[android][NativeAOT] SIGSEGV in RandomNumberGenerator.GetBytes (CryptoNative_GetRandomBytes) on Android 16 emulator

### Android framework version

net10.0-android

### Affected platform version

.NET 10.0.2

### Description


### Summary
Calling `System.Security.Cryptography.RandomNumberGenerator.GetBytes()` crashes the process with a **native SIGSEGV** (null pointer dereference) on an **Android 16 arm64 emulator** when running an **instrumentation test** (`AndroidJUnitRunner` / `roidJUnitRunner`).

This also breaks any library that calls `RandomNumberGenerator` internally (e.g. MessagePack on first use).

### Expected behavior
`RandomNumberGenerator.GetBytes()` returns random bytes (or throws a managed exception if unsupported), and the test continues.

### Actual behavior
The process crashes with:
- `Fatal signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0`
- Tombstone shows a **null pointer dereference** (register `x0 == 0` at crash PC)

### Reproduction
The repro repository is attached. Run the instrumentation test as described in the repo README.

The minimal trigger is:

```csharp
using System.Security.Cryptography;

RandomNumberGenerator.GetBytes(1);
```

### Environment
#### Host
- macOS (Apple Silicon)
- .NET host: **10.0.2** (arm64)

`dotnet --info` (run from my terminal; note: the CLI prints `getcwd() failed: Operation not permitted` in my environment, but it still reports the host/runtime versions):

```text
Host:
  Version:      10.0.2
  Architecture: arm64
  Commit:       4452502459
  RID:          osx-arm64

.NET SDKs installed:
  8.0.100 [/usr/local/share/dotnet/sdk]
  8.0.303 [/usr/local/share/dotnet/sdk]
  8.0.403 [/usr/local/share/dotnet/sdk]
  9.0.100-rc.2.24474.11 [/usr/local/share/dotnet/sdk]
  9.0.100 [/usr/local/share/dotnet/sdk]
  10.0.100-rc.1.25451.107 [/usr/local/share/dotnet/sdk]
  10.0.102 [/usr/local/share/dotnet/sdk]

.NET runtimes installed:
  Microsoft.AspNetCore.App 8.0.0 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 8.0.7 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 8.0.10 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 9.0.0-rc.2.24474.3 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 9.0.0 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 10.0.0-rc.1.25451.107 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 10.0.2 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.NETCore.App 8.0.0 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
  Microsoft.NETCore.App 8.0.7 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
  Microsoft.NETCore.App 8.0.10 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
  Microsoft.NETCore.App 9.0.0-rc.2.24473.5 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
  Microsoft.NETCore.App 9.0.0 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
  Microsoft.NETCore.App 10.0.0-rc.1.25451.107 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
  Microsoft.NETCore.App 10.0.2 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
```

#### Target / device
- Android emulator: **arm64**
- Android version: **Android 16**
- Build fingerprint (from tombstone):
  - `google/sdk_gphone64_arm64/emu64a:16/BE4B.251210.005/14574095:user/release-keys`

#### Notes
- I currently **cannot test on a physical Android device** (I don’t own one).
- `/dev/urandom` works on the emulator (so this doesn’t appear to be “no entropy”):
  - `adb shell dd if=/dev/urandom bs=16 count=1 2>/dev/null | hexdump -C` succeeds.

### Tombstone excerpt (crypto crash)
Full tombstone file is attached in the repo; key excerpt:

```text
*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
Build fingerprint: 'google/sdk_gphone64_arm64/emu64a:16/BE4B.251210.005/14574095:user/release-keys'
Kernel Release: '6.12.38-android16-5-gbb9513914902-ab13996879-4k'
Revision: '0'
ABI: 'arm64'
Timestamp: 2026-01-14 21:32:17.933551025+0100
Process uptime: 2s
Executable: /system/bin/app_process64
Cmdline: com.example.nativewrapper.test
pid: 20099, tid: 20113, name: roidJUnitRunner  >>> com.example.nativewrapper.test <<<
uid: 10313
tagged_addr_ctrl: 0000000000000001 (PR_TAGGED_ADDR_ENABLE)
pac_enabled_keys: 000000000000000f (PR_PAC_APIAKEY, PR_PAC_APIBKEY, PR_PAC_APDAKEY, PR_PAC_APDBKEY)
esr: 0000000092000006 (Data Abort Exception 0x24)
signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0000000000000000 (read)
Cause: null pointer dereference
    x0  0000000000000000  x1  000000775ba00cb0  x2  0000000000010006  x3  000000000000000f
    ...
    lr  000000775b6d0420  sp  000000775ba00cb0  pc  000000775b6d02a0  pst 0000000060001000
    esr 0000000092000006

1 total frames
backtrace:
      #00 pc 00000000000092a0  /data/app/~~pTwoqId5I5rZPYpgEgbUjA==/com.example.nativewrapper.test-cCYoCv4nJQpJ9OqsLmtvUg==/base.apk (offset 0x21a000)
```

### What I think is happening
This looks like a **native null dereference** inside the .NET Android crypto/RNG native shim (call path includes `CryptoNative_GetRandomBytes` in other tombstones from similar runs), where an internal context/function-table pointer is unexpectedly null.

Any guidance on additional diagnostics, or whether this is a known issue on Android 16 emulator, would be appreciated.

### Steps to Reproduce

## Repro ([https://github.com/elias-io/crypto_android_crash](https://github.com/elias-io/crypto_android_crash))
1) Build the NativeAOT .so and generate the AAR:
./build_dotnet_native_crypto_androidtest.sh

2) Open `AndroidTest/` in Android Studio.

3) Run instrumentation test:
`DotNetNativeCryptoBridgeTest.calls_dotnet_hello_world_random`

File:
`AndroidTest/NativeWrapper/src/androidTest/java/com/example/nativewrapper/DotNetNativeCryptoBridgeTest.kt`

## Expected / Actual
- `calls_dotnet_hello_world` works (just Console.WriteLine).
- `calls_dotnet_hello_world_random` crashes because it calls:
`RandomNumberGenerator.GetBytes(1)` inside NativeAOT.

### Did you find any workaround?

No

### Relevant log output

```shell
Tombstone:
https://github.com/elias-io/crypto_android_crash/blob/main/tombstone_00
```

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[android][NativeAOT] SIGSEGV in RandomNumberGenerator.GetBytes (CryptoNative_GetRandomBytes) on Android 16 emulator #123355

Android framework version

Affected platform version

Description

Summary

Expected behavior

Actual behavior

Reproduction

Environment

Host

Target / device

Notes

Tombstone excerpt (crypto crash)

What I think is happening

Steps to Reproduce

Repro (https://github.com/elias-io/crypto_android_crash)

Expected / Actual

Did you find any workaround?

Relevant log output

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[android][NativeAOT] SIGSEGV in RandomNumberGenerator.GetBytes (CryptoNative_GetRandomBytes) on Android 16 emulator #123355

Description

Android framework version

Affected platform version

Description

Summary

Expected behavior

Actual behavior

Reproduction

Environment

Host

Target / device

Notes

Tombstone excerpt (crypto crash)

What I think is happening

Steps to Reproduce

Repro (https://github.com/elias-io/crypto_android_crash)

Expected / Actual

Did you find any workaround?

Relevant log output

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions