Crash: SIGSEGV in SpliceKitPlayheadOverlayTarget tick: during timeline playback

Environment
SpliceKit version: 3.3.8
Final Cut Pro version: 12.3 (build 450152)
macOS: 15.7.9 (24G830)
Mac model: iMacPro1,1 (x86_64)
Code signing: ad-hoc
Reproduction
Launch the SpliceKit-patched Final Cut Pro
Open a project/timeline
Start playback
App crashes reliably during playback (reproduced twice within the same session, ~7 minutes apart, identical fault signature both times)
Crash signature
Exception Type: EXC_BAD_ACCESS (SIGSEGV)
Exception Subtype: KERN_INVALID_ADDRESS at 0x0000697461636f80
Faulting Thread: 0 (com.apple.main-thread)
Identical fault address (0x697461636f80) in both crash reports — this is a deterministic/reproducible bug, not a one-off memory corruption.

Backtrace (top of faulting thread)
0 libobjc.A.dylib objc_msgSend_stret
1 SpliceKit PO_xForTime (+166)
2 SpliceKit -[SpliceKitPlayheadOverlayTarget tick:] (+438)
3 AppKit -[_NSDisplayLinkForwarder displayLinkDidFire:]
4 QuartzCore CA::Display::DisplayLinkItem::dispatch_(...)
5 QuartzCore CA::Display::DisplayLink::dispatch_items(...)
6 QuartzCore display_timer_callback(...)
7 CoreFoundation __CFMachPortPerform
8 CoreFoundation __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE1_PERFORM_FUNCTION__
9 CoreFoundation __CFRunLoopDoSource1
10 CoreFoundation __CFRunLoopRun
11 CoreFoundation CFRunLoopRunSpecific
12 HIToolbox RunCurrentEventLoopInMode
13 HIToolbox ReceiveNextEventCommon
14 HIToolbox _BlockUntilNextEventMatchingListInModeWithFilter
15 AppKit _DPSNextEvent
16 AppKit -[NSApplication(NSEventRouting) _nextEventMatchingEventMask:untilDate:inMode:dequeue:]
17 AppKit -[NSApplication run]
18 LunaKit LKApplicationMain
19 Final Cut Pro main
20 dyld start
Analysis
The playhead-overlay tick handler is driven by CVDisplayLink/CADisplayLink and fires on every screen refresh during playback. SpliceKitPlayheadOverlayTarget tick: calls into PO_xForTime, which sends an Objective-C message (objc_msgSend_stret, i.e. a struct-returning method) to a pointer that is no longer valid, producing KERN_INVALID_ADDRESS. This points to a dangling/deallocated object reference being captured or cached by the overlay target and reused across display-link ticks without revalidation — most likely an FCP-internal timeline/playhead time-conversion object that gets released (e.g. on project/sequence reload) while the display link keeps firing against the stale pointer.

Attached files
Final Cut Pro-2026-08-17-173031.ips
Final Cut Pro-2026-08-17-172352.ips (both in ~/Library/Logs/DiagnosticReports/)

[ips files.zip](https://github.com/user-attachments/files/31135371/ips.files.zip)

Start with the attached .ips crash reports and inspect the implementations of PO_xForTime and -[SpliceKitPlayheadOverlayTarget tick:], which appear at the top of the faulting thread. Reproduce timeline playback and check the display-link callback's object lifetime across repeated ticks. Done means playback no longer reaches objc_msgSend_stret with the invalid address or crashes reproducibly.

Written by the indexing model from the issue text.