Permitting device loss due to improper external synchronization is (or at least seems) too restrictive

The Vulkan specification states that improper external synchronization may cause device loss. For semaphores:

• Losing the logical device on which the violation occurred immediately or at a future time, resulting in a VK_ERROR_DEVICE_LOST error from subsequent commands, including the one causing the violation.

For fences:

• In the preceding cases, any of the devices associated with the fences sharing the payload may be lost, or any of the queue submission or fence reset commands may return VK_ERROR_INITIALIZATION_FAILED

While VK_ERROR_DEVICE_LOST is not a fatal error, it is nevertheless quite disruptive. An untrusted program (such as a guest virtual machine or a sandboxed application) being able to cause VK_ERROR_DEVICE_LOST is therefore not desireable. If it happened repeatedly, it could effectively cause denial of service to the importing application, such as a Wayland compositor. Therefore, it would be preferable to provide stronger guarantees here.

Due to hardware or firmware limitations, some implementations may not be able to prevent faults in one application from causing device loss in another. This is out of scope for this issue.