experimental_11.0 (experimental-11.0-20260903b) and bleeding edge. dlls/xinput1_3/main.c:863 (xinput1_4 merges this code):

ret = get_current_state(index, state) ? ERROR_SUCCESS : ERROR_DEVICE_NOT_CONNECTED;
if (ret == ERROR_SUCCESS) goto done;
sgi = getenv("SteamGameId");
if (!strcmp(sgi, "298110")) goto done;

The getenv result goes straight to strcmp without a NULL check. With SteamGameId unset, XInputGetState dereferences NULL and the process exits with EXCEPTION_ACCESS_VIOLATION reading address 0x0.

Seen with Subliminal (appid 2300840, UE 5.7.4) on experimental-11.0-20260903b. Crash log callstack:

Unhandled Exception: EXCEPTION_ACCESS_VIOLATION reading address 0x0000000000000000

ucrtbase.dll!strcmp()
XINPUT1_4.dll!0x180005f7d()
XINPUT1_4.dll!0x180020d0()
Subliminal-Win64-Shipping.exe

Disassembly at xinput1_4+0x5f60 confirms the sequence: load "SteamGameId", call getenv, load "298110" into rdx, pass the (NULL) getenv result in rcx, call strcmp:

lea    0x2f6d(%rip),%rcx   # 180008ed4 -> "SteamGameId"
call   *0x9623(%rip)       # getenv
lea    0x2f6c(%rip),%rdx   # 180008ee0 -> "298110"
mov    %rax,%rcx
call   *0x9643(%rip)       # strcmp

Repro: any game that calls XInputGetState, run through proton run with STEAM_COMPAT_CLIENT_INSTALL_PATH / STEAM_COMPAT_DATA_PATH set and SteamGameId not exported. Also reproduced with steam steam://rungameid/2300840, which apparently doesn't export it either. Normal Steam library launches set the variable and don't hit this. The hack is absent from proton_11.0, so stable releases are unaffected.

Every other getenv("SteamGameId") call site I checked (d3d8, d2d1, ddraw, gdiplus, ieframe, metahost, mshtml, quartz, rsaenh, wgl) is guarded; this is the only one without the check. Same class as #228, the identical missing NULL check in opengl32.

Patch:

sgi = getenv("SteamGameId");
if (sgi && !strcmp(sgi, "298110")) goto done;

Workaround until then: export SteamGameId= before launching.