[BUG][GPU] Metal backend segfaults on pointer arithmetic into external_memory shared buffer

Bug description

Actual behavior

mojo build segfaults in the Metal codegen pass (MetalAIRPass) when a kernel does pointer arithmetic on an external_memory shared pointer and then dereferences the result.

Only happens on Metal. The same source compiles targeting sm_80 and gfx942.

Expected behavior

Compiles without crashing, same as the NVIDIA and AMD backends. Indexing the base pointer directly (smem[4 + i]) already works and emits identical PTX on NVPTX, the smem + 4 form should lower the same way instead of segfaulting.

Steps to reproduce

from std.gpu import thread_idx
from std.gpu.host import DeviceContext, FuncAttribute
from std.gpu.memory import external_memory, AddressSpace


def smem_kernel(dst: UnsafePointer[Float32, MutAnyOrigin]):
    var smem = rebind[UnsafePointer[Float32, MutUntrackedOrigin, address_space = AddressSpace.SHARED]](
        external_memory[Float32, address_space = AddressSpace.SHARED, alignment=16, name="repro_smem"]()
    )
    var g = Int(thread_idx.x)

    # Crashes:
    var off = smem + 4
    off[g] = Float32(g)
    dst[g] = off[g]

    # Fine:
    # smem[4 + g] = Float32(g)
    # dst[g] = smem[4 + g]


def main() raises:
    var ctx = DeviceContext()
    comptime N = 32
    var buf = ctx.enqueue_create_buffer[DType.float32](N)
    comptime smem_bytes = (4 + N) * 4
    ctx.enqueue_function[smem_kernel](
        buf.unsafe_ptr().as_unsafe_any_origin(),
        grid_dim=(1,),
        block_dim=(N,),
        shared_mem_bytes=smem_bytes,
        func_attribute=FuncAttribute.MAX_DYNAMIC_SHARED_SIZE_BYTES(UInt32(smem_bytes)),
    )
    ctx.synchronize()

> pixi run mojo metal_smem_crash_repro.mojo
Please submit a bug report to https://github.com/modular/modular/issues and include the crash backtrace along with all the relevant source codes.
Stack dump:
0.      Program arguments: /Users/.../.pixi/envs/default/bin/mojo metal_smem_crash_repro.mojo
1.      Running pass "M::KGEN::MetalAIRPass" on module "metal_smem_crash_repro.mojo"
 #0 0x0000000104b6158c _mh_execute_header (/Users/.../.pixi/envs/default/bin/mojo+0x1041b158c)
 #1 0x0000000104b5ec0c _mh_execute_header (/Users/.../.pixi/envs/default/bin/mojo+0x1041aec0c)
 #2 0x0000000104b61fa8 _mh_execute_header (/Users/.../.pixi/envs/default/bin/mojo+0x1041b1fa8)
 #3 0x0000000182d87744 (/usr/lib/system/libsystem_platform.dylib+0x1804fb744)
 #4 0x0000000100b90d38 _mh_execute_header (/Users/.../.pixi/envs/default/bin/mojo+0x1001e0d38)
 #5 0x0000000100b8ed50 _mh_execute_header (/Users/.../.pixi/envs/default/bin/mojo+0x1001ded50)
 #6 0x0000000104a474e8 _mh_execute_header (/Users/.../.pixi/envs/default/bin/mojo+0x1040974e8)
 #7 0x0000000100bd0858 _mh_execute_header (/Users/.../.pixi/envs/default/bin/mojo+0x100220858)
 #8 0x0000000100be4b48 _mh_execute_header (/Users/.../.pixi/envs/default/bin/mojo+0x100234b48)
 #9 0x0000000100beead4 _mh_execute_header (/Users/.../.pixi/envs/default/bin/mojo+0x10023ead4)
#10 0x000000010881c550 (/Users/.../.pixi/envs/default/lib/libAsyncRTMojoBindings.dylib+0x74550)
#11 0x0000000108819568 (/Users/.../.pixi/envs/default/lib/libAsyncRTMojoBindings.dylib+0x71568)
#12 0x0000000100bea2d8 _mh_execute_header (/Users/.../.pixi/envs/default/bin/mojo+0x10023a2d8)
#13 0x000000010881c424 (/Users/.../.pixi/envs/default/lib/libAsyncRTMojoBindings.dylib+0x74424)
#14 0x0000000108819568 (/Users/.../.pixi/envs/default/lib/libAsyncRTMojoBindings.dylib+0x71568)
#15 0x0000000100c2af3c _mh_execute_header (/Users/.../.pixi/envs/default/bin/mojo+0x10027af3c)
#16 0x0000000100c2a948 _mh_execute_header (/Users/.../.pixi/envs/default/bin/mojo+0x10027a948)
#17 0x00000001009db0b4 _mh_execute_header (/Users/.../.pixi/envs/default/bin/mojo+0x10002b0b4)
#18 0x00000001009de968 _mh_execute_header (/Users/.../.pixi/envs/default/bin/mojo+0x10002e968)
#19 0x00000001829bfe00

💣 Program crashed: Bad pointer dereference at 0x0000000000000048

Platform: arm64 macOS 26.5.1 (25F80)

Thread 0 crashed:

  0 0x0000000104933a54 <unknown> in mojo
  1 0x0000000100b8ed50 <unknown> + 884 in mojo
  2 0x0000000104a474e8 <unknown> + 260 in mojo
  3 0x0000000100bd0858 <unknown> + 2476 in mojo
  4 0x0000000100be4b48 <unknown> + 644 in mojo
  5 0x0000000100beead4 <unknown> + 1588 in mojo
  6 0x000000010881c550 <unknown> + 964 in libAsyncRTMojoBindings.dylib
  7 0x0000000108819568 <unknown> + 628 in libAsyncRTMojoBindings.dylib
  8 0x0000000100bea2d8 <unknown> + 3820 in mojo
  9 0x000000010881c424 <unknown> + 664 in libAsyncRTMojoBindings.dylib
 10 0x0000000108819568 <unknown> + 628 in libAsyncRTMojoBindings.dylib
 11 0x0000000100c2af3c <unknown> + 612 in mojo
 12 0x0000000100c2a948 <unknown> + 560 in mojo
 13 0x00000001009db0b4 <unknown> + 2948 in mojo
 14 0x00000001009de968 <unknown> + 2736 in mojo
...

Backtrace took 0.25s

[62896:53993766:20260709,174547.032990:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /usr/lib/libc++.1.dylib
[62896:53993766:20260709,174547.033036:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /usr/lib/libc++abi.dylib
[62896:53993766:20260709,174547.033065:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /usr/lib/system/libdispatch.dylib
[62896:53993766:20260709,174547.033088:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /usr/lib/system/libdyld.dylib
[62896:53993766:20260709,174547.033110:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /usr/lib/system/libsystem_asl.dylib
[62896:53993766:20260709,174547.033131:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /usr/lib/system/libsystem_c.dylib
[62896:53993766:20260709,174547.033157:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /usr/lib/system/libsystem_malloc.dylib
[62896:53993766:20260709,174547.033177:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /usr/lib/system/libsystem_notify.dylib
[62896:53993766:20260709,174547.033203:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /usr/lib/system/libsystem_secinit.dylib
[62896:53993766:20260709,174547.033228:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /usr/lib/system/libsystem_kernel.dylib
[62896:53993766:20260709,174547.033251:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /usr/lib/system/libsystem_platform.dylib
[62896:53993766:20260709,174547.033270:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /usr/lib/system/libsystem_pthread.dylib
[62896:53993766:20260709,174547.033289:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /usr/lib/system/libsystem_trace.dylib
[62896:53993766:20260709,174547.033309:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /usr/lib/system/libxpc.dylib
[62896:53993766:20260709,174547.033327:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /usr/lib/libobjc.A.dylib
[62896:53993766:20260709,174547.033345:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
[62896:53993766:20260709,174547.033380:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /usr/lib/libRosetta.dylib
[62896:53993766:20260709,174547.033403:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
[62896:53993766:20260709,174547.033427:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration
[62896:53993766:20260709,174547.033450:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /System/Library/Frameworks/CFNetwork.framework/Versions/A/CFNetwork
[62896:53993766:20260709,174547.033483:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /usr/lib/liboah.dylib
[62896:53993766:20260709,174547.033506:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /System/Library/Frameworks/Security.framework/Versions/A/Security
[62896:53993766:20260709,174547.033528:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/CarbonCore
[62896:53993766:20260709,174547.033551:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/LaunchServices
[62896:53993766:20260709,174547.033573:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /usr/lib/libsqlite3.dylib
[62896:53993766:20260709,174547.033598:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /System/Library/Frameworks/CoreGraphics.framework/Versions/A/CoreGraphics
[62896:53993766:20260709,174547.033622:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /System/Library/Frameworks/Network.framework/Versions/A/Network
[62896:53993766:20260709,174547.033648:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /System/Library/PrivateFrameworks/CrashReporterSupport.framework/Versions/A/CrashReporterSupport
[62896:53993766:20260709,174547.033676:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /System/Library/Frameworks/IOSurface.framework/Versions/A/IOSurface
[62896:53993766:20260709,174547.033696:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /System/Library/PrivateFrameworks/LoggingSupport.framework/Versions/A/LoggingSupport
[62896:53993766:20260709,174547.033721:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /usr/lib/libquic.dylib
[62896:53993766:20260709,174547.033767:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /System/Library/Frameworks/ImageIO.framework/Versions/A/ImageIO
[62896:53993766:20260709,174547.033790:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ATS.framework/Versions/A/ATS
[62896:53993766:20260709,174547.033809:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/HIServices.framework/Versions/A/HIServices
[62896:53993766:20260709,174547.033832:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /System/Library/PrivateFrameworks/SkyLight.framework/Versions/A/SkyLight
[62896:53993766:20260709,174547.033854:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /System/Library/PrivateFrameworks/BaseBoard.framework/Versions/A/BaseBoard
[62896:53993766:20260709,174547.033879:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /System/Library/Frameworks/CoreDisplay.framework/Versions/A/CoreDisplay
[62896:53993766:20260709,174547.033899:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /System/Library/Frameworks/VideoToolbox.framework/Versions/A/VideoToolbox
[62896:53993766:20260709,174547.033923:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /System/Library/Frameworks/CoreMedia.framework/Versions/A/CoreMedia
[62896:53993766:20260709,174547.033973:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /System/Library/PrivateFrameworks/GPUWrangler.framework/Versions/A/GPUWrangler
[62896:53993766:20260709,174547.033996:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /System/Library/PrivateFrameworks/IOPresentment.framework/Versions/A/IOPresentment
[62896:53993766:20260709,174547.034019:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /System/Library/Frameworks/ExtensionFoundation.framework/Versions/A/ExtensionFoundation
[62896:53993766:20260709,174547.034040:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /usr/lib/libspindump.dylib
[62896:53993766:20260709,174547.034060:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /System/Library/PrivateFrameworks/AppServerSupport.framework/Versions/A/AppServerSupport
[62896:53993766:20260709,174547.034081:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /System/Library/PrivateFrameworks/AudioToolboxCore.framework/Versions/A/AudioToolboxCore
[62896:53993766:20260709,174547.034109:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /System/Library/Frameworks/OSLog.framework/Versions/A/OSLog
[62896:53993766:20260709,174547.034132:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /System/Library/Frameworks/CoreImage.framework/Versions/A/CoreImage
[62896:53993766:20260709,174547.034167:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /System/Library/PrivateFrameworks/Symbolication.framework/Versions/A/Symbolication
[62896:53993766:20260709,174547.034192:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /System/Library/PrivateFrameworks/CoreSymbolication.framework/Versions/A/CoreSymbolication
[62896:53993766:20260709,174547.034230:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /System/Library/Frameworks/OpenDirectory.framework/Versions/A/Frameworks/CFOpenDirectory.framework/Versions/A/CFOpenDirectory
[62896:53993766:20260709,174547.034268:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /System/Library/PrivateFrameworks/AttributeGraph.framework/Versions/A/AttributeGraph
[62896:53993766:20260709,174547.034303:WARNING mach_o_image_annotations_reader.cc:92] unexpected crash info version 7 in /usr/lib/dyld
[62896:53993767:20260709,174547.040340:ERROR directory_reader_posix.cc:42] opendir /Users/.../.pixi/envs/default/share/max/crashdb/attachments/24d541dd-e23e-47ce-887e-58f2100c3036: No such file or directory (2)
[62896:53993766:20260709,174547.040576:WARNING crash_report_exception_handler.cc:257] UniversalExceptionRaise: (os/kern) failure (5)
zsh: segmentation fault  pixi run mojo metal_smem_crash_repro.mojo

System information

System
------------
       Pixi version: 0.70.2
        TLS backend: rustls
           Platform: osx-arm64
   Virtual packages: __unix=0=0
                   : __osx=26.5.1=0
                   : __archspec=1=m1
          Cache dir: /Users/.../Library/Caches/rattler/cache
       Auth storage: /Users/.../.rattler/credentials.json
   Config locations: No config files found

Global
------------
            Bin dir: /Users/.../.pixi/bin
    Environment dir: /Users/.../.pixi/envs
       Manifest dir: /Users/.../.pixi/manifests/pixi-global.toml

Name      Version               Build             Size  Kind   Source
max       26.5.0.dev2026062206  3.14release   6.65 MiB  conda  https://conda.modular.com/max-nightly
max-core  26.5.0.dev2026062206  release      49.07 MiB  conda  https://conda.modular.com/max-nightly

Start by running the provided metal_smem_crash_repro.mojo command and inspect the MetalAIRPass mentioned in the crash. Compare the pointer-arithmetic case with direct indexing and the NVPTX behavior described. Done means the Metal target compiles the reproduction without a segfault and preserves the expected shared-buffer access behavior.