Crash on Netplay -> Host (Steam nightly, Windows): c0000005 at retroarch.exe+0x10728a

RetroArch Steam Nightly Crash on Netplay -> Host (Windows)

Summary

RetroArch crashes when creating a host session from UI netplay menu.

• RECONSTRUCTED: crash is reproducible on Steam build 1.22.2 (Git 70816e850a, build time 2026-01-24).
• RECONSTRUCTED: exception is always 0xc0000005 (access violation read).
• RECONSTRUCTED: current stable offset is retroarch.exe+0x10728a.
• RECONSTRUCTED: older run in previous build crashed at retroarch.exe+0x1057ba.

Environment

• OS: Windows 10 x64 (19045)
• Install: Steam (AppID 1118310)
• Binary: D:\SteamLibrary\steamapps\common\RetroArch\retroarch.exe
• Build info source: D:\SteamLibrary\steamapps\common\RetroArch\build.txt

Repro Steps

1. Launch RetroArch from Steam.
2. Load content/core as usual.
3. Open netplay menu and create host (Host from UI).
4. Observe immediate crash to desktop.

Expected

Host session should start and remain active.

Actual

RetroArch exits with APPCRASH.

Evidence

Windows Event Log (Application Error, Event ID 1000)

• 12 Feb 2026 22:33:12: ExceptionCode 0xc0000005, FaultOffset 0x000000000010728a
• 12 Feb 2026 22:23:51: ExceptionCode 0xc0000005, FaultOffset 0x000000000010728a
• 12 Feb 2026 22:22:22: ExceptionCode 0xc0000005, FaultOffset 0x000000000010728a
• 12 Feb 2026 22:20:05: ExceptionCode 0xc0000005, FaultOffset 0x000000000010728a

Source: Windows Application log, provider Application Error.

Crash Dumps

• %LOCALAPPDATA%\\CrashDumps\\retroarch.exe.19004.dmp
• %LOCALAPPDATA%\\CrashDumps\\retroarch.exe.22492.dmp
• %LOCALAPPDATA%\\CrashDumps\\retroarch.exe.2568.dmp

Dump Analysis (cdb, latest dump)

• RECONSTRUCTED: bucket INVALID_POINTER_READ_c0000005_retroarch.exe!Unknown
• RECONSTRUCTED: faulting instruction:
  • retroarch+0x10728a: movzx r9d, byte ptr [r8]
• RECONSTRUCTED: invalid read address: 0x000000000165d000
• RECONSTRUCTED: top stack frames:
  • retroarch+0x10728a
  • retroarch+0x39f38a
  • retroarch+0x327adf
  • retroarch+0x0f1d4
  • retroarch+0x2d1426
  • retroarch+0x121a9f

Additional Notes

• INFERRED: looks like invalid pointer/use-after-free class issue in RetroArch runtime path.
• SPECULATIVE: exact function/subsystem cannot be named without private symbols.
• RECONSTRUCTED: launching with CLI --host did not reproduce immediate crash in short automated test window; manual UI host still reproduces.

Attachments Recommended for Upstream Issue

1. Latest .dmp file (retroarch.exe.19004.dmp).
2. This report.
3. Optional verbose startup log:
   • D:\SteamLibrary\steamapps\common\RetroArch\logs\force_verbose.log

Local Commands Used

# Event log check
Get-WinEvent -LogName Application -MaxEvents 200 |
  ? { $_.Id -eq 1000 -and $_.ProviderName -eq 'Application Error' -and $_.Message -match 'retroarch.exe' }

# Dump analysis
C:\Temp\windbg_amd64\cdb.exe -z %LOCALAPPDATA%\\CrashDumps\\retroarch.exe.19004.dmp `
  -c ".symfix;.reload;!analyze -v;kb;lmvm retroarch;q"

Start by reproducing the crash through the UI netplay Host flow and inspect the supplied %LOCALAPPDATA%\CrashDumps\retroarch.exe.19004.dmp with the cdb command shown in the report. Compare the UI path with the non-reproducing CLI --host path; done means creating a host session no longer crashes and it remains active.