Describe the bug

Since SteamVR auto-updated to 2.17.9 (build 25216780) on 2026-09-10, vrcompositor segfaults on
its RenderThread while Half-Life: Alyx is loading a level. It happened three times on 2026-09-11 with
a byte-identical stack:

Kernel line (identical each time apart from PIDs):

RenderThread[40955]: segfault at 108 ip 00007f5229539acd sp 00007f5210172bc0 error 4 in libnvidia-glcore.so.595.99.02[d39acd,7f5228c00000+c00000]

Stack from systemd-coredump (no symbols for vrcompositor):

#0  libnvidia-glcore.so.595.99.02 + 0xd39acd
#1  vrcompositor + 0x409820
#2  vrcompositor + 0x1b9aef
#3  vrcompositor + 0x1ba43e
#4  vrcompositor + 0x1be409
#5  vrcompositor + 0x27b09e
#6  vrcompositor + 0x281671
#7  vrcompositor + 0x283798
#8  vrcompositor + 0x2b9662
#9  libc.so.6 + 0x9eece   (start_thread)

At the faulting instruction the driver executes mov 0x108(%rbx),%r8 with rbx = 0, right after
walking a pNext chain that contains sType 1000138002
(VK_STRUCTURE_TYPE_WRITE_DESCRIPTOR_SET_INLINE_UNIFORM_BLOCK). So it looks like a
vkUpdateDescriptorSets call against a null or already-destroyed object; the NVIDIA driver does
not validate and dereferences it.

What I have ruled out:

• VRAM pressure: 636 MiB of 16 GiB in use before the 21:06 crash, nothing else on the GPU.
• GPU health: no Xid errors in the kernel log all day; the compositor's startup GPU benchmark
  reported 3125 (normal for this card).
• The Alyx loading-screen dioramas workaround from #784: the models/ui/dioramas folder was
  renamed away before the 21:06 crash, so it is not that.
• The same driver (595.99.02) ran Alyx for 38 minutes on SteamVR 2.16.7 on 2026-09-03 without
  incident. I have now switched to the previous branch (2.16.7, build 23791826) to re-test.
  TODO: state how long 2.16.7 has run cleanly since the switch.
• Differs from alvr-org/ALVR#3230 (that one faults through r15 at +0x10 in the distortion pass,
  every time the headset connects; this one is rbx at +0x108, only at Alyx level loads).

Other SteamVR games did not trigger it (Eleven Table Tennis ran 6 minutes immediately before the
21:06 Alyx launch in the same SteamVR session).

To Reproduce

1. SteamVR 2.17.9 on the setup below, Valve Index on DisplayPort.
2. Launch Half-Life: Alyx and load a save, or play until a level transition.
3. vrcompositor dies on RenderThread; SteamVR either auto-restarts the compositor (error -203) or
   vrserver goes to standby with hlvr left running.

Expected behavior

Level loads complete without the compositor crashing, as on 2.16.7.

System Information (please complete the following information):

• Steam client version (build number or date): 1788652215 (2026-09-04)
• SteamVR version: 2.17.9 (build 25216780, installed 2026-09-10). Crash-free so far on previous = 2.16.7 (build 23791826). TODO: also say whether beta reproduces it if you test that.
• Distribution (e.g. Ubuntu): openSUSE Tumbleweed, kernel 7.2.3-1-default, KDE Plasma on X11
• GPU / driver: NVIDIA GeForce RTX 5070 Ti, driver 595.99.02, Vulkan 1.4.329; CPU Ryzen 7 9800X3D; 32 GB RAM; glibc 2.44
• HMD: Valve Index on DP-2, 2880x1600, 120 Hz
• Steam runtime diagnostics: attached (Steam → Help → Steam Runtime Diagnostics)
• Steam and SteamVR logs: attached steam-logs.tar.gz
• Minidumps: attached steam-minidumps.tar.gz. The compositor's own reporter also uploaded
  crash_20260911210624_2.dmp and crash_20260911145239_2.dmp at crash time.

Additional context

Full systemd core files for all three crashes (36–65 MB each) are available on request.
The steamwebhelper SIGABRTs visible in the minidump set (16:08, 21:05) and the vrcompositor
main-thread crash at 16:13 are separate: the latter happens during SteamVR shutdown and looks like
#921.

steam-logs.tar.gz
steam-minidumps.tar.gz
steam-system-runtime-information-20260911.txt