Integer divide-by-zero in RAGE physics code at GTA5_b3258.exe+14D1A7D (three-magnesium-muppet), only on Intel Core Ultra 200S (Arrow Lake) CPUs #4382

What happened?

Players with Intel Core Ultra 200S desktop CPUs crash with GTA5_b3258.exe+14D1A7D (legacy hash three-magnesium-muppet). The crash happens on unrelated servers, so it does not look like it is caused by server content.

We compared 21 minidumps:

• 1 from a player on our server (2026-11-07)
• 20 that another player attached publicly to https://forum.cfx.re/t/crash-hash-three-magnesium-muppet/5376693 (2026-01-09, three different servers)

All 21 dumps are the same:

• Exception 0xC0000094 (EXCEPTION_INT_DIVIDE_BY_ZERO) at GTA5_b3258.exe+14D1A7D, on MainThrd.
• The divisor is 0 (rcx = 0, rdx = 0). The dividend is always rax = r8 * 8, where r8 is a count that changes from crash to crash (1 to 677 across the 21 dumps). r13 = 7, r14 = 0xFFFFFFFF, r12 = 0 and rbx = 0 in every dump. rsi and r11 point to two adjacent globals, +2F1AA58 and +2F1AA68.
• The return addresses are the same: +14BA535 ← +14BDB7D ← +14E2A94 ← +6DE8A8 ← +6DF744 ← +93F763.

Where this code is (from the b3258 GTA5.exe, sha1 17183412df26a019386ffd5097df697d9041bb3d):

• .pdata says the crash is inside the function starting at +14D18F0 (size 0x218).
• +14E299C (the third caller) is slot 39 of a vtable at +1BB8B60 in .rdata. Next to that vtable are RAGE physics strings: the constraint type names (cylindrical, half-space, hinge, fixedrotation, attachment, prismatic, spherical) and UpdateCollidersTask / ProcessPairListTask. The largest group of .rdata pointers into +14B0000–+14E5000 (189 of about 300) is in this physics area. Most of the other groups are next to fragment, bound and NaturalMotion strings. So we think the crash is in the physics simulator or collision code.
• We could not read the instructions, because .text is encrypted in the file.

What the 21 dumps have in common is the CPU:

Family 6, model 0xC6 is Arrow Lake-S. 20 logical processors with no SMT matches the Core Ultra 7 265K / 265KF / 265F.

As a comparison, we also checked a dump from a different player on our server (2026-10-31). It has the same Windows build (26300) and an NVIDIA RTX 5070 Ti, but an AMD CPU (ProcessorLevel 26). That player crashed for an unrelated reason (+168F5DB) and has never hit +14D1A7D.

The number of RAGE worker threads is the same on both CPUs: 20 × sysThread (0x14131d894) and 10 × sysThread (0x14131d9a8). So the divisor does not seem to be a worker thread count.

On our server, this crash happened 15 times since 2026-10-14, to only 2 players (11 to one of them). That player played on 27 days since 2026-10-08 and crashed on 2 of them. On those days, the crash came back every 12 to 81 minutes, even after reconnecting. We looked at our client telemetry (sampled every 30 seconds) right before each crash. The location, activity, FPS, nearby ped/vehicle/object counts and streaming state had nothing in common. The forum user crashes in almost every session, 2 to 35 minutes after spawning.

Expected result

No crash.

Reproduction steps

We can't reproduce it on demand. What the reports have in common:

1. Use a PC with an Intel Core Ultra 200S desktop CPU (for example Core Ultra 7 265K)
2. Join any server on game build 3258 and play normally
3. The client crashes at GTA5_b3258.exe+14D1A7D after a few minutes to about an hour. Not every session crashes.

Importancy

Crash

Area(s)

FiveM

Specific version(s)

FiveM client 23069 and 38410, game build 3258, server builds 20559 / 23683 / 23918 / 37850

Additional information

• The 20 public dumps are attached to the forum thread above.
• Our player's dump contains their personal data, so we have not attached it. We can share it privately, or ask the player for a full dump (https://forum.cfx.re/t/enabling-and-uploading-full-client-dumps/1138940) so the decrypted code can be checked.
• We have only seen this on build 3258 and have not tested other game builds.