Code Mode host SIGSEGV on Linux with 57-bit virtual addresses and 200 GiB RLIMIT_AS

What version of Codex CLI is running?

codex-cli 0.153.4

What subscription do you have?

ChatGPT Pro

Which model were you using?

gpt-6-astra

What platform is your computer?

Linux 5.14.0-687.31.1.el9_8.x86_64, x86_64. AMD EPYC 9534 with 57-bit virtual-address support. RLIMIT_AS soft/hard: 214748364800 bytes (200 GiB).

What terminal emulator and version are you using (if applicable)?

Codex App over Remote SSH to a Linux host. Also reproduced by launching an independent codex-code-mode-host process on that host.

Codex doctor report

What issue are you seeing?

codex-code-mode-host 0.153.4 reproducibly crashes with SIGSEGV when executing a trivial JavaScript callback. Arithmetic succeeds in the same environment.

Observed errors:

code-mode host exited with status signal: 11 (SIGSEGV)

Another observed error presentation:

code-mode host closed its stdout

The affected Linux host has an AMD EPYC 9534 CPU with 57-bit virtual-address support. Both soft and hard RLIMIT_AS limits are 200 GiB.

An independent host process reproduces the crash without model API calls or project data. strace shows:

mmap(0xd2b00000000, 1481763713024, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_NORESERVE, -1, 0) = -1 ENOMEM
mmap(0x77bdc100000000, 141733916672, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_NORESERVE, -1, 0) = 0x77bdc100000000
SIGSEGV {si_code=SEGV_MAPERR, si_addr=0xbdc1001b5262}

Intermediate failed reservation attempts are omitted above. The fault address equals the low 48 bits of the successful reservation base plus 0x1b5262:

(0x77bdc100000000 + 0x1b5262) & 0x0000ffffffffffff == 0xbdc1001b5262

Under GDB, restricting high non-fixed mmap hints to the low 48-bit range makes the same binary successfully execute array callbacks and ordinary function calls, with normal inferior exit.

This strongly suggests an address-placement/pointer-encoding compatibility issue in the embedded runtime. The exact source-level root cause remains unconfirmed. Raising RLIMIT_AS has not been tested.

What steps can reproduce the bug?

1. Use the Linux x86_64 Codex 0.153.4 installation on a system supporting 57-bit virtual addresses, with soft and hard RLIMIT_AS set to 214748364800 bytes (200 GiB).

2. Start a Codex session with the Code Mode host enabled and functions.exec available.

3. Execute this control as one Code Mode JavaScript call:

   text(1 + 2);
   

   Actual result: 3.

4. Execute this as a SECOND, SEPARATE Code Mode JavaScript call:

   text([1, 2, 3].map(x => x + 1));
   

   Expected result: [2,3,4].
   Actual result: the Code Mode host exits with SIGSEGV.

The snippets must run inside the Code Mode JavaScript host, not through node -e in a shell.

The same comparison was independently reproduced by launching codex-code-mode-host and sending synthetic JavaScript through its length-prefixed JSON protocol (connection/hello, session/open, session/execute with no enabled tools). Handshake and session opening succeed.

Direct host process results:

• Arithmetic: exitCode 0, signal null.
• Array callback: exitCode null, signal SIGSEGV.

The probe launcher's own exit code can be zero even when its child host crashes; inspect the host's exit status.

What is the expected behavior?

No response

Additional information

No response

Start with the codex-code-mode-host entry point on the specified 57-bit-address Linux host and reproduce the separate arithmetic and array-callback calls. Compare the host exit status with strace and the supplied GDB low-address experiment; done means the callback completes without SIGSEGV under the reported RLIMIT_AS conditions.