Reported by temurin/zulu users [1]. Example logs are from Zulu VM and temurin VM, 25.0.1+8-LTS.

Crashes in JDK 25 with Generational Shenandoah, with and without compact object headers.

We crash during concurrent Marking.

Either in Mutator, doing a Klass supertype check in interpreted code.
Or in GC threads, doing a Klass is-array check.

In all cases, we crash when processing an invalid Klass* resulting from decoding a garbage narrow Klass (null or otherwise invalid).

We crash when the resulting Klass* points into unmapped or protected space; so I assume this bug could also cause more diverse errors when it just happens to point to valid class space. With Lilliput in particular, there is a small chance that the bug causes a valid but wrong Klass* to be processed (due to the way the nKlass works in Lilliput). I have no examples of such crashes - just as a thought, there could be other errors attributable to this bug as well.

I have not been able to reproduce this locally.

JDK-8373350 may be a duplicate of this bug, but it contains not much info.

[1] https://github.com/adoptium/adoptium-support/issues/1386