SentinelOne incompatibility: Segmentation fault when running Bun while Windhawk is active

[NipOc]

Description
Applications using the Bun runtime crash immediately with a segmentation fault when Windhawk is active in the background.

This occurs even if no mods are enabled in Windhawk. Terminating Windhawk allows the application to run normally.

Steps to reproduce

1. Ensure Windhawk is running (active in tray).
2. Execute a Bun-based standalone application (tested with opencode.exe, Bun v1.3.5).
3. The process immediately panics.

Environment

• OS: Windows 11 (Build 26200)
• Target Application: Bun v1.3.5 (1e86cebd) Windows x64

Crash Log

Bun v1.3.5 (1e86cebd) Windows x64 (baseline)
Windows v.win11_dt
CPU: sse42 avx avx2
Args: "C:\\Users\\[user]\\AppData\\Local\\Microsoft\\WinGet\\Links\\opencode.exe" "--user-agent=opencode/1.1.48" "--use-system-ca" "--"
Features: Bun.stderr(4) Bun.stdin(4) Bun.stdout(4) fetch(3) jsc spawn standalone_executable workers_spawned
Builtins: "bun:ffi" "bun:main" "node:assert" "node:async_hooks" "node:buffer" "node:child_process" "node:console" "node:crypto" "node:events" "node:fs" "node:fs/promises" "node:http" "node:https" "node:module" "node:net" "node:os" "node:path" "node:process" "node:querystring" "node:readline" "node:stream" "node:string_decoder" "node:timers" "node:timers/promises" "node:tls" "node:tty" "node:url" "node:util" "undici" "node:v8" "node:dgram"
Elapsed: 974ms | User: 1046ms | Sys: 328ms
RSS: 0.71GB | Peak: 0.72GB | Commit: 0.93GB | Faults: 192601 | Machine: 34.03GB

panic(thread 24352): Segmentation fault at address 0x2571E610000
oh no: Bun has crashed. This indicates a bug in Bun, not your code.

[m417z]

OpenCode launched fine for me. Please post a crash dump. You should be able to get it with the following steps:

• Open regedit
• Go to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting
• Create a key named LocalDumps
• Create a DWORD value named DumpType with value 2
• Trigger the crash
• Go to the %LocalAppData%\CrashDumps folder, you should see a dump file in there

[NipOc]

I followed the registry steps, but, no crash dump was created in %LocalAppData%\CrashDumps. However, the issue seems specific to bun v1.3.5. I can't reproduce the crash after updating OpenCode to run on bun v1.3.9.

[m417z]

How can I reproduce it? Is there a specific version of OpenCode I can use? Where can I get it?

[m417z]

I tried OpenCode v1.1.48 (from the user agent from the first message), but it works fine for me.

I followed the registry steps, but, no crash dump was created in %LocalAppData%\CrashDumps.

I assume that it sets up a crash handler which prints the error message and prevents the crash generation. You can also try ProcDump, or you can try asking the Bun team how to disable their crash handler, or have it generate a dump if possible. Without a crash dump and without reproduction steps, it's quite challenging to investigate it.

[NipOc]

I managed to capture a crash dump using ProcDump. To avoid exposing sensitive information I extracted only a small snippet.
To me it looks like the crash is caused by a conflict between SentinelOne and Windhawk within Bun.

Exception Code:    0xC0000005 (EXCEPTION_ACCESS_VIOLATION)
Exception Address: 0x00007ffc50dc4912
Exception Module:  C:\Program Files\SentinelOne\Sentinel Agent 25.1.4.434\InProcessClient64.dll (Offset + 0x204912)

Crashing Thread Context (x64):
RIP: 0x00007ffc50dc4912
RSP: 0x000000c2f1dc3750
RBP: 0x000000c2f1dc3cf9

Stack Scan (Relevant Frames):
[0] 0x00007ffc50dc4912  SentinelOne\InProcessClient64.dll + 0x204912  <-- CRASH LOCATION
[1] 0x00007ffc50c08496  SentinelOne\InProcessClient64.dll + 0x48496
[2] 0x00007ffc50f15a00  SentinelOne\InProcessClient64.dll + 0x355a00
...
[+] 0x00007ffc50cdaca1  SentinelOne\InProcessClient64.dll + 0x11aca1
[+] 0x00007ffc247ef898  Windhawk\Engine\1.7.3\64\windhawk.dll + 0x5f898  <-- Windhawk involvement
[+] 0x00007ffc50cdaef9  SentinelOne\InProcessClient64.dll + 0x11aef9
[+] 0x00007ffc53fbe8d3  ntdll.dll + 0x3e8d3

If you need a larger portion of the stack or specific register values, let me know and I can extract them.

[m417z]

[+] 0x00007ffc247ef898 Windhawk\Engine\1.7.3\64\windhawk.dll + 0x5f898 <-- Windhawk involvement

This doesn't make much sense, this points to a string, not to code.

I'd really be helpful to get the dump. If you'd rather not post it publicly, you can email it to me. If you'd rather not do that either, that's understandable. If you have WinDbg, can you open the dump, run these commands, and post the content of the output?

!analyze -v
.ecxr
dps @rsp L1000

[mazany]

I had issues with SentinelOne as well (actually, that's the reason I've posted #871).

I use extra process exclusion list in advanced settings:

SentinelAgent.exe
SentinelAgentWorker.exe
SentinelBrowserNativeHost.exe
SentinelCtl.exe
SentinelHelperService.exe
SentinelMemoryScanner.exe
SentinelOfficeMacroClean.exe
SentinelRemediation.exe
SentinelRemoteShellHost.exe
SentinelScanFromContextMenu.exe
SentinelServiceHost.exe
SentinelStaticEngine.exe
SentinelStaticEngineScanner.exe
SentinelUI.exe

[morpheus1211]

As @zrajnai-shapr3d mentioned in anthropics/claude-code#19666, adding claude.exe to Windhawk's exclusion list fixes it for me as well.

[m417z]

@morpheus1211 a dump will help, please see my comment here; #836 (comment).

[morpheus1211]

@morpheus1211 a dump will help, please see my comment here; #836 (comment).

I unfortunately don't have elevation so I don't think I can edit HKLM; regedit doesn't let me create a key in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting. (And I don't have a Windows PC where I can get administrator privileges at the moment :( sorry!)

[m417z]

In this case, can you try ProcDump? Run procdump64.exe -mp -e claude.exe and trigger the crash. The dump will be written to a file, the details will be printed in the ProcDump console window. Let me know if that works.