Proton Experimental: wine64-preloader child killed by SIGSYS (SYS_SECCOMP on arch_prctl)

protonclosed

ValveSoftware/Proton#10155 · opened 2026-09-17 by luizguimaraes · updated 2026-09-17 · 2 comments · github

Lluizguimaraes 2026-09-17 github

System information

Proton version: experimental-11.0-20260910b
OS: Omarchy 4.0.4-1 (Arch-based), kernel 7.2.5-3-omarchy
GPU: AMD Radeon RX 7700 XT / 7800 XT (Navi 32), Mesa
Game: Cyberpunk 2077 (appID 1091500)

Description

A wine64-preloader child process is killed by SIGSYS during the game's
prefix startup. systemd-coredump records:

PID: 248525 (wine64-preloade)
Signal: 31 (SYS) si_code: SYS_SECCOMP
Command Line: wine64-preloader wine64 C:\windows\system32\explorer.exe /desktop
Executable: .../Proton - Experimental/files/lib/wine/i386-unix/wine64-preloader

From the core:

si_signo = 31, si_code = 1 (SYS_SECCOMP)
si_syscall = 158, si_arch = 0xC000003E (AUDIT_ARCH_X86_64)
rax=158  rdi=0x1002   (arch_prctl, ARCH_SET_FS)
rip = wine64-preloader _start+38
#0  _start (+0x1026)

Syscall 158 on x86-64 is arch_prctl; rdi 0x1002 is ARCH_SET_FS (early
libc TLS setup). A seccomp filter is therefore already present in the
freshly exec'd preloader and traps its first TLS syscall, before Wine
installs a SIGSYS handler.

The filter appears to be Proton's own seccomp syscall-emulation filter:
files/lib/wine/x86_64-unix/ntdll.so contains the strings
"Installing seccomp filters.", "Seccomp filters already installed.",
"Native libs are being loaded in low addresses ... not installing seccomp.",
and "prctl(PR_SET_SECCOMP, ...)". Because seccomp filters survive fork/exec,
a child wine64-preloader inherits the parent's filter with no handler yet.

Context

This occurred during a Steam Remote Play session streaming this host to a
Steam Deck (streaming_log.txt: "Streaming started to steamdeck" at
19:20:39; the client GPU is reported as "AMD Custom GPU 0405 (radeonsi,
vangogh)"). The crash was at 19:33:03, mid-session. I am not claiming Remote
Play caused it — the seccomp filter is local to the host — but it is the
context in which it happened.

Steps to reproduce

Launch Cyberpunk 2077 with Proton Experimental, including over Steam
Remote Play from a Steam Deck.
Observe coredumpctl list showing a SIGSYS core for wine64-preloader.

Expected behavior

No core dump from the Wine bootstrap process.

Notes

/proc/sys/vm/legacy_va_layout is 0 and ulimit -s is 8192, so the
"native libs in low addresses, not installing seccomp" branch is not taken.
Core is only ~13.6K; Proton produced no crash report in
/tmp/proton_crashreports.
This may be an expected/internal helper crash; filing for confirmation
whether the inherited-filter path is supposed to handle this child.

Lluizguimaraes 2026-09-17 github

Full systemd-coredump record and core inspection for the report above, as plain text (the raw core is a copy of process memory, so I'd rather not publish it; happy to arrange a private transfer if it's useful).

coredumpctl info 248525:

           PID: 248525 (wine64-preloade)
           TID: 248525 (wine64-preloade)
           UID: 1000 (cazeh)
           GID: 1000 (cazeh)
        Signal: 31 (SYS) si_code: SYS_SECCOMP
     Timestamp: Thu 2026-09-17 19:33:03 -03
  Command Line: $'.../Proton - Experimental/files/lib/wine/i386-unix/wine64-preloader' $'.../Proton - Experimental/files/lib/wine/i386-unix/wine64' $'C:\\windows\\system32\\explorer.exe' /desktop
    Executable: .../Proton - Experimental/files/lib/wine/i386-unix/wine64-preloader
 Control Group: /user.slice/user-1000.slice/[email protected]/app.slice/app-graphical.slice/app-Hyprland-gtk\x2dlaunch-3ffb1671.scope
          Unit: [email protected]
     User Unit: app-Hyprland-gtk\x2dlaunch-3ffb1671.scope
       Boot ID: 109394b2537d4c35acab511c5918bea2
      Storage: /var/lib/systemd/coredump/core.wine64-preloade.1000.109394b2537d4c35acab511c5918bea2.248525.1789684383000000.zst (present)
  Size on Disk: 13.6K
       Message: Process 248525 (wine64-preloade) of user 1000 dumped core.

                Stack trace of thread 248525:
                #0  0x00006ffda1e7e026 _start (.../wine64-preloader + 0x1026)
                ELF object binary architecture: AMD x86-64

gdb -q <preloader> <core> (registers and $_siginfo):

Program terminated with signal SIGSYS, Bad system call.
#0  0x00006ffda1e7e026 in _start ()

$1 = {si_signo = 31, si_errno = 0, si_code = 1, _sifields = {
      _sigsys = {_call_addr = 0x6ffda1e7e026 <_start+38>, _syscall = 158, _arch = 3221225534}}}

rax            0x9e                158
rbx            0x0                 0
rcx            0x6ffda1e7e026      123135133736998
rdx            0x0                 0
rsi            0x6ffda1e820a0      123135133753504
rdi            0x1002              4098
rbp            0x0                 0x0
rsp            0x7fff39b093e0      0x7fff39b093e0
r8             0x0                 0
r9             0x0                 0
r10            0x0                 0
r11            0x202               514
r12            0x0                 0
r13            0x0                 0
r14            0x0                 0
r15            0x0                 0
rip            0x6ffda1e7e026      0x6ffda1e7e026 <_start+38>
eflags         0x202               [ IF ]
cs             0x33                51
ss             0x2b                43
fs_base        0x0                 0
gs_base        0x0                 0

#0  0x00006ffda1e7e026 in _start ()
No shared libraries loaded at this time.

Notes:

si_code = 1 is SYS_SECCOMP; _syscall = 158 is arch_prctl; rdi = 0x1002 is ARCH_SET_FS.
The core has no shared libraries loaded (the preloader is the very first image), so there is no further stack to symbolize beyond _start.

Kkisak-valve maintainer 2026-09-17 github

Hello @luizguimaraes, we're using one issue report per unofficially supported game title, and usually I'd transfer this issue report to #4450, however, you've chosen to predigest your own feedback into unusable noise. There's nothing here for a Proton dev to productively ponder.

Feel free to add a comment describing your symptoms and a Proton log to the pre-existing compatibility report.

Closing as invalid.