosed appid 2322010
ValveSoftware/Proton#10148 · opened 2026-09-16 by arthuralvesdev · updated 2026-09-16 · 2 comments · github · game page · search this game
Aarthuralvesdev 2026-09-16 github

Compatibility Report

  • Name of the game with compatibility issues: God of War Ragnarök
  • Steam AppID of the game: 2322010

System Information

  • GPU: NVIDIA GeForce RTX 4070 (12GB)
  • Video driver version: NVIDIA 615.71.09
  • Kernel version: 7.2.5-1-cachyos
  • Proton version: Proton-CachyOS / Proton Experimental (Wine 11.0)

I confirm:

  • [x] that I haven't found an existing compatibility report for this game.
  • [x] that I have checked whether there are updates for my system available.

Symptoms

In God of War Ragnarök, the framerate intermittently collapses from 60 FPS down to a locked ~10 FPS for several seconds or minutes during gameplay.

The drop occurs whenever a 1000 Hz gaming mouse (e.g. Logitech G403 HERO) is moved. Analysis of Proton debug logs (steam-2322010.log) and disassembly of GoWR.exe and Wine's win32u.so revealed an unchecked NULL pointer dereference inside Wine's NtUserGetRawInputData (dlls/win32u/rawinput.c line 533), which triggers up to 1,000 hardware Page Faults / SIGSEGV exceptions (0xc0000005) per second on the window thread (DxWindowThread).

Technical Root Cause:

  1. Game Side (GoWR.exe RVA 0xeb81c3):
    When handling window message 0x00FF (WM_INPUT), the game queries RID_HEADER passing pcbSize = NULL:
140eb81c6: mov DWORD PTR [rsp+0x20], 0x18  ; cbSizeHeader = 24 bytes (sizeof(RAWINPUTHEADER))
140eb81ce: xor r9d, r9d                    ; pcbSize = NULL (0x0)
140eb81d1: lea r8, [rbp-0x21]              ; pData = &header
140eb81d5: mov edx, 0x10000005             ; uiCommand = RID_HEADER
140eb81da: mov rcx, rdi                    ; hRawInput
140eb81e9: call GetRawInputData            ; GetRawInputData(hRawInput, RID_HEADER, &header, NULL, 24)

On native Windows, passing pcbSize == NULL when pData != NULL and uiCommand == RID_HEADER succeeds without crashing because the header size is static (24 bytes).

  1. Wine Side (dlls/win32u/rawinput.c line 533):
    In Wine's NtUserGetRawInputData:
    if (!data)
    {
        *data_size = sizeof(RAWINPUTHEADER) + size;
        return 0;
    }

    /* LINE 533: UNCHECKED DEREFERENCE */
    if (*data_size < sizeof(RAWINPUTHEADER) + size)
    {
        RtlSetLastWin32Error( ERROR_INSUFFICIENT_BUFFER );
        return -1;
    }

Wine does not check if data_size is NULL before dereferencing *data_size (mov (%r15), %esi in assembly). Because data_size is NULL, this triggers a hardware Page Fault (#PF) / SIGSEGV inside the syscall dispatcher:

trace:seh:handle_syscall_fault code=c0000005 addr=0x7f294fd3d92c ip=7f294fd3d92c tid=02c8
warn:seh:handle_syscall_fault backtrace: --- Exception 0xc0000005 at win32u.so (NtUserGetRawInputData + 0x8c)
returning to user mode ip=00006fffff374114 ret=c0000005
  1. Performance Impact:
    At 1000 Hz, mouse movement generates up to 1,000 WM_INPUT messages per second. Each one causes a kernel signal roundtrip, DWARF stack unwinding, and SEH exception dispatch. In my log, over 8,394 hardware exceptions were recorded (peaking at 700–906 faults/sec on DxWindowThread), starving the game engine and pinning the framerate to 10 FPS.

Proposed Fix:

In dlls/win32u/rawinput.c:

--- a/dlls/win32u/rawinput.c
+++ b/dlls/win32u/rawinput.c
@@ -530,7 +530,7 @@ UINT WINAPI NtUserGetRawInputData( HRAWINPUT handle, UINT command, void *data, U
         return 0;
     }
 
-    if (*data_size < sizeof(RAWINPUTHEADER) + size)
+    if (data_size && *data_size < sizeof(RAWINPUTHEADER) + size)
     {
         RtlSetLastWin32Error( ERROR_INSUFFICIENT_BUFFER );
         return -1;

Reproduction

  1. Launch God of War Ragnarök on Proton using a mouse configured to a 1000 Hz polling rate (e.g. Logitech G403 HERO).
  2. Move the mouse continuously during 3D gameplay (camera rotation).
  3. Observe the framerate drop to 10 FPS and thousands of handle_syscall_fault (0xc0000005) in win32u.so in the Proton log.

steam-2322010.zip

Kkisak-valve maintainer 2026-09-16 github

Hello @arthuralvesdev, we're using one issue report per unofficially supported game title, and usually I'd transfer this issue report to #8107, however, this is very specific feedback for wine that should be reproduced with vanilla wine, reported, and evaluated upstream.

https://gitlab.winehq.org/wine/wine/-/wikis/Developer-FAQ#can-i-contribute-code-generated-by-a-large-language-model-llm-tool is also relevant as a secondary detail.

Aarthuralvesdev 2026-09-16 github

Ok, thanks

Related threads

Proton versions

Error codes