Onnx Runtime Model Dispose Crash When Multiple Models are Loaded

Observed that with the Microsoft.ML.OnnxRuntimeGenAI package version 0.9.0 (and other versions tested going back to 0.5.0), that we have a native OnnxRuntime crash that happens during the clean up of the models, when we’re loading a Phi 3.5 mini instruct model alongside a Qwen3-0.6B Model. This crash is 100% reproducible in the Onnx framework.

===

1- Download Bug Jar (Provided as a zip file)
2- Download Qwen 0.6 B Model (Provided as zip file alongside bug jar)
3- Download Phi-3.5-mini-instruct Model (Provided as zip file alongside bug jar)
4- Extract Phi-3.5 and Qwen 3 models to folders of your choice
5- Modify the following lines in Program.cs of the bug jar to point to the extracted model folders above:
> Qwen3 –
- modelPath2 = @"C:\\Program Files\\WindowsApps\\AD2F1837.AIMDL.PLANNER.WW.AMD.1.0.0.ONNX.DML_1.0.37.0_neutral__922sw8z9z7n5w\App";
> Phi 3.5 –
- var modelPath = @"C:\Program Files\WindowsApps\AD2F1837.AIMDL.SLM.WW.AMD.1.0.0.ONNX.DML_1.0.9.0_neutral__922sw8z9z7n5w\App";
6- Run bug jar w/ Debug_DirectML target selected.

Expected results:
The attached bug jar should run to completion with no crash and have a zero exit code.

Actual results:
When the bug jar is run from the console, with both models downloaded, we observe the following output exemplifying the crash w/ a non-zero exit code:
------------Hello, Phi!-------------
Warning: Unable to create a device from version 1.614.0 of the DirectX 12 Agility SDK. You can still use this library, but some scenarios may not work.
The given module path: C:\HelloPhi_MS\HelloPhi\HelloPhi\bin\x64\Debug_DirectML\net8.0\runtimes\win-x64\native\ Certainly! Below is a Python function named `is_prime` that checks if a given number `num` is a prime number. A
Streaming Tokens: 50 Time: 1.51 Tokens per second: 33.05
Process exit detected, cleaning up OnnxRuntime resources...
Start Cleaning up OnnxRuntime resources...
Disposing all OnnxRuntime Tokenizers...
Disposing Tokenizer...
Disposing Tokenizer...
All OnnxRuntime Tokenizers disposed.
Disposing all OnnxRuntime Models ...
Disposing Model...
Disposing Model...
Fatal error. System.AccessViolationException: Attempted to read or write protected memory. This is often an indication that other memory is corrupt.
Repeat 2 times:
--------------------------------
at Microsoft.ML.OnnxRuntimeGenAI.NativeMethods.OgaDestroyModel(IntPtr)
--------------------------------
at Microsoft.ML.OnnxRuntimeGenAI.Model.Dispose(Boolean)
at Microsoft.ML.OnnxRuntimeGenAI.Model.Dispose()
at AIModels.LanguageModel.Onnx.OnnxRTResourceManager.DisposeAllModels()
at AIModels.LanguageModel.Onnx.OnnxRTResourceManager.CleanupOnnxRuntimeOnProcessExit(System.Object, System.EventArgs)
[createdump] Writing full dump for process 95704 to file C:\dumps\testhost_95704.dmp
[createdump] Dump successfully written in 61699ms

C:\HelloPhi_MS\HelloPhi\HelloPhi\bin\x64\Debug_DirectML\net8.0\HelloPhi.exe (process 95704) exited with code -1073741819 (0xc0000005).
Press any key to close this window . . .
The native crash decoded in WinDBG shows the offending thread:
3 Id: 175d8.df20 Suspend: 0 Teb: 000000af`5897f000 Unfrozen ".NET Finalizer"
# Child-SP RetAddr : Args to Child : Call Site
00 000000af`58e7ca38 00007ffd`3b92cbbf : 00000000`00000001 00000000`00000001 00000201`44177440 00007ffc`21b5a0db : ntdll!NtWaitForSingleObject+0x14
01 000000af`58e7ca40 00007ffc`21a37ee6 : 00000000`00000000 000001c0`8cc75fb0 000000af`00000000 00000000`00000828 : KERNELBASE!WaitForSingleObjectEx+0xaf
02 000000af`58e7cae0 00007ffc`21a347b6 : 00000000`00000002 00000000`00000000 000000af`58e7cb50 00007ffc`218db1f8 : coreclr!LaunchCreateDump+0xe6 [D:\a\_work\1\s\src\coreclr\vm\excep.cpp @ 4103]
03 000000af`58e7cc20 00007ffc`21a3b14a : 00000000`00000002 000001c0`8cc75fb0 000000af`58e7d9b0 000000af`58e7da80 : coreclr!CreateCrashDumpIfEnabled+0x86 [D:\a\_work\1\s\src\coreclr\vm\excep.cpp @ 4138]
04 000000af`58e7cc70 00007ffc`21a7806b : 00000000`00000000 000000af`58e7da80 00000000`c0000005 00000201`47f79501 : coreclr!WatsonLastChance+0x1a6 [D:\a\_work\1\s\src\coreclr\vm\excep.cpp @ 3834]
05 000000af`58e7cce0 00007ffc`21a772cb : 00000000`00000001 00000000`00000000 00000000`00000000 00007ffb`c1e18ea0 : coreclr!EEPolicy::LogFatalError+0x5cf [D:\a\_work\1\s\src\coreclr\vm\eepolicy.cpp @ 571]
06 000000af`58e7d980 00007ffc`219f9e4c : 000000af`58e7edb0 000000af`58e7edb0 00000000`00000000 00007ffb`c1e28ea1 : coreclr!EEPolicy::HandleFatalError+0x133 [D:\a\_work\1\s\src\coreclr\vm\eepolicy.cpp @ 810]
07 000000af`58e7df80 00007ffd`3e0c6fef : 000000af`58e7edb0 000000af`58e7f3f0 000000af`58e7edb0 000000af`58e7e720 : coreclr!ProcessCLRException+0xe8d9c [D:\a\_work\1\s\src\coreclr\vm\exceptionhandling.cpp @ 1066]
08 000000af`58e7e140 00007ffd`3dfd4557 : 000000af`58e7edb0 00007ffb`c1e20000 00007ffb`c1e28ea1 00007ffb`c20a5d5c : ntdll!RtlpExecuteHandlerForException+0xf
09 000000af`58e7e170 00007ffd`3e0c692e : 00007ffd`10af4ef0 00007ffd`10a9ed60 000001c0`82a7d730 00007ffd`10af4f40 : ntdll!RtlDispatchException+0x437
0a 000000af`58e7e8c0 00007ffb`70bc2b1c : 00000000`00000004 000000af`58e7f670 00000000`00000000 00000201`3a9fc648 : ntdll!KiUserExceptionDispatch+0x2e (TrapFrame @ 000000af`58e7ece8)
0b 000000af`58e7efc0 00007ffb`70c2666c : 00000000`00000001 000000af`00000000 00000201`3b85e5b0 00000201`3f3d21f8 : onnxruntime!OrtSessionOptionsAppendExecutionProviderEx_DML+0xa2c8c
0c 000000af`58e7eff0 00007ffb`70b26d0a : 00000000`00000000 000000af`00000000 00000201`3fcf56b0 000000af`58e7f6b8 : onnxruntime!OrtSessionOptionsAppendExecutionProviderEx_DML+0x1067dc
0d 000000af`58e7f020 00007ffb`70b7257e : 000001c0`8cb90000 00000000`00000000 00000201`3a9fc610 000000af`58e7f6b8 : onnxruntime!OrtSessionOptionsAppendExecutionProviderEx_DML+0x6e7a
0e 000000af`58e7f050 00007ffb`70b72464 : 00000000`00000001 000000af`00000000 00000201`3fce5dd0 000000af`58e7f6b8 : onnxruntime!OrtSessionOptionsAppendExecutionProviderEx_DML+0x526ee
0f 000000af`58e7f080 00007ffb`70a87f0c : 00000201`485abe00 00000201`00000000 000000af`58e7f6b8 000000af`58e7f4a0 : onnxruntime!OrtSessionOptionsAppendExecutionProviderEx_DML+0x525d4
10 000000af`58e7f0b0 00007ffb`70ad3f8b : 00000201`438e8020 000000af`58e7f6b8 00000201`3aa39530 00000201`3fcf56b0 : onnxruntime!OrtGetApiBase+0xefac
11 000000af`58e7f0e0 00007ffb`70add505 : 00000201`438e8020 00000201`438e8020 000000af`58e7f6b8 00000201`438e8028 : onnxruntime!OrtGetApiBase+0x5b02b
12 000000af`58e7f120 00007ffb`70adc814 : 00000000`00000014 00000000`00000001 00000201`438e8020 00000000`00000000 : onnxruntime!OrtGetApiBase+0x645a5
*** WARNING: Unable to verify checksum for onnxruntime-genai.DLL
13 000000af`58e7f360 00007ffb`a005383f : 000001c0`89e5f3e0 000001c0`914b8710 000001c0`914b8880 00000000`00000002 : onnxruntime!OrtGetApiBase+0x638b4
14 000000af`58e7f390 00007ffb`a00a297a : 000001c0`89e5f3d0 00007ffc`20f9db2a 00000000`00000000 00000000`00000000 : onnxruntime_genai+0x1d383f
15 000000af`58e7f3c0 00007ffb`c1e28ea1 : 000001c0`82abd7f0 000000af`58e7f708 00000000`00000000 000001c0`914b8ae8 : onnxruntime_genai!OgaDestroyModel+0x4a
16 000000af`58e7f3f0 00007ffb`c1e28de5 : 000001c0`914b8fc8 00000000`00000001 000000af`58e7f708 000000af`58e7f6b8 : 0x00007ffb`c1e28ea1
17 000000af`58e7f4b0 00007ffb`c1e28cae : 000001c0`914b8fc8 000001c0`914b8db0 000001c0`8cc75fb0 000001c0`914b8ae8 : 0x00007ffb`c1e28de5
18 000000af`58e7f4e0 00007ffb`c1e28736 : 00000000`00000002 00000000`00000000 000001c0`914b8b60 000001c0`8cc75fb0 : 0x00007ffb`c1e28cae
19 000000af`58e7f5a0 00007ffc`21980333 : 000001c0`914b8be8 000001c0`914bb0f8 000001c0`914bb0f8 00000000`00000000 : 0x00007ffb`c1e28736
1a 000000af`58e7f610 00007ffc`2182635d : 000000af`58e7f7e8 00000000`00000000 00007ffc`215e0a45 00007ffc`215ac58c : coreclr!CallDescrWorkerInternal+0x83 [D:\a\_work\1\s\src\coreclr\vm\amd64\CallDescrWorkerAMD64.asm @ 100]
1b (Inline Function) --------`-------- : --------`-------- --------`-------- --------`-------- --------`-------- : coreclr!CallDescrWorkerWithHandler+0x5a (Inline Function @ 00007ffc`2182635d) [D:\a\_work\1\s\src\coreclr\vm\callhelpers.cpp @ 67]
1c 000000af`58e7f650 00007ffc`2192545b : 00000000`00000000 00000000`00000000 00000000`00000000 000000af`58e7f728 : coreclr!MethodDescCallSite::CallTargetWorker+0x249 [D:\a\_work\1\s\src\coreclr\vm\callhelpers.cpp @ 570]
1d (Inline Function) --------`-------- : --------`-------- --------`-------- --------`-------- --------`-------- : coreclr!MethodDescCallSite::Call+0x12 (Inline Function @ 00007ffc`2192545b) [D:\a\_work\1\s\src\coreclr\vm\callhelpers.h @ 458]
1e (Inline Function) --------`-------- : --------`-------- --------`-------- --------`-------- --------`-------- : coreclr!AppDomain::RaiseExitProcessEvent+0x2d (Inline Function @ 00007ffc`2192545b) [D:\a\_work\1\s\src\coreclr\vm\appdomain.cpp @ 3834]
1f 000000af`58e7f790 00007ffd`3c72e8d7 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : coreclr!FinalizerThread::FinalizerThreadStart+0xcb [D:\a\_work\1\s\src\coreclr\vm\finalizerthread.cpp @ 413]
20 000000af`58e7f8a0 00007ffd`3df9c34c : 00000000`00000000 00000000`00000000 000004f0`fffffb30 000004d0`fffffb30 : kernel32!BaseThreadInitThunk+0x17
21 000000af`58e7f8d0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x2c

Start with the supplied Program.cs reproduction and run it with the two models under the Debug_DirectML target. Trace cleanup through OnnxRTResourceManager.DisposeAllModels, Model.Dispose, and the native OgaDestroyModel call shown in the crash stack. Done means both models can be disposed without an access violation and the process exits with code zero.

Written by the indexing model from the issue text.