[Crash] macOS 27 SFM v1.14.0 未知崩溃日志

Operating system

macOS

System version

macOS 27.0（Build 26A5425a）

Installation type

sing-box for macOS Graphical Client

If you are using a graphical client, please provide the version of the client.

macOS sing-box SFM 版本1.14.0（1)

Version

macOS 27.0（Build 26A5425a）
Mac mini（Mac16,10）
32 GB
Apple M4

sing-box v1.14.0
SFM 版本1.14.0

Description

Log

Crash Report.md
Go Crash Log.md

Metadata

crashedAt	2026-09-04T00:16:07Z
goVersion	go1.26.7, darwin/arm64
processPath	/Library/SystemExtensions/FC765801-2396-495A-B603-1776336EFA5A/io.nekohasekai.sfmt.system.systemextension/Contents/MacOS/io.nekohasekai.sfmt.system
bundleIdentifier	io.nekohasekai.sfmt.system
coreVersion	1.14.0
appMarketingVersion	1.14.0
appVersion	1
exceptionName	panic
signalName	SIGABRT
startedAt	2026-09-02T02:35:18Z
processName	io.nekohasekai.s
exceptionReason	runtime error: slice bounds out of range [:4044] with capacity 2028
signalCode	#0
source	NetworkExtension

Reproduction

在SFM客户端发现的，具体当时的崩溃场景和操作步骤没有

Logs

Supporter

• I am a sponsor

Integrity requirements

• I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
• I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
• I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
• I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.

Start by reading the linked Crash Report.md and Go Crash Log.md, focusing on the panic location for the slice-bounds error in the macOS NetworkExtension process. Trace that location into the relevant Go entry point and determine whether the reports provide a reproducible input or scenario. Done means the crash cause is identified and a regression test or confirmed fix covers it.