[SM8850] SIGSEGV crash in TensorBuffer.readFloat() on Snapdragon 8 Elite (Samsung S25 Ultra)

[carrycooldude]

Description

LiteRT 2.1.1 consistently crashes with SIGSEGV during TensorBuffer.readFloat() on Samsung Galaxy S25 Ultra (Snapdragon 8 Elite / SM8850). The crash affects BOTH NPU and GPU accelerators at the identical memory address, indicating a fundamental runtime bug rather than accelerator-specific issues.

Environment

• Device: Samsung Galaxy S25 Ultra (SM-S938B)
• Chipset: Snapdragon 8 Elite (SM8850)
• Android: 16+
• LiteRT Version: 2.1.1 (com.google.ai.edge.litert:litert:2.1.1)
• Architecture: ARM64-v8a
• Model: DeepLab v3 (513×513×3 input, 513×513×21 output, Float32)

Crash Signature

Fatal signal 11 (SIGSEGV), code 2 (SEGV_ACCERR)
fault addr: 0xb400007397d71000

Critical: NPU and GPU crash at identical memory address

Reproduction Steps

Code follows Google's official android_jit reference implementation exactly:

// 1. Environment & model initialization (SUCCEEDS)
val environment = Environment.create(BuiltinNpuAcceleratorProvider(context))
val accelerator = BuiltinNpuAcceleratorProvider.create(environment) // or GpuAccelerator
val options = CompiledModel.Options(accelerator).apply {
    qualcommOptions = CompiledModel.QualcommOptions(
        htpPerformanceMode = HtpPerformanceMode.HIGH_PERFORMANCE
    )
}
val model = CompiledModel.create(environment, "deeplab.tflite", options)

// 2. Inference execution (SUCCEEDS)
inputBuffers[0].writeFloat(preprocessedData)
model.run(inputBuffers, outputBuffers)  // ✅ Completes successfully

// 3. Buffer reading (CRASHES HERE)
val outputFloatArray = outputBuffers[0].readFloat()  // ❌ SIGSEGV

Test Results

NPU Test

D ImageSegmentation: Created an image segmenter with accelerator: NPU
D ImageSegmentation: Model.run() time: 513 ms
F DEBUG: Fatal signal 11 (SIGSEGV), code 2 (SEGV_ACCERR), fault addr 0xb400007397d71000

GPU Test

D ImageSegmentation: Created an image segmenter with accelerator: GPU
D ImageSegmentation: Model.run() time: 1 ms
F libc: Fatal signal 11 (SIGSEGV), code 2 (SEGV_ACCERR), fault addr 0xb400007397d71000

Same fault address for both accelerators!

Stack Trace

#09 pc 00000000001ef458 litert.so (TensorBuffer.access$nativeReadFloat+0)
#14 pc 00000000001eeab4 litert.so (TensorBuffer$Companion.nativeReadFloat+0)
#24 pc 00000000001ef474 litert.so (TensorBuffer.readFloat+0)
#29 pc 0000000000006f04 base.apk (ImageSegmentationHelper$Segmenter.segment+0)

Analysis

Why This Indicates a Runtime Bug

1. ✅ Model initialization succeeds for both NPU and GPU
2. ✅ model.run() executes successfully (inference completes)
3. ❌ Crash occurs during buffer read after successful inference
4. 🔴 Identical crash address for NPU and GPU proves this is shared runtime code, not accelerator drivers
5. 🔴 SEGV_ACCERR = memory access permission error (buffer exists but lacks proper access)

Hypothesis

Snapdragon 8 Elite introduced new memory protection for HTP/GPU shared buffers. LiteRT 2.1.1 (likely released before SM8850 testing was possible) doesn't correctly request permissions for these protected memory regions on this new chipset.

Code Alignment

Our implementation exactly matches Google's official reference:

• Repository: google-ai-edge/litert-samples
• Path: compiled_model_api/image_segmentation/kotlin_npu/android_jit
• Same environment creation, Qualcomm options, and buffer handling code

Workaround

✅ CPU-only inference works (but without hardware acceleration benefits)

// Temporary workaround
val priorities = listOf(AcceleratorEnum.CPU)  // Skip NPU/GPU

Impact

• Severity: Critical
• Scope: All SM8850 devices (Samsung S25 series)
• Hardware Affected: NPU and GPU (CPU works)
• Users Impacted: Anyone using LiteRT on latest Snapdragon flagship

Expected Behavior

TensorBuffer.readFloat() should successfully read output tensors without crashing, as it does on older chipsets and with CPU acceleration.

Actual Behavior

TensorBuffer.readFloat() triggers SIGSEGV with memory access permission error on NPU and GPU accelerators.

Request

Could the LiteRT team:

1. Test on actual SM8850 devices (S25 Ultra)
2. Update QNN runtime libraries for Snapdragon 8 Elite support
3. Fix memory access handling for SM8850's HTP architecture
4. Add SM8850 to CI/CD testing pipeline

Additional Information

• SM8850 launched Q1 2025 (recent, may not have been tested during LiteRT 2.1.1 development)
• Full reproduction code and logs available upon request
• Willing to provide further testing/debugging assistance

---

Urgency: High - This affects Google's latest flagship chipset support and blocks hardware acceleration for a major device line.

[shivaylamba]

I am also facing the same issue. Thanks for bringing this up @carrycooldude

[aravindmurali22]

Hi @carrycooldude,

The SIGSEGV (SEGV_ACCERR) occurring at identical addresses for NPU and GPU suggests an issue with HardwareBuffer mapping or synchronization on the Snapdragon 8 Elite (SM8850).

To help us investigate, could you please verify:

1. Does the crash persist using the standard Interpreter api instead of CompiledModel?
2. Does this occur with other types (e.g., readInt()) or only floats?
3. Does disabling HIGH_PERFORMANCE in QualcommOptions change the behavior?

Thanks for testing on the latest hardware!

[carrycooldude]

Hi @carrycooldude,

The SIGSEGV (SEGV_ACCERR) occurring at identical addresses for NPU and GPU suggests an issue with HardwareBuffer mapping or synchronization on the Snapdragon 8 Elite (SM8850).

To help us investigate, could you please verify:

1. Does the crash persist using the standard Interpreter api instead of CompiledModel?
2. Does this occur with other types (e.g., readInt()) or only floats?
3. Does disabling HIGH_PERFORMANCE in QualcommOptions change the behavior?

Thanks for testing on the latest hardware!

Hey @aravindmurali22 , I tried on CompiledModel API and yes it happened in both the types Int and float and for third I didn't tried that.