reth crashes at startup under sanitizer builds when jemalloc is enabled

[akidry]

Copy-Paste Issue (reth bug.yml format)

Describe the bug

reth crashes at startup under sanitizer builds when jemalloc is enabled (default features).

• MSAN (-Zsanitizer=memory): reth --version exits with RC=139 (SIGSEGV).
• ASAN (-Zsanitizer=address): default-feature binary also exits with RC=139.
• The same sanitizer builds run past startup when jemalloc is excluded.

This blocks sanitizer-based runtime validation on the default startup path.

Steps to reproduce

1. Build reth with MSAN and default features.

cd /home/as/pwn/web3/reth
RUSTFLAGS="-Zsanitizer=memory" \
RUSTDOCFLAGS="-Zsanitizer=memory" \
CARGO_TARGET_DIR=target-msan-default \
cargo +nightly build -Zbuild-std --target x86_64-unknown-linux-gnu -p reth

2. Run:

./target-msan-default/x86_64-unknown-linux-gnu/debug/reth --version

3. Observe crash (RC=139).

Control checks:

4. Build with MSAN, no default features:

RUSTFLAGS="-Zsanitizer=memory" \
RUSTDOCFLAGS="-Zsanitizer=memory" \
CARGO_TARGET_DIR=target-msan-no-default \
cargo +nightly build -Zbuild-std --target x86_64-unknown-linux-gnu -p reth --no-default-features

5. Run:

./target-msan-no-default/x86_64-unknown-linux-gnu/debug/reth --version

6. Observe success (RC=0).

Default-equivalent minus jemalloc also succeeds:

RUSTFLAGS="-Zsanitizer=memory" \
RUSTDOCFLAGS="-Zsanitizer=memory" \
CARGO_TARGET_DIR=target-msan-default-minus-jemalloc \
cargo +nightly build -Zbuild-std --target x86_64-unknown-linux-gnu -p reth \
  --no-default-features \
  --features "otlp,otlp-logs,reth-revm/portable,js-tracer,keccak-cache-global,asm-keccak,min-debug-logs,rocksdb"

./target-msan-default-minus-jemalloc/x86_64-unknown-linux-gnu/debug/reth --version

Node logs

MSAN failure stack (gdb, key frames):

• obtain_malloc_conf / malloc_conf_init_helper (jemalloc.c)
• _dl_lookup_symbol_x resolving __isoc99_printf
• GetFuncAddr / InterceptFunction
• InitializeInterceptors / __msan_init
• crash at 0x0000000000000000

ASAN default-feature run also exits with RC=139.

Platform(s)

Linux (x86)

Container Type

Not running in a container

What version/commit are you on?

reth --version output (from non-crashing sanitizer control binary):

Reth Version: 1.11.0-dev
Commit SHA: bb1b9ec611dc8c0ee75bfc69b94609a243186df8
Build Timestamp: 2026-02-21T05:50:59.565640143Z
Build Features:
Build Profile: debug

Toolchain:

rustc 1.95.0-nightly (7f99507f5 2026-02-19)
LLVM version: 22.1.0

What database version are you on?

Not applicable to this repro path.

This issue reproduces on reth --version before node startup.
reth db version was not usable in this environment without an initialized datadir (Datadir does not exist).

Which chain / network are you on?

mainnet (default)

What type of node are you running?

Archive (default)

What prune config do you use, if any?

None

If you've built Reth from source, provide the full command you used

Failing command (MSAN default):

RUSTFLAGS="-Zsanitizer=memory" \
RUSTDOCFLAGS="-Zsanitizer=memory" \
CARGO_TARGET_DIR=target-msan-default \
cargo +nightly build -Zbuild-std --target x86_64-unknown-linux-gnu -p reth

Passing control (MSAN no default features):

RUSTFLAGS="-Zsanitizer=memory" \
RUSTDOCFLAGS="-Zsanitizer=memory" \
CARGO_TARGET_DIR=target-msan-no-default \
cargo +nightly build -Zbuild-std --target x86_64-unknown-linux-gnu -p reth --no-default-features

Code of Conduct

• I agree to follow the Code of Conduct

Attachments / evidence logs

• web3/bug-bounty/hackerone/今世/results/phase2/D07/raw/reth-msan-default-build-2026-02-21.log
• web3/bug-bounty/hackerone/今世/results/phase2/D07/raw/reth-msan-default-version-2026-02-21.log
• web3/bug-bounty/hackerone/今世/results/phase2/D07/raw/reth-msan-default-gdb-2026-02-21.log
• web3/bug-bounty/hackerone/今世/results/phase2/D07/raw/reth-msan-no-default-version-2026-02-21.log
• web3/bug-bounty/hackerone/今世/results/phase2/D07/raw/reth-msan-default-minus-jemalloc-version-2026-02-21.log
• web3/bug-bounty/hackerone/今世/results/phase2/D07/raw/reth-asan-default-version-2026-02-21.log
• web3/bug-bounty/hackerone/今世/results/phase2/D07/raw/reth-asan-no-default-version-2026-02-21.log
• web3/bug-bounty/hackerone/今世/results/phase2/D07/raw/reth-asan-no-default-version-no-lsan-2026-02-21.log