macOS: shell exec exits 139; child crashes in _os_log_preferences_refresh during fork

Environment

• ChatGPT desktop 26.901.51231 (8109), bundled Codex executable
• macOS 26.6.2 (25G83), Apple Silicon (ARM64)

Behavior

Shell execution worked, then began failing with exit code 139 without a known configuration change. The exact reproduction trigger is unknown. Shell execution also succeeded during a subsequent investigation.

Inspection found 25 available crash reports with the same leading stack signature, across two Codex binary builds and two boot sessions. Some reports may be duplicates; this is a report count, not a count of unique crashes.

Expected behavior

Commands start successfully, or return an actionable execution error without crashing the child process.

Crash evidence

The bundled Codex process receives SIGSEGV before executing the requested shell command. macOS reports:

• "*** multi-threaded process forked ***"
• "crashed on child side of fork pre-exec"

Call path (caller to fault):

codex_exec_server::fs_sandbox::spawn_command
fork
_pthread_atfork_child_handlers
nw_settings_child_has_forked()
nw_path_release_globals
NEFlowDirectorDestroy
os_log_type_enabled
_os_log_preferences_refresh

The fault is EXC_BAD_ACCESS / KERN_INVALID_ADDRESS. This localizes the failure to macOS networking/logging fork cleanup invoked during Codex process spawning. The underlying cause and trigger have not been established.

The crash-excerpt.json below contains only selected diagnostic fields, not the raw macOS report. Personal identifiers, local paths, timestamps, process IDs, binary/incident/device/boot identifiers, register values, memory addresses, and unrelated diagnostic metadata were omitted.

Sanitized crash excerpt

{
  "process": "codex (bundled with ChatGPT desktop)",
  "architecture": "ARM-64",
  "os": {
    "train": "macOS 26.6.2",
    "build": "25G83",
    "releaseType": "User"
  },
  "exception": {
    "type": "EXC_BAD_ACCESS",
    "signal": "SIGSEGV",
    "subtype": "KERN_INVALID_ADDRESS"
  },
  "termination": {
    "namespace": "SIGNAL",
    "code": 11
  },
  "crash_annotations": {
    "CoreFoundation": [
      "*** multi-threaded process forked ***"
    ],
    "libsystem_c.dylib": [
      "crashed on child side of fork pre-exec"
    ]
  },
  "symbolic_stack": [
    "_os_log_preferences_refresh",
    "os_log_type_enabled",
    "NEFlowDirectorDestroy",
    "nw_path_release_globals",
    "nw_settings_child_has_forked()",
    "_pthread_atfork_child_handlers",
    "fork",
    "codex_exec_server::fs_sandbox::spawn_command",
    "_pthread_start",
    "thread_start"
  ]
}

Start at codex_exec_server::fs_sandbox::spawn_command and trace the macOS fork/pre-exec path using the supplied crash signature. Investigate whether the failure can be reproduced; done means shell commands start reliably or return an actionable execution error without a child-process SIGSEGV.