Describe the bug

The native Linux build of Half-Life: Alyx crashes during the train ride on a2_pistol (Chapter 2, right after getting the pistol and dropping into the train). The game hits a fatal assertion in its entity serialization code on a GlobPool worker thread, then deliberately crashes itself.

It is deterministic. Two crashes nine days apart, both restored from the same autosave, fail on the exact same bit offset:

../public/networksystem/serializedentity.h (797) : Assertion Failed in function GetBitRange():
*pEnd > *pStart
GetBitRange( 6661 -> 6661 ) end is before or same as start

Stack of the crashing thread (identical offsets in both cores):

Signal: 11 (SEGV) si_code: SEGV_MAPERR   thread: GlobPool5
#0  libtier0.so + 0x4aa9b                 <- intentional write to 0x0 after fatal assert
#1  libtier0.so + 0x4bc18
#2  LoggingSystem_Log (libtier0.so + 0x4bd7b)
#3  AssertMsg_ConditionFailed (libtier0.so + 0x38b27)
#4  libnetworksystem.so + 0x16d392
#5  libengine2.so + 0x42b919
#6  libengine2.so + 0x42cf0c
#7  libvstdlib.so + 0x32a60
#8  libvstdlib.so + 0x330ef
#9  CThread::ThreadProc (libtier0.so + 0x64d8c)

Game console just before the assert (game build 10919, map a2_pistol). The player position is moving steadily, so the train is running:

763(139.833397):  ET:  Restoring game at 1829 0:30:29 : '#HLVR_Chapter_Number_01 #HLVR_Chapter_Title_01 ...'
827(145.261290):  Map: "a2_pistol"
829(145.261292):  Build: 10919 (revision 10919)
...
1015(177.490523):  Attempted to find unknown particle system "bloodspray"
1016(177.660280):  Failed to allocate space for morph!
...
1048(214.250343):  Fog Clipmaps - too many lights (54 - max: 32) 820 units centered on (setpos -639 891 587) ...
1062(238.468814):  Fog Clipmaps - too many lights (52 - max: 32) 820 units centered on (setpos -659 889 575) ...
1063(238.478966):  ../public/networksystem/serializedentity.h (797) : Assertion Failed in function GetBitRange():

Crash report auto-uploaded by Steam for the 2026-10-04 crash: bp-cc7e0e00-136d-4aa2-85d3-bb30b2261003

Not the filesystem. A comment in #965 reports this same GetBitRange assertion and attributes it to the Steam library being on an NTFS (ntfs3) partition. Here the game is installed on btrfs (compress=zstd:3) on the home subvolume, so NTFS is not required to trigger it.

Not the stream. I'm streaming to a Steam Frame over vrlink, and that session did show the stream reset storm and videovulkan.cpp:1641 assert from #965 while the level was loading. But the game kept running normally for about a minute afterwards, and the headset only went inactive after the game had frozen on the assert. Memory, swap and the GPU driver logged no errors.

To Reproduce

1. Native Linux build, Vulkan (-vr -steam -noasserts -nopassiveasserts +map startup -vulkan).
2. Play to the Chapter 2 autosave at 0:30:29 (just after getting the pistol), or load it.
3. Drop into the train and ride it.
4. Within a minute or two the game freezes and then crashes with the assertion above.

Expected behavior
The train ride completes and the level continues.

System Information

• Steam client version: 1790904859 (publicbeta)
• SteamVR version: 2.18.2 beta (build 25664061, version.txt 1790893534)
• Distribution: Omarchy (Arch Linux based), kernel 7.2.5, Hyprland 0.56.2 (Wayland)
• GPU / driver: NVIDIA GeForce RTX 4080, NVIDIA open kernel module 610.57.04
• CPU / RAM: AMD Ryzen 7 5800X, 62 GiB
• Headset: Steam Frame ("Deckard MP") via vrlink, 90 Hz
• Game: Half-Life: Alyx native Linux, depot build 25487405, engine build 10919, no addons

Additional context

• An older crash from the same save on 2026-09-25 20:24 was a different SIGSEGV in libscenesystem.so on a worker thread, matching the "native build instability" note in #965.
• Related: #405 and #801 (crashes at the Quarantine Zone train / level transitions), and Steam forum thread https://steamcommunity.com/app/546560/discussions/0/596289845780986981/ (several distros crash entering this train). Those mostly show SteamVR itself dying; this report is the game-side assertion.
• Core dumps and the minidump are available on request.