Segfault in cmdstan_model(..., compile_model_methods = TRUE) on Ubuntu GitHub Actions

Describe the bug
I’m seeing a segfault in cmdstanr when model methods are compiled. The crash happens before sampling starts, during model construction, and it reproduces in a fresh R process without loading rstan.

I originally saw this intermittently in CI, so I created a small diagnostic workflow. In the attached cmdstanr_only artifact, the very first run segfaults in a fresh process. I also tested a mixed mode where an rstan fit runs first; that fit succeeds, and then the same cmdstanr step segfaults in the same place.

To Reproduce
Environment:

OS: GitHub Actions ubuntu-latest
R: release via r-lib/actions/setup-r@v2

Minimal reproduction

Using the attached Stan file model8k5.stan, in a fresh R session:

library(cmdstanr)

cat("cmdstanr:", as.character(packageVersion("cmdstanr")), "\n")
cat("CmdStan:", as.character(cmdstan_version()), "\n")
sessionInfo()

mod <- cmdstan_model(
  stan_file = "model8k5.stan",
  compile = TRUE,
  compile_model_methods = TRUE
)

Expected behavior
cmdstan_model() should return a CmdStanModel object.

Actual behavior
R aborts with a segfault during model-method compilation/loading. The relevant stack looks like:

cause 'invalid permissions'
dyn.load("/tmp/.../sourceCpp_2.so")
Rcpp::sourceCpp(...)
expose_model_methods(...)
CmdStanModel$new(... compile_model_methods = TRUE)

In the failing trace, the crash occurs before sampling, while cmdstanr is compiling/loading the generated model-method shared object.

Operating system
Environment
OS: GitHub Actions ubuntu-latest
R: release via r-lib/actions/setup-r@v2
cmdstanr: 0.9.0
CmdStan: 2.38.0
CmdStan installed via cmdstanr::install_cmdstan(cores = 2, overwrite = FALSE)

CmdStanR version number
0.9.0

Additional context
The same model works if I do not request model methods.

The cmdstanr_only reproduction is the strongest signal that this is not primarily an rstan/cmdstanr interaction.

In mixed mode, an rstan fit and log_prob() call succeed first, and then the cmdstanr step crashes in the same place.

If helpful, I also provide the full CI run artifacts and the small diagnostic script/workflow I used:

cmdstanr-model-methods-diagnostic-mixed.zip
cmdstanr-model-methods-diagnostic-cmdstanr_only.zip
model8k5.stan.zip

Start by running the minimal reproduction with model8k5.stan in a fresh R process, then trace cmdstan_model(..., compile_model_methods = TRUE) through CmdStanModel$new, expose_model_methods, and Rcpp::sourceCpp. Use the cmdstanr_only diagnostic artifact to compare the failing model-method shared-object load with the successful no-method path; done means cmdstan_model() returns a CmdStanModel without a segfault.