[BUG] JACCL segfaults in mx.distributed.init(backend="jaccl") on 2-node Mac-Mac with RDMA devices present

Description

mx.distributed.init(backend="jaccl") segfaults immediately (signal 11) during
2-node Mac↔Mac initialization, even when both hosts have working RDMA devices
(ibv_devices enumerates rdma_en2) and Thunderbolt 40 Gb/s links confirmed.
The segfault is 100% reproducible on fresh builds.

This differs from #3777 (closed by #4180) which covered the no-verbs-device
case. In our case, RDMA devices ARE present — the crash happens deeper in the
initialization path.

The same 2-node setup works fine with MlxRing (socket-based backend).

Environment

• Hardware: 2× Apple Silicon Macs, 16 GB RAM, connected by direct Thunderbolt cable (40 Gb/s confirmed via system_profiler SPThunderboltDataType)
• macOS: 26.6.2 (latest)
• MLX: 0.32.0.dev20260806+cc3f3e60 (from rltakashige/mlx-jaccl-fix-small-recv fork, branch address-rdma-gpu-locks, commit cc3f3e60)
• Both hosts verified:
  • rdma_ctl status → enabled
  • ibv_devices → rdma_en2 present (real verbs devices)
  • Thunderbolt link: active, 40 Gb/s

Steps to Reproduce

1. Connect two Apple Silicon Macs via Thunderbolt cable
2. Enable RDMA on both hosts (rdma_ctl enable, cold boot if needed)
3. Verify ibv_devices shows rdma_en2 on both hosts
4. Run mx.distributed.init(backend="jaccl") with both hosts in the group

Expected Behavior

JACCL initialization completes, allowing distributed operations over Thunderbolt RDMA.

Actual Behavior

Segfault immediately during initialization:

Fatal Python error: Segmentation fault
signal=11 (SIGSEGV)

Stack trace points into libjaccl.dylib — the shared-buffer / protection-domain
registration path during mx.distributed.init(backend="jaccl").

Isolation Evidence

The crash is isolated to JACCL initialization over RDMA. The Ring backend
uses the same topology and works. This isolates the bug to the JACCL/RDMA
initialization path specifically.

Related

• Continuation of discussion in #3777 (comment by @cdvankammen, 2026-08-07) — maintainer @erwinzhang7 confirmed our failure is distinct from the #4180 fix
• MlxRing (non-RDMA socket backend) works as a workaround

Start by reproducing the two-node setup with mx.distributed.init(backend="jaccl") and inspect the libjaccl.dylib shared-buffer and protection-domain registration path named in the report. Compare initialization with the working MlxRing backend and the single-node case. Done means JACCL initializes without a segmentation fault when RDMA devices are present and distributed operations can run.