[Linux] SIGSEGV inside exit() during service shutdown, IP == fault address (Hyprland/NVIDIA)

Nobody has claimed this yet.

### Is there an existing issue for this?

- [x] I have searched the existing issues (closest match: #5378, "SIGSEGV on client disconnect" — same fault signature class, different code path and already fixed for that path)

### Is your issue described in the documentation?

- [x] I have read the documentation

### Is your issue present in the latest beta/pre-release?

Unknown / not tested. Installed release is the "Latest" stable tag `v2026.516.143833` (2026-05-16, Arch package build date 2026-08-13, installed 2026-08-28). The repo's most recent pre-releases (`v2026.830.223700`, `v2026.830.165455`) are ~3.5 months newer and postdate the fix for #5378 (nightly `2026.713.170739`), so this may already be resolved upstream — flagging that gap rather than assuming a fresh bug.

### Describe the Bug

`sunshine` segfaults with SIGSEGV while the process is inside `exit()` (i.e. after its own main loop has already exited cleanly), not during active streaming. Fault address equals the instruction pointer and resolves to no mapped module — same signature class as #5378 ("instruction pointer equal to the faulting address", consistent with a jump through a dangling/stale function pointer), but here the crash lands in the exit-time cleanup path (`__run_exit_handlers` → `exit()`) rather than in the RTSP disconnect handler.

Timeline (systemd/journal, all times local):
```
20:08:44 client sends GET /unpair (Moonlight, macOS client "roth")
20:08:57.944819 systemd: Stopping Self-hosted game stream host for Moonlight...
20:08:57.944 sunshine: Info: Terminate handler called
20:08:57.946 sunshine: Info: Main loop has exited
20:08:58.084631 kernel: sunshine[108442]: segfault at 7fcfc40000c8 ip 00007fcfc40000c8 sp 00007ffcb348fcc8 error 15 likely on CPU 3 (core 3, socket 0)
```
No `systemctl stop` invocation appears in the journal around the stop request — the terminate signal's origin wasn't captured (only that libwrap-visible systemd unit transition + Sunshine's own terminate-handler log line, effectively simultaneous).

At the moment of the crash, a worker thread was blocked inside `libcuda.so.1` (`poll()`), i.e. a CUDA/NVENC context was still live — consistent with an encoder/GPU-resource destructor running in the wrong order during shutdown.

`coredumpctl info` backtrace (crashing thread; full output with all 8 threads available on request):
```
Stack trace of thread 108442:
#0 0x00007fcfc40000c8 n/a (n/a + 0x0)
#1 0x00005605a664df84 n/a (sunshine + 0x103f84)
#2 0x00005605a6610a96 n/a (sunshine + 0xc6a96)
#3 0x00005605a660cffa n/a (sunshine + 0xc2ffa)
#4 0x00005605a6620ea6 n/a (sunshine + 0xd6ea6)
#5 0x00005605a6610a96 n/a (sunshine + 0xc6a96)
#6 0x00005605a6647735 n/a (sunshine + 0xfd735)
#7 0x00005605a6610a96 n/a (sunshine + 0xc6a96)
#8 0x00005605a66f7dbf n/a (sunshine + 0x1addbf)
#9 0x00007fd01b640fbf n/a (libc.so.6 + 0x40fbf)
#10 0x00007fd01b64109e exit (libc.so.6 + 0x4109e)
#11 0x00007fd01b627788 n/a (libc.so.6 + 0x27788)
#12 0x00007fd01b6278b9 __libc_start_main (libc.so.6 + 0x278b9)
#13 0x00005605a6603b75 n/a (sunshine + 0xb9b75)
```
No debug symbols were available for this build (not on debuginfod.archlinux.org — this is an Arch/Omarchy community package build, not upstream-provided debuginfo), so the `sunshine + 0x...` offsets are unresolved. Happy to provide the raw (root-owned) coredump if it's useful for offline symbolization against this exact build (BuildID `ce1214ae1aaa2e5873a39a5359b9fdba3be96b5f`).

This is not an isolated one-off on this machine: `coredumpctl list sunshine` shows 6 crashes across 3 days since installing the package, in at least two distinct failure modes — this exit-time SIGSEGV (twice, back-to-back with a SIGABRT at shutdown ~3 min earlier the same evening), three SIGSEGVs within a 10-minute window on the day of install, and separately a SIGABRT (`SI_TKILL`) during startup inside `gtk_init_check` → `wl_display_roundtrip_queue`, unrelated to this report.

No user data loss (streaming host, no persisted user documents); `Restart=on-failure` (5s) on the systemd unit masks the outage in most cases.

### Expected Behavior

Sunshine should tear down GPU/encoder resources and any other static state during shutdown without segfaulting, regardless of whether shutdown was triggered by a config change (pairing/unpairing), signal, or normal exit.

### Additional Information

_No response_

### Host Operating System

Arch Linux (Omarchy 4.0.1), kernel 7.1.9-arch1-2

### Sunshine commit/version

v2026.516.143833 (Arch package `sunshine 2026.516.143833-4`, build date 2026-08-13)

### Capture method

wlgrab (Wayland), Hyprland 0.56.2

### GPU Type

Nvidia

### GPU Model

NVIDIA GeForce RTX 3060 Ti

### GPU driver/mesa version

610.57.04

### Config

_No response_

### Apps.json

_No response_

### Relevant log output

```
Aug 28 20:08:58.084631 NXHome kernel: sunshine[108442]: segfault at 7fcfc40000c8 ip 00007fcfc40000c8 sp 00007ffcb348fcc8 error 15 likely on CPU 3 (core 3, socket 0)
Aug 28 20:08:58.086214 NXHome systemd-coredump[334111]: Process 108442 (sunshine) of user 1000 terminated abnormally with signal 11/SEGV, processing...
Aug 28 20:08:58.974857 NXHome systemd[1642]: app-dev.lizardbyte.app.Sunshine.service: Main process exited, code=dumped, status=11/SEGV
Aug 28 20:08:58.974953 NXHome systemd[1642]: app-dev.lizardbyte.app.Sunshine.service: Failed with result 'core-dump'.
```

No source file or test is identified in the report. Start by reproducing the shutdown crash on the listed Arch Linux, Hyprland, NVIDIA, and Sunshine versions, then inspect the coredump and shutdown path around the terminate handler, main-loop exit, and exit-time cleanup. Done means identifying the failing cleanup sequence and confirming repeated shutdowns no longer crash.

Written by the indexing model from the issue text.