King's Bounty: Warriors of the North (203350) 32-bit — EXCEPTION_ACCESS_VIOLATION (NULL deref) inside DXVK d3d9.dll after ~1.7 h; plus 32-bit address-space exhaustion crash

Summary

Two distinct crash modes in this 32-bit D3D9 game under Proton Experimental:

1. Address-space exhaustion (game-side, ~4.5 h session) — SIGSEGV/SEGV_ACCERR; fixed locally via game.ini (streaming 1, shadowresolution 1024, r_fsaa 0).
2. NULL-object dereference inside DXVK 32-bit d3d9.dll (~1 h 42 min session) — EXCEPTION_ACCESS_VIOLATION 0xc0000005, read of 0x4, instruction movl 4(%ecx),%eax at ecx=0, fault at RVA 0x466833, entered through a device method (RVA 0xb0914), caller KBWotN.exe RVA 0x2be1e0. Captured in a PROTON_LOG=1 / WINEDEBUG=+seh log with winedbg backtrace.

The DXVK-side NULL deref has not recurred since updating from DXVK v3.1.1-21 to v3.1.1-27 (Proton Experimental 20260924): ~10 h / 9 sessions. Statistical confirmation still pending.

Environment

• OS: EndeavourOS (Arch), kernel 7.2.7-zen1-1-zen
• GPU: AMD Cezanne iGPU (1002:1638), Mesa RADV 26.2.3 (Vulkan 1.4.354), 4 GB shared VRAM
• RAM: 20 GB, zram swap
• Proton: Experimental 11.0-20260917b (crash time) → 11.0-20260924 (current)
• DXVK: v3.1.1-21-7df3596eed49cb7 (crash) → v3.1.1-27-g25ca63f17f34bdc (current), 32-bit build
• API: D3D9 → DXVK → Vulkan/RADV

Crash A — 32-bit address-space exhaustion (2026-09-24 00:51, ~4.5 h session)

• signal 11 (SEGV), si_code SEGV_ACCERR, ~1.5 GB core (systemd-coredump).
• Guest ntdll.dll mapped at 0x7BF10000 — 32-bit user space exhausted "to the top"; SEH exception cascade in the engine (~40 nested frames).
• Render thread idling in vkWaitSemaphores; no amdgpu / GPU errors in kernel log → game-side memory issue, not driver.
• Cause: game defaults to streaming 0 (data/game.ini → setf ~streaming 0) and holds its whole content set in RAM (textures.kfs ~445 MB + animation.kfs ~210 MB + renderer copy). Crash ~2 s after an autosave.
• Workaround (works, survived game rewriting game.ini): ~streaming 0→1, ~shadowresolution 2048→1024, ~r_fsaa 1→0.

Crash B — NULL deref inside DXVK d3d9.dll (2026-09-25 19:34:17, ~1 h 42 min session)

Captured with PROTON_LOG=1 / WINEDEBUG=+seh. Backtrace from winedbg:

EXCEPTION_ACCESS_VIOLATION 0xc0000005, flags=0
eip 0x77C56833 = d3d9.dll +0x466833   ; DXVK 32-bit
instruction `movl 4(%ecx), %eax` with ecx=0  → read access to 0x00000004

Backtrace:
=>0  0x77c56833  d3d9 (+0x466833)   ; movl 4(%ecx),%eax  ← fault
   1  0x77874cf6  d3d9 (+0x84cf6)
   2  0x7788f60b  d3d9 (+0x9f60b)
   3  0x7782081a  d3d9 (+0x3081a)
   4  0x778a0914  d3d9 (+0xb0914)   ; IDirect3DDevice9 method entry
   5  0x006be1e0  kbwotn (+0x2be1e0)

Modules/threads in the dump confirm the renderer is DXVK (threads dxvk-cs, dxvk-queue, dxvk-frame, dxvk-shader-*; info: DXVK: v3.1.1-21 / info: Game: KBWotN.exe in the log).

After the fault the engine's own error path failed (managed .NET threw Win32Exception "invalid window handle" ×9), then winedbg tore the process down (~17 s later).

Hypotheses

• Game calls a D3D9 device method on a released/NULL object or
• DXVK returns NULL where native/wined3d returns a valid object (DeviceLost/Reset semantics, surface/state lifetime).

The same session settings had crash-mode A removed (streaming on), so memory pressure is not plausible here.

Notes

• DXVK state cache is not persisted: ~/.local/share/Steam/steamapps/shadercache/203350/ stays empty — shaders recompile every launch for this title. (Slower start only.)
• Full log (with winedbg backtrace) and analysis are archived; happy to attach / link on request.

Repro

1. Install under Steam Play → Proton Experimental.
2. Play ~1.5 h (longer sessions increase probability for both modes).
3. Lower repro probability on the current DXVK build — see status above.

Precise, trustworthy logs available on request (PROTON_LOG with backtrace, coredump analysis).