Crashes with "BGSPackage..."

[nopse0]

I quite often (once a week or so) have crashes with "BGSPackage..." in the registers and the stackdump, e.g:

 

REGISTERS:
	RAX 0x1794CA36590      (BGSPackageDataBool*)
	RCX 0x1794CA36588      (void*)
	RDX 0xA3EEFF5C0        (void*)
	RBX 0x1794CA36588      (void*)
	RSP 0xA3EEFF5A0        (void*)
	RBP 0x1794BEA4080      (BGSProcedurePursue*)
	RSI 0x17A436FFE88      (void*)
	RDI 0x0                (size_t) [0]
	R8  0x0                (size_t) [0]
	R9  0x1794CA36590      (BGSPackageDataBool*)
	R10 0x178811712B8      (void*)
	R11 0x2                (size_t) [2]
	R12 0x0                (size_t) [0]
	R13 0x17A436FFE70      (BGSProcedureFollowExecState*)
	R14 0xA3EEFF720        (void*)
	R15 0x2                (size_t) [2]

 

Is this related to the "Package Override" functions of "PapyrusUtil SE" ? I saw that PapyrusUtilDev.log was last modified at the same time I had the crash:

Package[151053582] Priority[100] Flag[1]
Override Picked -- Package[2186678912] Priority[100] Flag[1]
Package[151053582] Priority[100] Flag[1]
Override Picked -- Package[2186678912] Priority[100] Flag[1]
Package[151053582] Priority[100] Flag[1]
Override Picked -- Package[2186678912] Priority[100] Flag[1]

 

Is something known about this ?

crash-2025-05-29-09-01-49.log

 

Edit: I overwrite the PapyrusUtils version, SexLabFrameworkAE_v166b comes with, with the newest PapyrusUtil (4.6) from NexusMods, is this perhaps the problem ?

 

Edited May 29, 2025 by nopse0

[traison]

Package reference id 0xFF0011A0 of form id 0x0001981E "Solaf" in 0x00013A76 "FalkreathGrayPineGoods" has a null pointer in it. Judging by the class names BGSProcedurePursue and BGSPackageDataLocation I'm going to say Solaf was going to pursue a location; maybe the location is (or was supposed to be) an actor. The location may have been form id 0x14 "Lola".

 

48 minutes ago, nopse0 said:

Is this related to the "Package Override" functions of "PapyrusUtil SE" ?

 

At this point I would assume its a possibility. You're having issues with Packages, and if PapyrusUtil contains something to mess with those it shouldn't be ruled out. Finding something like this in a debugger is potentially quite complicated, so for now I would inspect 0xFF0011A0 and go from there.

 

48 minutes ago, nopse0 said:

...with the newest PapyrusUtil (4.6) from NexusMods, is this perhaps the problem ?

 

Changing the version seems like a reasonable test to do. Newest (assuming 4.6 is newest) is not always the best.

Edited May 29, 2025 by traison

[nopse0]

Hm, I guess then, this is a racing condition between SexLab and RandomSexNG, because my player char "Lola" was having sex with "Solaf", when the game crashed. Maybe the reference alias "VictimAlias" in the "RndSexActivityThread" quests gets invalid, when having sex. How can I find out, whats behind (base form)  a dynamically created reference id ?

[traison]

41 minutes ago, nopse0 said:

How can I find out...

 

As far as I know the only way to get anywhere close to this is with a debugger. That requires bypassing DRM and debugger traps. All you'd get out of this is raw bytes obviously, so you'd need extensive knowledge of game structures to determine where things are. For this I'd use the source code of SKSE and CommonLibSSE. I think this would be a 3-4 day job, assuming no problems arise.

 

41 minutes ago, nopse0 said:

...whats behind (base form)  a dynamically created reference id ?

 

If this reference id doesn't exist in xEdit (try subtracting 0xFF000000 from the reference id) then I would assume some temporary object is behind the reference. I don't know enough about packages or the engine to say any more than that.

 

I don't recall ever seeing the game engine making up AI packages. As far as I know, there is no temporary AI packages, nor a template or mechanism from which packages are made. Packages can reference eachother, but they all have their own form id. I would assume at most this package reference references a temporary copy of an already existing package. If you have a mod you suspect as being the cause of the issue, go through its packages and look for ones that may have something to do with "Pursue".

 

41 minutes ago, nopse0 said:

...this is a racing condition between SexLab and RandomSexNG, because my player char "Lola" was having sex with "Solaf", when the game crashed. Maybe the reference alias "VictimAlias" in the "RndSexActivityThread" quests gets invalid...

 

Not sure if these are the mods involved, but it could be a classic use-after-free (i.e. a kind of race condition like you said) issue where something was using a reference when something else cleared it.

Edited May 29, 2025 by traison

[nopse0]

I think it's RandomSexNG. I saw in the .esp file, that it gives attackers a travel package, which has as destination location a "victimAlias". Could be, that sometimes "victimAlias" is None, when concurrently a SexLab scene starts between the attacker and the victim. I also saw, that SexLab uses "PapyrusUtil SE" to add package overrides to actors, maybe that's a problem, too.