Segfault at 0x3C — nProtect GameGuard (npggNT64.des) injection kills any Bun process on Windows 11 #34055

What version of Bun is running?

1.3.14+0d9b296af

What platform is your computer?

Microsoft Windows NT 10.0.26100.0 x64

What steps can reproduce the bug?

Any Bun process on Windows segfaults at address 0x3C while nProtect GameGuard is running. A process that is already running and idle is killed within seconds of GameGuard starting — it does not need to be doing anything.

Repro:

Install a game that uses nProtect GameGuard. Confirmed with Helldivers 2 and Myth of Empires: Throne (both on Steam).
With no game running, start a long-lived Bun process:

bun -e "let n=0; setInterval(()=>{ for(let i=0;i<5e6;i++) n+=i; console.log('alive', Date.now()); }, 1000)"

It ticks once per second indefinitely. No crash.

Leave it running. Launch the game — this auto-starts the GameGuard service, which injects npggNT64.des into processes across the desktop.
Within seconds, the already-running, previously healthy Bun process dies with a segfault at 0x3C.
Quit the game. GameGuard exits. Bun works normally again immediately — no reboot, no reinstall.

Steps 3–5 cycle cleanly and repeatedly (verified 4+ times).

This also reproduces on Bun 1.4.0 in a bun build --compile standalone executable (details in Additional information), so it is not specific to one version or to compiled binaries.

What is the expected behavior?

The Bun process keeps running and continues logging alive once per second, regardless of whether an unrelated third-party process (a game and its anti-cheat service) is running elsewhere on the system.``

What do you see instead?

The running Bun process dies. Crash output:

============================================================
Bun v1.3.14 (0d9b296) Windows x64
Windows v.win11_dt
CPU: sse42 avx avx2
Args: "C:\Users<user>.bun\bin\bun.exe" "-e" "let n=0; setInterval(()=>{ for(let i=0;i<5e6;i++) n+=i; console.log('alive', Date.now()); }, 1000)"
Features: jsc
Builtins: "bun:main"
Elapsed: 482ms | User: 0ms | Sys: 93ms
RSS: 52.58MB | Peak: 52.58MB | Commit: 0.24GB | Faults: 13114 | Machine: 33.72GB
panic(thread 21900): Segmentation fault at address 0x3C
oh no: Bun has crashed. This indicates a bug in Bun, not your code.
To send a redacted crash report to Bun's team,
please file a GitHub issue using the link below:
https://bun.report/1.3.14/wa10d9b296AggggCCYnpggNT64.desy2TCYnpggNT64.desynouE__CYnpggNT64.desws0PCUUSER32.dllglkwBCYnpggNT64.desgi6R____CYnpggNT64.desoqmWA2A4D

Every subsequent bun invocation also crashes the same way for as long as GameGuard is running.

The frames in the crash report are all in GameGuard's injected DLL, with a USER32.dll frame between them:

npggNT64.des … npggNT64.des … USER32.dll … npggNT64.des … npggNT64.des

Additional information

The faulting code is in an injected third-party DLL

npggNT64.des is nProtect GameGuard's usermode hook/injection module. Bun reports "a bug in Bun" because it catches the signal, but the faulting instruction is in foreign code executing inside Bun's address space.

The USER32.dll frame sandwiched between GameGuard frames is characteristic of a global Windows hook (SetWindowsHookEx), which loads the DLL into processes across the desktop. That matches the observed behaviour: an idle Bun process, doing nothing but a timer tick, is killed the moment GameGuard appears.

0x3C is a NULL + struct-field-offset read — the injected code appears to expect something in the host process (a module handle, a TEB/PEB field, a hook target) and gets null back.

What I ruled out

Both games shipping the byte-for-byte identical 2025 build crash Bun. The game shipping an older, different build does not — despite starting GameGuard normally.

PE section layout differs between the two builds:

• Crashing build (HD2 / MoE) — 9 sections, including .vlizer (~3 MB, executable) and .vm_sec. .vlizer is the section name used by Oreans Code Virtualizer; nearly the whole module is virtualized bytecode.
• Non-crashing build (N-Age) — 3 sections (text/data/.rsrc), older plain packer, no virtualization engine.

Second crash signature (Bun 1.4.0, standalone executable)

This is the Bun runtime embedded in Anthropic's Claude Desktop (Claude Code 2.1.205), which is how I originally hit this. Same fault, same module:

Bun v1.4.0 (63bb0ca0d) Windows x64 (baseline)
Windows v10.26100
CPU: sse42 avx avx2
Features: Bun.stdin(2) jsc spawn standalone_executable claude_code
Elapsed: 233ms | RSS: 0.20 GB | Peak: 0.20 GB | Faults: 48935 | Machine: 33.72 GB
panic(thread 26712): Segmentation fault at address 0x3C
https://bun.report/1.4.0/e_163bb0camggggEkgggCCYnpggNT64.desy2TCYnpggNT64.desynouE_A2A4D

Frames: 0x2769 and 0x239079, both in npggNT64.des. Those offsets map onto the crashing build's sections as:

• 0x2769 → .text (native hook stub, RVA 0x1000–0x30f72)
• 0x239079 → .vlizer (virtualization engine, RVA 0x5d000–0x33ca00)

i.e. the injected hook enters at the native stub, calls into the virtualized engine, and faults there.

Open questions

• Why Bun specifically? GameGuard injects broadly, but other processes on the same desktop survive. Something about Bun's process state seems to make GameGuard's hook read null at +0x3C. I have not been able to establish what, and I have deliberately not attached a debugger to the game or the anti-cheat.
• Where a fix belongs is genuinely unclear. The faulting instruction is inside GameGuard's own virtualized code on its injected thread, so Bun cannot patch it directly. But if GameGuard is relying on an assumption about process state that Bun uniquely violates, a Bun-side mitigation may be possible. I'm raising it here because Bun is the only runtime I've seen this kill, and because the crash reporter attributes it to Bun.
• GameGuard offers no exclusion list by design, and npggNT64.des is integrity-checked, so there is no safe user-side fix on the anti-cheat side.

Possibly related

#27940 reports the identical fault address (0x3C) with a Bun-based app. It may be the same cause if that reporter has GameGuard installed.

Environment

• Windows 11, build 10.0.26100 (24H2)
• CPU: sse42, avx, avx2 (no avx512)
• RAM: 33.72 GB
• nProtect GameGuard, npggNT64.des SHA-256 4227ed49…4f199, PE date 2025-04-21