Audacity 4.0.0 crashes on startup when a Philips TAH6509 Bluetooth headset is connected

Bug description

Audacity 4.0.0 consistently crashes during startup on Windows 11 when my Philips TAH6509 Bluetooth headset is connected.

The crash is reproducible. If the headset is turned off/disconnected, Audacity starts normally. If the headset is connected before starting Audacity, Audacity crashes approximately 5 seconds after launch.

While Audacity is attempting to start, audio playback through the Bluetooth headset also becomes distorted. As soon as Audacity terminates, audio returns to normal.

I collected a full process dump and investigated the crash with WinDbg. The crash appears to occur while Audacity is handling a PortAudio device-enumeration error involving the Microsoft Bluetooth A2DP driver and subsequently formatting the resulting error string through wxWidgets.

Environment

• Audacity: 4.0.0
• Audacity executable version: 4.0.0.0
• Windows 11
• Windows build: 10.0.26100
• Audacity architecture: x64
• wxWidgets: 3.2.6
• Bluetooth headset: Philips TAH6509
• Bluetooth audio service: Microsoft BthA2dp
• Driver involved in the PortAudio error: btha2dp.sys

Audacity executable:

C:\Program Files\Audacity 4\bin\Audacity4.exe

Troubleshooting already performed

I initially suspected a WASAPI issue, but changing the Audacity Audio Host did not resolve the crash.

Tested:

• Windows WASAPI
• MME
• Disabling the Philips Hands-Free/recording endpoint
• Resetting Audacity preferences by removing/renaming the Audacity configuration directory
• Audacity file validation/retesting

The crash still occurs when the Bluetooth headset is connected.

Windows crash information

Windows Event Viewer reports:

Application: Audacity4.exe
Version: 4.0.0.0

Faulting module:
ucrtbase.dll

Exception code:
0xc0000409

Fault offset:
0x0000000000011858

WER classifies the crash as:

Event Name: BEX64

Failure.Bucket:
FAIL_FAST_INVALID_ARG_c0000409_ucrtbase.dll!invoke_watson

The fast-fail subcode is specifically:

FAST_FAIL_INVALID_ARG (0x5)

Therefore, despite the generic 0xc0000409 description mentioning a security check/stack buffer overrun, the dump indicates an invalid-parameter fail-fast rather than evidence of a stack buffer overflow.

WinDbg analysis

The exception is:

ExceptionAddress:
ucrtbase!invoke_watson+0x18

ExceptionCode:
0xc0000409

Parameter[0]:
0x5

Subcode:
FAST_FAIL_INVALID_ARG

Relevant stack:

ucrtbase!invoke_watson
ucrtbase!invalid_parameter_internal
ucrtbase!__crt_stdio_output::...::process
ucrtbase!common_vsprintf
ucrtbase!_stdio_common_vswprintf_p
wxbase32u_vc_x64_custom.dll
Audacity4.exe

Audacity and wxWidgets in the release build only expose export symbols, so some function names reported for frames without private symbols are nearest-export approximations and should not be considered reliable function names.

However, disassembly of the first relevant Audacity frame showed an indirect call:

Audacity4.exe + 0x493a4f

Resolving its target from the dump:

dq 00000001`40fe3e98 L1

00000001`40fe3e98  00007ffa`12e46988

and:

ln 00007ffa`12e46988

resolves exactly to:

wxbase32u_vc_x64_custom!wxString::FormatV

Therefore the observed failure path is approximately:

Audacity4.exe
    -> wxString::FormatV
    -> wxWidgets formatting internals
    -> ucrtbase!_stdio_common_vswprintf_p
    -> ucrtbase!common_vsprintf
    -> ucrtbase!invalid_parameter_internal
    -> ucrtbase!invoke_watson
    -> FAST_FAIL_INVALID_ARG

PortAudio / Bluetooth finding

Heap inspection of the full dump revealed the following error string:

PortAudio stream error creating device list: Windows WDM-KS:Input (@System32\drivers\btha2dp.sys,#1;%1%0
;(Philips TAH6509)): Invalid device

The apparent line break after %1%0 is actually:

%1%0\r\n;(Philips TAH6509)

The UTF-16 bytes in the dump confirm this:

0025 0031 0025 0030 000d 000a 003b 0028
 %    1    %    0    CR   LF    ;    (

Windows PnP information for the device confirms that the Philips headset uses the Microsoft Bluetooth A2DP stack:

Class       : MEDIA
FriendlyName: Philips TAH6509
Description : Microsoft Bluetooth A2dp Source
Manufacturer: Microsoft
Service     : BthA2dp
Status      : OK

The driver stack includes:

\Driver\ksthunk
\Driver\BthA2dp
\Driver\BthEnum

There is also a Philips audio endpoint reported by Windows with Status: Unknown, while the other Philips endpoints are reported as OK.

Possibly relevant formatting behavior

This part may be particularly relevant.

Multiple copies of the PortAudio error string exist in the dump containing the original device identifier:

...btha2dp.sys,#1;%1%0\r\n;(Philips TAH6509)): Invalid device

However, multiple other copies exist where that portion has changed to:

...btha2dp.sys,#1;ack): Invalid device

For example:

Original:
PortAudio stream error creating device list:
Windows WDM-KS:Input
(@System32\drivers\btha2dp.sys,#1;%1%0\r\n;(Philips TAH6509)):
Invalid device

Modified copy:
PortAudio stream error creating device list:
Windows WDM-KS:Input
(@System32\drivers\btha2dp.sys,#1;ack):
Invalid device

The %1%0 sequence is therefore suspicious because the crash subsequently occurs while the error is being processed through:

wxString::FormatV
    ->
_stdio_common_vswprintf_p
    ->
invalid_parameter_internal
    ->
FAST_FAIL_INVALID_ARG

One possible explanation is that externally supplied device/error text containing % sequences is reaching a printf-style formatting path and being interpreted as formatting syntax rather than literal data.

I have not proven that this is the root cause, so I am reporting it as an observation/hypothesis rather than a conclusion.

Steps to reproduce

1. Connect/turn on a Philips TAH6509 Bluetooth headset.
2. Verify that Windows recognizes the headset and audio is working.
3. Start Audacity 4.0.0.
4. Audacity begins initializing.
5. Audio through the Bluetooth headset becomes temporarily distorted.
6. Audacity crashes approximately 5 seconds after startup.
7. Audio returns to normal immediately after Audacity terminates.

If I turn the Philips headset off before launching Audacity, Audacity starts normally.

The issue is consistently reproducible on this machine.

Expected behavior

If PortAudio encounters an invalid or unsupported WDM-KS Bluetooth endpoint, Audacity should ignore the device, report/log the error, or otherwise continue startup without terminating the process.

A malformed/unusable audio endpoint should not cause Audacity to fail-fast during startup.

Actual behavior

The PortAudio device enumeration error is followed by a failure inside the wxWidgets/CRT formatting path and Audacity terminates with:

0xc0000409
FAST_FAIL_INVALID_ARG

Audacity Version

Audacity 4.0.0

Operating system

Windows

Additional context

I have retained the approximately 205 MB full crash dump used for this analysis and can provide additional WinDbg output or inspect specific memory locations if useful.

Because it is a full process dump, I have not attached it publicly by default.

I can also perform additional tests on the affected Windows machine with the Philips TAH6509 connected if maintainers need a specific reproduction or debugger command.