[Windows][26.908.4834.0] Renderer C000001D at chrome.dll+0xAD95EE0; identical raw_hash_map::at fatal in two dumps

Summary

On Windows, Codex Desktop's renderer is terminating through the same native fatal path in two independently captured dumps. This persists on desktop package 26.908.4834.0.

This is more specific than my earlier idle-startup report (#44115), which did not have native dumps. I am filing it separately so the renderer failure can be symbolized and triaged without conflating it with browser-main crashes.

Environment

• Windows 11 24H2, x64
• Codex Desktop package: OpenAI.Codex 26.908.4834.0
• Embedded Chromium: 152.0.7977.83

Confirmed native failure (two captures)

Two independent ProcDump MiniPlus captures of processes launched with --type=renderer have the same:

• unhandled exception: C000001D (ILLEGAL_INSTRUCTION)
• fault instruction: chrome.dll+0xAD95EE0, disassembling to ud2
• WER/CDB bucket: ILLEGAL_INSTRUCTION_c000001d_chrome.dll!Unknown
• Failure.Hash: {f25bb7c2-d945-c864-f5f8-519ce06a7b76}
• fatal text present in each dump: throw_delegate.cc:107 and raw_hash_map<>::at

For the 2026-09-13 19:05 UTC+08:00 capture, ProcDump reported the renderer's unhandled C000001D, completed the dump, and Crashpad concurrently recorded ptype=renderer.

The browser-main process and codex.exe app-server survived; a replacement renderer was created immediately afterward. This is therefore a renderer-only native termination, not a full desktop-app exit.

Observed state around reload (correlation only)

On some renderer reloads, the UI recovery path also logs Conversation state not found and Item not found in turn state, particularly while rehydrating a long active task. I am not claiming those messages are the direct native cause; the exact same renderer fatal path was confirmed only by the two dumps above.

Request

Could the team symbolize chrome.dll+0xAD95EE0 for this package and investigate the raw_hash_map<>::at fatal/missing-key path in the Codex renderer? The two matching dumps strongly suggest a deterministic product code path rather than a one-off system fault.

No conversation content, local paths, credentials, full logs, or dump files are attached publicly. I can provide the two dumps and their SHA-256 values through a private/support-approved channel if useful.

Start by symbolizing chrome.dll+0xAD95EE0 for package 26.908.4834.0 and reviewing the two ProcDump MiniPlus captures through the private channel. Trace the raw_hash_map<>::at fatal path in the renderer; done means identifying the missing-key call path and a reproducible product-level cause.