Five of the nine medium findings from the pf-encode sweep. The remaining four
need cross-crate plumbing or an unwind refactor and are deliberately left out.
- vulkan_video `enqueue` waited on the backpressure fence with `u64::MAX`. That
wait runs ON the host encode thread — the same thread the stall watchdog's
`reset()` would run on — so a wedged GPU parked the one thread that could
recover the session: no error, no reset, and teardown blocking on the join.
This is the DEFAULT encode path for AMD/Intel Linux hosts (both shipped build
recipes enable `vulkan-encode` and `vulkan_encode_enabled()` defaults true).
Now bounded by ENCODE_FENCE_TIMEOUT_NS with expiry surfaced as an error.
- vulkan_video `import_cached` evicted a cached dmabuf import and destroyed its
image/view/memory with no fence wait, while up to `ring_depth - 1` submitted
frames may still reference it — a GPU-side use-after-free. `Drop` and `reset`
both idle first; this was the one unguarded destroy. Now idles before the
eviction loop, guarded on the length test so the steady state pays nothing.
- vulkan_video `read_slot` never asked for the encode's operation status, so a
FAILED encode was indistinguishable from a successful one and its feedback
was read as if it described real bitstream. Now requests WITH_STATUS_KHR and
refuses anything that is not COMPLETE.
- linux/pyrowave `encode_frame` opens its recording window early and has six
fallible steps inside it; every one returned with `cmd` still RECORDING, and
nothing repaired it (one `begin_command_buffer` in the file, and neither
`reset()` nor `Drop` touches `cmd`), so the next frame called `begin` on a
recording buffer — invalid usage. `submit` now resets the buffer on error;
legal on all these paths since the pool carries RESET_COMMAND_BUFFER and the
buffer is not pending.
- windows/pyrowave `encode_frame` ignored `frame.width`/`height` and imported
planes at the encoder's configured extent, so a ring recreate at a new mode
(the IDD capturer does this autonomously on a confirmed descriptor change)
read the planes under a stale VkImageCreateInfo. Added the size guard its QSV
and AMF siblings already carry, and keyed the plane cache on
(address, width, height) so a recycled COM address cannot resurrect an import
of a different size. NOTE: a recycle at the SAME size is still theoretically
possible; the complete fix keys on the capturer's ring generation and needs
that plumbed onto `PyroFrameShare`.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
enricobuehler
a38adad943