Hello,

This issue consolidates 100 reproducible CPython 3.14 bugs involving memory safety and concurrency.

The bugs resulted from Python security research using static analysis. Each entry has a concrete PoC in the linked version-specific Gist. Although the collection is large, these bugs warrant inspection, especially the cases producing interpreter crashes, sanitizer failures, memory corruption, or similarly concrete failures.

Bugs

1. array.fromlist() source-list element race — Same-size slot replacement can reclaim a borrowed list element before descriptor conversion uses it.
2. Code-assembly metadata dictionary race — Concurrent metadata resize can produce inconsistent CFG offsets and counts used by raw array writes.
3. AST __replace__() _field_types race — Concurrent dictionary mutation can invalidate borrowed _field_types entries during traversal.
4. Exporter-less buffered-I/O callback views — A retained callback memoryview can outlive the temporary or internal allocation it exposes.
5. bytearray.__init__() storage race — Concurrent initialization can leave one thread writing its old requested length through smaller or freed storage.
6. Codec-cache callable promotion race — Cache invalidation can destroy a selected codec callable before it is promoted.
7. codecs.unregister() search-path race — Two unregister calls can invalidate the saved list index and cause an unconditional null decrement.
8. _collections._count_elements() value race — Concurrent replacement can reclaim a borrowed dictionary value before the fast path increments it.
9. Shared Context HAMT iterator race — Concurrent next() calls can combine incompatible traversal levels, positions, and node pointers.
10. Cross-interpreter namespace dictionary race — Concurrent growth can overrun native namespace storage, while replacement can reclaim a value before conversion.
11. _ctypes.Structure _fields_ lifetime race — Concurrent deletion can release the _fields_ sequence after its dictionary snapshot is dropped but before construction uses it.
12. ctypes _anonymous_ list race — Concurrent clear or resize can invalidate raw list storage and borrowed field names during structure construction.
13. ctypes nested _fields_ list race — Anonymous-field expansion can consume invalidated list storage or reclaimed field tuples.
14. _curses.window.encoding double-free race — Concurrent setters can both free the same native encoding pointer.
15. Decimal formatting override race — Concurrent replacement can reclaim a borrowed override string before UTF-8 conversion.
16. Decimal signal dictionary race — Concurrent replacement can reclaim a signal value before truth testing dispatches through it.
17. dict.update() sequence-pair race — Concurrent replacement can destroy a borrowed key or value before destination insertion.
18. Element.append() and Element.clear() race — Append can dereference detached representation state or write through freed child storage.
19. Element.get() attribute-reset race — Concurrent reset can free the extra representation and attribute dictionary before the reader owns them.
20. Element child-reader race — Structural mutation can detach child storage between validation and borrowed-child promotion.
21. Element structural-writer race — Concurrent writes can move, overwrite, or decrement child storage another operation has freed or replaced.
22. XML parser entity-value race — Concurrent entity replacement can reclaim a borrowed value before or during TreeBuilder use.
23. Element.get() dictionary-value promotion race — Concurrent attribute replacement can reclaim the returned value before Py_XNewRef() promotes it.
24. XMLParser._setevents() input-list race — Concurrent clear or refill can invalidate the saved size, list entry, or bytes storage.
25. Element shared-list input race — extend(), slice assignment, and __setstate__() can consume invalidated list storage or unpinned children.
26. Concurrent XMLParser.feed() state corruption — Simultaneous parser methods can corrupt shared Expat, handler, cache, and error state.
27. float(bytearray) storage race — Concurrent resize can relocate the bytearray while numeric parsing uses its earlier pointer and size.
28. CFG constants-list race — Concurrent clear or refill can reclaim a constant or invalidate list storage during optimization.
29. FrameLocalsProxy traversal race — Extra-local deletion or replacement can reclaim dictionary entries before result construction promotes them.
30. functools.partial.__setstate__() state race — Concurrent mutation can expose reclaimed argument storage or an incoherent mixture of partial fields.
31. gc.callbacks promotion race — List mutation can reclaim a borrowed callback before the collector promotes and invokes it.
32. Concurrent generator frame entry — Two threads can enter and concurrently corrupt the same embedded interpreter frame.
33. CFG conversion and InstructionSequence growth race — Concurrent growth can reallocate an instruction array while CFG conversion retains raw pointers into it.
34. Concurrent InstructionSequence method race — Concurrent array growth and snapshots can lose updates, double-free allocations, or traverse moving storage.
35. itertools.pairwise() state race — Shared next() calls can promote stale state, over-decrement an element, or simultaneously reuse one result tuple.
36. itertools._tee_dataobject() values-list race — Concurrent clear or resize can invalidate bounds and reclaim a value before promotion.
37. _json exact-dictionary traversal race — Concurrent mutation can reclaim a borrowed key or value before encoding owns it.
38. _json custom-mapping items-list race — An externally retained items list can replace and reclaim a tuple before recursive encoding.
39. _json sequence traversal race — Concurrent element replacement can destroy the last owner before promotion or recursive use.
40. _locale.setlocale() return-pointer race — A concurrent locale change can free libc's process-global string while another thread decodes it.
41. marshal.dumps() container traversal race — Concurrent mutation can invalidate list storage or reclaim dictionary entries during serialization.
42. marshal.load() retained readinto() view — A callback-retained memoryview can remain live after its private native buffer is reallocated or freed.
43. memoryview.cast() shape-list race — Concurrent replacement can reclaim a borrowed shape integer before type and value checks.
44. memoryview.__hash__ release race — Release can drop the final buffer lease while hashing still reads the raw address.
45. Non-contiguous memoryview.hex() release race — Release and exporter resize can invalidate the buffer, shape, and strides during copying.
46. memoryview.tobytes() release race — Release can permit exporter resize while the copy still reads its old address.
47. module_dir() callable promotion race — Concurrent __dir__ replacement can destroy the borrowed callable before dispatch.
48. Concurrent multibyte stream-reader race — Shared read() calls can corrupt codec state, pending input, errors, and Unicode-writer transitions.
49. OSError.__reduce__() args race — Concurrent assignment can reclaim the args tuple or its elements between separate reads.
50. Pickling a resizing bytearray — Protocol 5 can copy from released storage or combine pointer and length from different generations.
51. Pickler dispatch-table reducer race — Concurrent dispatch replacement can reclaim a borrowed reducer before the Pickler promotes it.
52. Unpickler donor-memo copy race — Donor growth can reallocate the raw memo array while another Unpickler copies its slots.
53. Pickle extension-cache promotion race — Concurrent cache clearing can reclaim a borrowed object before it is promoted and pushed.
54. Unpickler.find_class() mapping race — Compatibility-map replacement can reclaim tuples and strings during import and global lookup.
55. _pickle.fix_imports() mapping race — Reverse compatibility-map replacement can reclaim borrowed names while they are validated and promoted.
56. _pickle.load_build() state-dictionary race — Concurrent state mutation can invalidate traversal and reclaim keys or values during assignment.
57. _pickle.load_extension() registry race — Concurrent registry replacement can reclaim the module and class names during resolution.
58. Pickle memo-setter dictionary race — Concurrent source mutation can invalidate traversal or reclaim entries before validation and insertion.
59. Shared Unpickler running-guard race — Two callers can bypass the non-atomic guard and concurrently mutate one Unpickler's native state.
60. Unpickler memo-proxy storage race — Copy can traverse memo storage that concurrent clear or assignment has detached and freed.
61. os.posix_spawn() file-action list race — Concurrent replacement can reclaim a borrowed action tuple before parsing.
62. PyUnstable_Exc_PrepReraiseStar() list race — Concurrent exception-list mutation can invalidate an entry before type and metadata access.
63. Stale specialized property-getter cache — Reinitializing a property does not invalidate the owning type version, leaving specialized bytecode with a collected getter pointer.
64. PyArg_Parse bytearray resize race — The et formats can read released bytearray storage during strlen() or memcpy().
65. PyConfig_Set() container-validation race — Concurrent list or dictionary mutation can invalidate entries before configuration type checks.
66. pyexpat.xmlparser handler-slot race — Handler replacement can leave getters and callbacks using stale or invalid slot contents.
67. pyexpat.ParseFile() bytearray race — A peer can resize the returned bytearray while native code copies from its saved address and length.
68. Concurrent pyexpat native-state corruption — Simultaneous parses can invalidate shared Expat tables, buffers, lists, and retained pointers.
69. PyFunction_GetAnnotations() lazy-state race — Concurrent setters can reclaim annotation fields or cause publication from inconsistent generations.
70. PyImport_GetImporter() path-hook race — Concurrent sys.path_hooks mutation can invalidate a slot or reclaim a hook before its call.
71. int(bytearray) storage race — Concurrent resize can make integer parsing scan released storage or mismatched pointer and length generations.
72. PyObject_Call() shared-kwargs race — Concurrent mutation can reclaim kwargs entries or make traversal exceed the allocated call arrays.
73. PySys_GetObject() borrowed-return race — Concurrent sys-dictionary replacement can reclaim the object before the caller promotes or uses it.
74. RawIOBase.read() callback-buffer race — A published callback bytearray can be resized while native code copies the originally reported byte count.
75. select.select() descriptor-list race — Concurrent mutation can invalidate saved bounds or reclaim a fetched descriptor before promotion.
76. compile(bytearray) source-storage race — Concurrent resize can relocate or free source storage while scanning and parsing continue.
77. SQLite converter-registry race — Concurrent registry replacement can reclaim a returned converter before the row-cast map owns it.
78. SQLite connection cursor-registry race — Concurrent append and cleanup can invalidate registry storage, references, or lose cursor registrations.
79. Concurrent SQLite cursor-step race — Two fetchone() calls can inspect or advance the same sqlite3_stmt concurrently.
80. SQLite parameter-list promotion race — Concurrent list mutation can reclaim a parameter before promotion, adaptation, or binding.
81. _sre.compile() code-list race — Concurrent mutation can invalidate the saved length or reclaim an opcode before conversion.
82. _sre.Match group-index race — Concurrent dictionary replacement can reclaim a group-index integer before use.
83. _sre.template() list race — Concurrent mutation can invalidate bounds or reclaim literals and group indices before conversion.
84. SSL password bytearray race — Concurrent resize can release password storage before the native copy completes.
85. SSL weak-socket referent race — The helper drops its strong reference before returning, allowing concurrent destruction before caller use.
86. _struct bytearray packing race — Concurrent resize can relocate or free 's' and 'p' source storage during copying.
87. Struct-sequence input-list race — Concurrent replacement can finalize an input item before the new struct sequence owns it.
88. Struct-sequence metadata race — Concurrent heap-type metadata replacement can reclaim an integer before conversion and corrupt constructor bounds.
89. Suggestion candidate-list traversal race — Concurrent mutation can invalidate bounds, reclaim a candidate, or reclaim the selected result before promotion.
90. _generate_suggestions() list race — Concurrent clear or replacement can invalidate a slot or reclaim an entry before calculation.
91. syslog.openlog() sys.argv[0] race — Concurrent replacement can destroy the borrowed program name before promotion and UTF-8 conversion.
92. termios.tcsetattr() attribute-list race — Concurrent outer or inner list mutation can invalidate control-character entries before conversion.
93. TextIOWrapper.tell() reentrant snapshot release — A decoder callback can re-enter seek(), release the snapshot, and leave the outer call using freed input bytes.
94. _tkinter._flatten() shared-list race — Concurrent clear and refill can invalidate exact-list storage during flattening.
95. Traceback sys.path item race — Concurrent replacement can reclaim a borrowed path string before source-file lookup encodes it.
96. type.__subclasses__() bases race — Concurrent __bases__ mutation can invalidate borrowed subclass references during dictionary traversal.
97. Unicode encoder shared-bytearray race — A codec can return a shared bytearray that another thread resizes during the bytes copy.
98. _PyUnicode_FromId() shared-array growth race — Concurrent identifiers can reallocate and publish the shared array while another thread accesses freed storage.
99. ZstdCompressor options-dictionary race — Concurrent clearing can reclaim borrowed option keys or values before conversion.
100. ZstdDecompressor options-dictionary race — Concurrent clearing can reclaim borrowed option keys or values before conversion.