Mass client crash via ped variation corruption (proximity, ~22 victims/73s on production)

[mfrischbutter]

What happened?

Single attacker crashed ~22 player clients within 73 seconds on a populated production server (~180 concurrent). Crash sites in GTA5_b3258.exe cluster on a small set of fixed offsets that all resolve to the ped variation/render pipeline, indicating a clone-sync of malformed CPed component variation data — distinct from the duplicate CNetObjPlayer clone variant patched in #3755.

Crash signatures observed
Distinct disconnect reasons during the burst, from server log:

Reason	Victims
GTA5_b3258.exe+520B27	9
GTA5_b3258.exe+8ECBB7	4
GTA5_b3258.exe+51D47E	4
GTA5_b3258.exe+8ECAEF (other days, same campaign)	recurring
GTA5_b3258.exe+1518F38	1
0x0 (null deref)	2
0x245be7b2360 (garbage pointer)	1
Connection timed out (collateral)	1

All ped-render / variation-pipeline frames. The mix of fixed offsets plus null/garbage derefs is consistent with the receiving client calling CPed::SetVariation() / CPedVariationStream::ApplyStreamPedFiles with attacker-supplied (slotId, drawableId, textureId) triplets that fail
component-table lookups.

Burst timeline (UTC)
17:40:09 first crash
17:40:09–17:40:55 burst peak: 18 crashes in 46 seconds
17:41:01 anticheat ban (antiPed) fires on the source player
17:41:22 last crash from the burst

Why this isn't PR #3755

• Artifact 25770 already contains PR fix(citizen-server-impl): prevent clients from creating multiple CNetObjPlayer #3755 (prevent clients from creating multiple CNetObjPlayer), merged 2026-01-05. The attack still landed.
• The server-side entity logger captured only one normal CREATE_PED from the attacker before the burst (the standard player_zero spawn). No additional peds, no model swap via native. The malicious payload appears to ride existing clone updates on the attacker's own player ped — not
  new entity creation. That's why the dup-clone hardening doesn't catch it.
• Anticheat fired antiPed for invalid variation, not for clone duplication.

Related public reports

• New Crash Method from Cheat Menus #3727 "New Crash Method from Cheat Menus" (Nov 2025) — same proximity-crash MO, attribution to commercial cheat menus, still open.
• [Crash/Exploit] Mass Client Crash - island-texas-floor (GTA5_b3258.exe!sub_1411D3FA8) #3751 "Mass Client Crash - island-texas-floor" (Dec 2025) — +1518FA8 ≈ same rage::netObject::Update code page as our +1518F38, fixed for the dup-clone variant by fix(citizen-server-impl): prevent clients from creating multiple CNetObjPlayer #3755 but the variation-data variant remains.
• Crash exploit: cheater can crash all nearby players #3629 "Crash exploit: cheater crashes all nearby players" (Sep 2025) — same pattern, older artifact.

Expected result

a malformed variation update from one client should not crash any other client. The same validation philosophy applied to clone identity in #3755 needs to extend to clone payload contents for CPed variation.

Reproduction steps

1. Stand up an FXServer on artifact 25770 (current recommended channel) with OneSync infinity enabled and a populated session (~20+ clients within network scope is enough to observe the cascade).
2. Connect an attacker client running a commercial cheat menu with a "ped crasher" / "model crasher" / "ped variation crash" feature (publicly advertised in Eulen, redENGINE, Susano feature lists as of mid-2026). Spawn a normal player ped (player_zero or any default model) — no new
   CREATE_PED required.
3. Trigger the menu's ped-variation crash function. Under the hood it mutates the local CPed's component variation state to invalid (slotId, drawableId, textureId) triplets and lets the standard OneSync clone-sync broadcast the updated state.
4. Observe nearby clients begin crashing within seconds. Disconnect reasons in the server log will cluster on a small set of fixed GTA5_b3258.exe offsets in the ped-render / variation pipeline (e.g. +520B27, +8ECBB7, +51D47E, +8ECAEF), with occasional null derefs (0x0) and
   garbage-pointer derefs depending on which component table entry was hit.
5. Confirm sc-entitylogg / any server-side entityCreating hook records no additional ped creation from the attacker during the burst — the payload rides existing clone-update traffic on the attacker's own player ped, which is why server-side CREATE_PED filters and the PR fix(citizen-server-impl): prevent clients from creating multiple CNetObjPlayer #3755
   dup-clone guard both miss it.

Importancy

Crash

Area(s)

FiveM

Specific version(s)

FXServer artifact 25770 (linux, recommended channel) — also reproducible/reported on earlier artifacts in the 19400–25770 range that already contain PR #3755. Game build b3258.

Additional information

Environment

• FXServer artifact: 25770 (linux, currently "recommended" channel)
• Game build: b3258
• Sync mode: OneSync (infinity)
• Third-party anticheat (ElectronAC) detection: antiPed — variation/component validation on the receiving client

[Gogsi]

GTA5_b3258.exe+520B27
GTA5_b3258.exe+8ECBB7
GTA5_b3258.exe+51D47E
GTA5_b3258.exe+8ECAEF
and likely 0x0

will all be fixed by #4024

[RrybaN]

Experienced this also on game build 3570

waiting to merge the PR #4024

[Gogsi]

Client-side workaround scripts: deletes bad objects

local BLOCKED = {
    [`patrolboat`] = true,
    [`barracks`] = true, 
    [`dune`] = true, 
    [`minitank`] = true, 
}

CreateThread(function()
    while true do
        Wait(10)

        for _, ent in ipairs(GetGamePool("CObject")) do
            if DoesEntityExist(ent) and BLOCKED[GetEntityModel(ent)] then
                SetEntityAsMissionEntity(ent, true, true)
                DeleteEntity(ent)
            end
        end
    end
end) 

It might still crash a few people if you are unlucky. You can also check if the current client owns the object and flag it to the server for a kick/ban.