[LLM][Android 16] SIGSEGV in libllm_inference_engine_jni.so on first generate() after model load (Pixel 6 Pro, tasks-genai 0.10.35)

## Have I written custom code (as opposed to using a stock example script provided in MediaPipe) Yes — Kotlin app calling `LlmInference.createFromOptions(...)` then `LlmInferenceSession.generateResponse(prompt)` from a Kotlin coroutine on `Dispatchers.Default`. ## OS Platform and Distribution Android 16 (API 36), Pixel 6 Pro (raven), build `google/raven/raven:16/CP1A.260305.018/14887507:user/release-keys`, security patch 2026-03-05. ## MediaPipe Tasks SDK version `com.google.mediapipe:tasks-genai:0.10.35` (the latest on Google Maven as of 2026-04-27). ## Task name LLM Inference (`tasks-genai`). ## Programming Language and version Kotlin / Android (compileSdk 35, minSdk 33, targetSdk 35). ## Describe the actual behavior Native SIGSEGV inside `libllm_inference_engine_jni.so` on the **first** `generateResponse()` call after a successful model load, when invoked from a background coroutine in a `WorkManager`-style job context. Model used: `gemma-3-1b-int4.task` (~528 MB, sourced from a community mirror of `litert-community/Gemma3-1B-IT`, byte-identical SHA-256 to a known-good local copy that was previously verified working on the same physical device). Sequence: 1. App cold-starts. 2. `LlmInference.createFromOptions(...)` succeeds. 3. `LlmInferenceSession.create(...)` succeeds. 4. First `session.generateResponse(prompt)` call → SIGSEGV. The crash is **reproducible across cold restarts**. Java `try/catch (Exception)` does not catch it (native signal). Stack frame at the fault: ``` F libc : Fatal signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0 in tid 11483 (DefaultDispatch), pid 11464 F DEBUG : #00 pc 0000000000c11a14 libllm_inference_engine_jni.so (offset 0x53ac000) F DEBUG : #01 pc 0000000000c11990 libllm_inference_engine_jni.so (offset 0x53ac000) (Java_com_google_mediapipe_tasks_genai_llminference_LlmTaskRunner_nativePredictSync+132) F DEBUG : #07 pc 0000000000300254 com.google.mediapipe.tasks.genai.llminference.LlmTaskRunner.predictSync+0 F DEBUG : #12 pc 00000000002ff518 com.google.mediapipe.tasks.genai.llminference.LlmInferenceSession.generateResponse+0 F DEBUG : #17 pc 00000000002ffb7c com.google.mediapipe.tasks.genai.llminference.LlmInference.generateResponse+0 ``` ART warning logged ~6 seconds before the first generate call: ``` W app.storied: userfaultfd: MOVE ioctl seems unsupported: Connection timed out ``` This is from the ART runtime's heap GC compaction (Android 14+ uses `userfaultfd MOVE` for concurrent compaction). The kernel on this device returns `ETIMEDOUT` for that ioctl. It is not clear from the public surface whether MediaPipe's LLM engine takes a code path that depends on that ioctl succeeding, but the timing strongly correlates. ## Describe the expected behaviour Either (a) `generateResponse` should succeed and return generated tokens, or (b) it should throw a Java exception (e.g. `MediaPipeException`) that the application can handle, rather than crashing the host process via SIGSEGV. ## Standalone code/steps you may have used to try to get what you need ```kotlin val opts = LlmInferenceOptions.builder() .setModelPath(modelPath) // /storage/emulated/0/Android/data/<pkg>/files/models/gemma-3-1b-int4.task .setMaxTokens(512) .setMaxTopK(40) .build() val llm = LlmInference.createFromOptions(context, opts) val session = LlmInferenceSession.createFromOptions( llm, LlmInferenceSessionOptions.builder() .setTopK(40) .setTemperature(0.7f) .build() ) // Crashes here with SIGSEGV — first call after fresh load: val response = session.generateResponse("Summarize the day in two sentences.") ``` ## Other info / Complete Logs Full tombstone available on request. Workaround we deployed: a circuit-breaker that persists a "last attempt timestamp" before each `generateResponse` call and a "last success timestamp" after, and skips the call on next launch if the previous attempt did not reach success within 60 seconds (assume native crash). This stops a debug-only crash loop where our app eagerly invoked LLM inference shortly after cold start, but it does not address the underlying issue — production callers (e.g. a nightly recap WorkManager job) still hit the SIGSEGV on the first inference of the day. A previous run on the same device with the same APK + same model file was confirmed working ~7 days ago, before a Pixel firmware update to security patch 2026-03-05. We have not yet been able to test a downgrade to a prior security patch level to confirm whether it is specifically related to the patch. Happy to provide a minimal-repro APK or our full logcat tail if useful.