Confirmed on all WoW64 Proton builds tested:
Non-WoW64 builds (GE-Proton) bypass this but hit a separate winegstreamer stub crash instead.
The consistent register signature across all builds: EIP at RWX page +7, EAX=base, EDX=8, ECX=E9000001, CS=0023.
Hello @gmpakpak12, we're using one issue report per unofficially supported game title, so I've gone ahead and transferred this issue report to https://github.com/ValveSoftware/Proton/issues/9861#issuecomment-4643207734.
ge-proton10-34x1 2026-06proton experimentalx1 2026-060xc0000005x1 2026-06
Compatibility Report
System
Description
The game worked on Proton before a recent client update. The update changed Xtrap/Aegis AC's injected shellcode — it now issues raw int 2Eh (CD 2E) syscalls from a 32-bit RWX page instead of using the standard ntdll WoW64 transition. Under WoW64, int 2Eh is a privileged instruction → #GP → SIGSEGV → EXCEPTION_ACCESS_VIOLATION → crash.
Log excerpt
05b4:warn:seh:dispatch_exception: --- Exception 0xc0000005 addr=008D0007 EAX=008D0000 EDX=00000008 ECX=E9000001 CS=0023EDX=8 (syscall number), ECX=E9000001 (argument), CS=0023 (32-bit compat). The shellcode base varies (008D0000, 00260000) but the pattern is identical.
Additional info
The same shellcode also crashes on native Windows during server switches and session state changes (lock, UAC), confirming it's a buggy AC update that WoW64 exposes 100% of the time.
Attached: proton_log_crash_chain.txt (crash trace including the int 2Eh dispatch)