IPC stability bugs, 2019 to now

This site lists every known stability bug in libmultiprocess and in Bitcoin Core's IPC code, from the library's first commits in 2019 to today. A stability bug here means a crash, assert, hang, deadlock, data race, undefined behavior or leak. Each bug has its own page: what happened, the root cause, the code, the fix, who reported it, and a timeline. The site also publishes the reports from independent security reviews of the IPC code done in 2026.

It is written for Bitcoin Core contributors and reviewers who know the IPC feature at a high level (separate processes talking over Cap'n Proto, the mining interface, Rust and Python clients) but not the library's internals. Library terms link to the glossary.

What the survey found

There are 102 records: 82 defects in production code, 13 bugs in test code, and 7 CI, build or example problems. The main results, explained on the findings page:

• About half of them are about tearing things down. Of the 82 production defects, 42 are triggered by a disconnect, a shutdown or a signal. More
• Old code, found late. Of the 73 production defects whose origin is known, 37 were in the library's first commits in 2019, but most were found after 2024, as new clients, tests and tools reached that code. More
• The cost to users was narrow. Eight defects were reported from real deployments, all in the mining interface and all hit by Stratum v2 software. More
• Detection moved from people to tools to review, and fixes got smaller. Some of those fixes caused the next bug. More
• The same mistakes recur. The 102 bugs fall into 11 patterns, each with the rule we learned. More

How to browse

• Bugs: all 102, with filters for status, symptom, trigger and year.
• Audit reports: the 79 reports from the 2026 security reviews.
• Explorer: charts of the records over time, with filters.
• Corrections: places where the explanation written at the time of a fix turned out to be partly wrong.
• Slides: a short talk on the survey for a Bitcoin Core developer meeting.

How this was made

The records were assembled from the git history of both repositories, their GitHub issues and pull requests, the maintainer's notes, and the 2026 security reviews. A second reader checked the first 86 records against the fix and the original reports; the 16 added in October 2026 were checked by the agent that wrote them. Language models did much of the triage, verification and drafting. Ryan Ofsky, the libmultiprocess maintainer, reviewed the results and made the judgment calls. The method page says what counts as a bug and how each page was checked.

Corrections are welcome on the linked GitHub issues and pull requests.