Dear Maintainer,

kwin_wayland crashes with SIGSEGV when the set of outputs changes,
most often on resume from suspend while connected to an MST docking
station. On Wayland this takes down the whole session: plasmashell,
Firefox and Chromium all die alongside the compositor.

This is upstream KDE bug 504959, RESOLVED FIXED with 14 duplicates,
released in Plasma 6.4.5. Trixie ships 6.3.6 and is affected.

Frequency here: 7 kwin_wayland crashes in the last 14 days according
to coredumpctl. It is a race, so it does not reproduce on every
suspend cycle, but it recurs reliably in normal use.

Hardware: ThinkPad P14s (Ryzen AI 9 HX PRO 370, Radeon 890M, amdgpu),
ThinkPad Thunderbolt 4 dock with Synaptics MST hub driving external
displays. Kernel 7.1.8 and Mesa 26.1.2 from trixie-backports, both
far newer than the bug, which rules them out as the cause. A BIOS
update and a hardware dock replacement made no difference either.

Note: this system has trixie-backports pinned at high priority, hence
the newer kernel and Mesa. The kwin packages themselves are stock
trixie 4:6.3.6-1 (Plasma is not in backports).

Symbolised backtrace, with libkwin6-dbgsym installed:

  #4  KWin::ColorManagementOutputV1::ColorManagementOutputV1(
        wl_client*, unsigned int, unsigned int, KWin::Output*)
      src/wayland/colormanagement_v1.cpp:580
  #5-7  ffi_call (libffi)
  #8-10 wl_event_loop_dispatch (libwayland-server)
  #11 KWin::Display::dispatchEvents()
      src/wayland/display.cpp:121

A client binds wp_color_management_output_v1 via wl_registry.bind;
libwayland dispatches into KWin's handler, which dereferences a
KWin::Output* belonging to an output that has already been torn down.
Backtraces in the upstream duplicates show output=0x0 at exactly this
line.

Upstream fix:

  master:      e1fd647b979df7f0bd10065932a614a2aa806e87
  Plasma/6.4:  598438b9bcb9487c9dc85e4eb5f84e3b73a71051
https://bugs.kde.org/show_bug.cgi?id=504959

The change is small: +16/-6 in src/wayland/colormanagement_v1.cpp and
+3/-4 in the corresponding header. It prevents the object from
dereferencing the output handle after the underlying output has been
removed, since wl_output removal is inherently racy.

I verified that the upstream Plasma/6.4 commit 598438b9 applies
cleanly to the Debian 4:6.3.6-1 source, on top of the existing
debian/patches series, with no offsets and no fuzz. The package
already carries a number of upstream cherry-picks in debian/patches,
so this would follow the established pattern.

The 6.3 series is end-of-line upstream, so trixie will not receive this
fix through any 6.3.x release. Please consider cherry-picking it for a
trixie point release.

I have not yet run a patched build; the identification rests on the
matching backtrace and the upstream report. I am happy to build and
test a patched package and report back, given the crash rate here is
roughly one every two days.

Note this is a different bug from #1143050, which is upstream 495702 in
Workspace::activateNextWindow() (src/workspace.cpp) and fixed in 6.4.6.
Both are output-removal races in 6.3.6 affecting docked setups, but the
code paths and the fixes are separate.

I can provide full core dumps or journal excerpts on request.