On macOS, anything involving the Finder crashes sshfs

[dtgriscom]

I had MacFUSE/sshfs working fine on my Apple M2 Macbook Pro running Sequoia 15.7.2. But, brew was confused, so I blew away my brew installation and reinstalled everything. I made sure that everything was ARM-based (it took a few tries).

I then reinstalled MacFUSE 5.1.2 and sshfs-3.7.5.pkg (both from here). And, my old scripts to start up sshfs mounting various Ubuntu boxes still work. I can use the command line to go into and interact with the mounted drives. I can even use BBEdit to edit files on the drive.

Problem: every time I try to use the Finder on an sshfs'd directory, sshfs crashes. I can view the drive's top level directory in the Finder, but anything deeper than that: boom. The same for using the standard File Open dialog from any app (e.g. when using "File/Open..." from BBEdit).

The entire Problem Reporter output is below, but the key seems to be that the thread that crashed is trying to use ssh_readdir():

Thread 6 Crashed:
0   libsystem_kernel.dylib        	       0x186e5a388 __pthread_kill + 8
1   libsystem_pthread.dylib       	       0x186e93848 pthread_kill + 296
2   libsystem_c.dylib             	       0x186d9c9e4 abort + 124
3   libsystem_c.dylib             	       0x186d9bc18 __assert_rtn + 284
4   sshfs                         	       0x10286e2c4 sshfs_readdir.cold.2 + 40
5   sshfs                         	       0x1028030f4 sshfs_readdir + 652
6   libfuse3.4.dylib              	       0x102f05090 0x102ef4000 + 69776
7   libfuse3.4.dylib              	       0x102f0e1c8 0x102ef4000 + 106952
8   libfuse3.4.dylib              	       0x102f0b014 fuse_session_process_buf_internal + 1272
9   libfuse3.4.dylib              	       0x102f07b88 0x102ef4000 + 80776
10  libsystem_pthread.dylib       	       0x186e93bc8 _pthread_start + 136
11  libsystem_pthread.dylib       	       0x186e8eb80 thread_start + 8

Do you have any suggestions on how I could debug this?

P.S. Here's the complete Problem Reporter output:

-------------------------------------
Translated Report (Full Report Below)
-------------------------------------

Process:               sshfs [1783]
Path:                  /usr/local/bin/sshfs
Identifier:            sshfs
Version:               ???
Code Type:             ARM-64 (Native)
Parent Process:        launchd [1]
Responsible:           iTerm2 [483]
User ID:               501

Date/Time:             2025-12-02 21:59:10.0389 -0500
OS Version:            macOS 15.7.2 (24G325)
Report Version:        12
Anonymous UUID:        C85561C1-847C-52E4-551C-190E6936CA25

Sleep/Wake UUID:       0EE9C91A-3E06-44CE-A9F8-560D6258D778

Time Awake Since Boot: 2500 seconds
Time Since Wake:       1211 seconds

System Integrity Protection: enabled

Crashed Thread:        6

Exception Type:        EXC_CRASH (SIGABRT)
Exception Codes:       0x0000000000000000, 0x0000000000000000

Termination Reason:    Namespace SIGNAL, Code 6 Abort trap: 6
Terminating Process:   sshfs [1783]

Application Specific Information:
crashed on child side of fork pre-exec


Thread 0::  Dispatch queue: com.apple.main-thread
0   libsystem_kernel.dylib        	       0x186e51bb0 semaphore_wait_trap + 8
1   libdispatch.dylib             	       0x186cdd960 _dispatch_sema4_wait + 28
2   libdispatch.dylib             	       0x186cddf10 _dispatch_semaphore_wait_slow + 132
3   libfuse3.4.dylib              	       0x102f07530 fuse_session_loop_mt_312 + 284
4   libfuse3.4.dylib              	       0x102ef8fb0 fuse_loop_mt_312 + 84
5   libfuse3.4.dylib              	       0x102ef9108 fuse_loop_mt_31 + 56
6   sshfs                         	       0x1027ff608 main + 3056
7   dyld                          	       0x186af2b98 start + 6076

Thread 1:
0   libsystem_kernel.dylib        	       0x186e527dc read + 8
1   libfuse3.4.dylib              	       0x102f0b6b8 0x102ef4000 + 95928
2   libfuse3.4.dylib              	       0x102f07ae4 0x102ef4000 + 80612
3   libsystem_pthread.dylib       	       0x186e93bc8 _pthread_start + 136
4   libsystem_pthread.dylib       	       0x186e8eb80 thread_start + 8

Thread 2:
0   libsystem_kernel.dylib        	       0x186e527dc read + 8
1   libfuse3.4.dylib              	       0x102f0b6b8 0x102ef4000 + 95928
2   libfuse3.4.dylib              	       0x102f07ae4 0x102ef4000 + 80612
3   libsystem_pthread.dylib       	       0x186e93bc8 _pthread_start + 136
4   libsystem_pthread.dylib       	       0x186e8eb80 thread_start + 8

Thread 3:
0   libsystem_kernel.dylib        	       0x186e527dc read + 8
1   sshfs                         	       0x102805774 sftp_read + 76
2   sshfs                         	       0x10280543c process_requests + 168
3   libsystem_pthread.dylib       	       0x186e93bc8 _pthread_start + 136
4   libsystem_pthread.dylib       	       0x186e8eb80 thread_start + 8

Thread 4:
0   libsystem_kernel.dylib        	       0x186e527dc read + 8
1   libfuse3.4.dylib              	       0x102f0b6b8 0x102ef4000 + 95928
2   libfuse3.4.dylib              	       0x102f07ae4 0x102ef4000 + 80612
3   libsystem_pthread.dylib       	       0x186e93bc8 _pthread_start + 136
4   libsystem_pthread.dylib       	       0x186e8eb80 thread_start + 8

Thread 5:
0   libsystem_kernel.dylib        	       0x186e527dc read + 8
1   libfuse3.4.dylib              	       0x102f0b6b8 0x102ef4000 + 95928
2   libfuse3.4.dylib              	       0x102f07ae4 0x102ef4000 + 80612
3   libsystem_pthread.dylib       	       0x186e93bc8 _pthread_start + 136
4   libsystem_pthread.dylib       	       0x186e8eb80 thread_start + 8

Thread 6 Crashed:
0   libsystem_kernel.dylib        	       0x186e5a388 __pthread_kill + 8
1   libsystem_pthread.dylib       	       0x186e93848 pthread_kill + 296
2   libsystem_c.dylib             	       0x186d9c9e4 abort + 124
3   libsystem_c.dylib             	       0x186d9bc18 __assert_rtn + 284
4   sshfs                         	       0x10286e2c4 sshfs_readdir.cold.2 + 40
5   sshfs                         	       0x1028030f4 sshfs_readdir + 652
6   libfuse3.4.dylib              	       0x102f05090 0x102ef4000 + 69776
7   libfuse3.4.dylib              	       0x102f0e1c8 0x102ef4000 + 106952
8   libfuse3.4.dylib              	       0x102f0b014 fuse_session_process_buf_internal + 1272
9   libfuse3.4.dylib              	       0x102f07b88 0x102ef4000 + 80776
10  libsystem_pthread.dylib       	       0x186e93bc8 _pthread_start + 136
11  libsystem_pthread.dylib       	       0x186e8eb80 thread_start + 8

Thread 7:
0   libsystem_kernel.dylib        	       0x186e527dc read + 8
1   libfuse3.4.dylib              	       0x102f0b6b8 0x102ef4000 + 95928
2   libfuse3.4.dylib              	       0x102f07ae4 0x102ef4000 + 80612
3   libsystem_pthread.dylib       	       0x186e93bc8 _pthread_start + 136
4   libsystem_pthread.dylib       	       0x186e8eb80 thread_start + 8

Thread 8:
0   libsystem_kernel.dylib        	       0x186e527dc read + 8
1   libfuse3.4.dylib              	       0x102f0b6b8 0x102ef4000 + 95928
2   libfuse3.4.dylib              	       0x102f07ae4 0x102ef4000 + 80612
3   libsystem_pthread.dylib       	       0x186e93bc8 _pthread_start + 136
4   libsystem_pthread.dylib       	       0x186e8eb80 thread_start + 8

Thread 9:
0   libsystem_kernel.dylib        	       0x186e527dc read + 8
1   libfuse3.4.dylib              	       0x102f0b6b8 0x102ef4000 + 95928
2   libfuse3.4.dylib              	       0x102f07ae4 0x102ef4000 + 80612
3   libsystem_pthread.dylib       	       0x186e93bc8 _pthread_start + 136
4   libsystem_pthread.dylib       	       0x186e8eb80 thread_start + 8

Thread 10:
0   libsystem_kernel.dylib        	       0x186e527dc read + 8
1   libfuse3.4.dylib              	       0x102f0b6b8 0x102ef4000 + 95928
2   libfuse3.4.dylib              	       0x102f07ae4 0x102ef4000 + 80612
3   libsystem_pthread.dylib       	       0x186e93bc8 _pthread_start + 136
4   libsystem_pthread.dylib       	       0x186e8eb80 thread_start + 8

Thread 11:
0   libsystem_kernel.dylib        	       0x186e527dc read + 8
1   libfuse3.4.dylib              	       0x102f0b6b8 0x102ef4000 + 95928
2   libfuse3.4.dylib              	       0x102f07ae4 0x102ef4000 + 80612
3   libsystem_pthread.dylib       	       0x186e93bc8 _pthread_start + 136
4   libsystem_pthread.dylib       	       0x186e8eb80 thread_start + 8


Thread 6 crashed with ARM Thread State (64-bit):
    x0: 0x0000000000000000   x1: 0x0000000000000000   x2: 0x0000000000000000   x3: 0x0000000000000000
    x4: 0x0000000000000000   x5: 0x000000000000002e   x6: 0x0000000000000002   x7: 0x0000000000000000
    x8: 0x1bcba9293acb183f   x9: 0x1bcba9285756283f  x10: 0x000000000000000a  x11: 0x0000000000000000
   x12: 0x0000000000000032  x13: 0x0000000000000000  x14: 0x0000000000000000  x15: 0x0000000000000010
   x16: 0x0000000000000148  x17: 0x00000001f5e7d548  x18: 0x0000000000000000  x19: 0x0000000000000006
   x20: 0x0000000000000d03  x21: 0x000000016d9d30e0  x22: 0x0000000000000016  x23: 0x00000001029a22de
   x24: 0x00000001f281f000  x25: 0x0000000000000003  x26: 0x0000000127605b80  x27: 0x0000000000000000
   x28: 0x0000000137606040   fp: 0x000000016d9d2a80   lr: 0x0000000186e93848
    sp: 0x000000016d9d2a60   pc: 0x0000000186e5a388 cpsr: 0x40001000
   far: 0x0000000000000000  esr: 0x56000080  Address size fault

Binary Images:
       0x1027fc000 -        0x1029affff sshfs (*) <bf8b19b7-7c53-3967-af89-da0fe38b0cd8> /usr/local/bin/sshfs
       0x102ef4000 -        0x102f1ffff libfuse3.4.dylib (*) <c28dc693-b389-3fcb-ab94-227c490a8c6d> /usr/local/lib/libfuse3.4.dylib
       0x186e51000 -        0x186e8c663 libsystem_kernel.dylib (*) <e5d90565-fa1a-3112-b048-59e321191677> /usr/lib/system/libsystem_kernel.dylib
       0x186cda000 -        0x186d2075f libdispatch.dylib (*) <63a54ce1-2ab6-3673-82e4-d8489d811475> /usr/lib/system/libdispatch.dylib
       0x186aec000 -        0x186b8757b dyld (*) <037bb3c1-5c6c-3ec9-af31-f5bded703b36> /usr/lib/dyld
               0x0 - 0xffffffffffffffff ??? (*) <00000000-0000-0000-0000-000000000000> ???
       0x186e8d000 -        0x186e99a77 libsystem_pthread.dylib (*) <022dc315-cf35-38da-939e-03800b5beff2> /usr/lib/system/libsystem_pthread.dylib
       0x186d24000 -        0x186da51f7 libsystem_c.dylib (*) <e098cb59-2c56-395c-ade1-6ef590e61199> /usr/lib/system/libsystem_c.dylib

External Modification Summary:
  Calls made by other processes targeting this process:
    task_for_pid: 0
    thread_create: 0
    thread_set_state: 0
  Calls made by this process:
    task_for_pid: 0
    thread_create: 0
    thread_set_state: 0
  Calls made by all processes on this machine:
    task_for_pid: 0
    thread_create: 0
    thread_set_state: 0

VM Region Summary:
ReadOnly portion of Libraries: Total=847.8M resident=0K(0%) swapped_out_or_unallocated=847.8M(100%)
Writable regions: Total=1.2G written=337K(0%) resident=337K(0%) swapped_out=0K(0%) unallocated=1.2G(100%)

                                VIRTUAL   REGION 
REGION TYPE                        SIZE    COUNT (non-coalesced) 
===========                     =======  ======= 
Kernel Alloc Once                   32K        1 
MALLOC                             1.2G       33 
MALLOC guard page                   96K        6 
STACK GUARD                       56.2M       12 
Stack                             14.4M       13 
Stack Guard                         16K        1 
VM_ALLOCATE                         16K        1 
__AUTH                             822K      161 
__AUTH_CONST                      12.8M      295 
__DATA                            11.2M      277 
__DATA_CONST                      10.8M      297 
__DATA_DIRTY                       453K       88 
__FONT_DATA                        2352        1 
__LINKEDIT                       617.1M        3 
__OBJC_RO                         61.4M        1 
__OBJC_RW                         2396K        1 
__TEXT                           230.7M      306 
__TPRO_CONST                       128K        2 
page table in kernel               337K        1 
shared memory                       32K        1 
===========                     =======  ======= 
TOTAL                              2.2G     1501 



-----------
Full Report
-----------

{"app_name":"sshfs","timestamp":"2025-12-02 21:59:10.00 -0500","app_version":"","slice_uuid":"bf8b19b7-7c53-3967-af89-da0fe38b0cd8","build_version":"","platform":1,"share_with_app_devs":0,"is_first_party":1,"bug_type":"309","os_version":"macOS 15.7.2 (24G325)","roots_installed":0,"incident_id":"34383CD0-56BC-4BEB-9A83-08C6CCF00AE8","name":"sshfs"}
{
  "uptime" : 2500,
  "procRole" : "Unspecified",
  "version" : 2,
  "userID" : 501,
  "deployVersion" : 210,
  "modelCode" : "Mac14,5",
  "coalitionID" : 533,
  "osVersion" : {
    "train" : "macOS 15.7.2",
    "build" : "24G325",
    "releaseType" : "User"
  },
  "captureTime" : "2025-12-02 21:59:10.0389 -0500",
  "codeSigningMonitor" : 1,
  "incident" : "34383CD0-56BC-4BEB-9A83-08C6CCF00AE8",
  "pid" : 1783,
  "translated" : false,
  "cpuType" : "ARM-64",
  "roots_installed" : 0,
  "bug_type" : "309",
  "procLaunch" : "2025-12-02 21:45:06.6156 -0500",
  "procStartAbsTime" : 40264837419,
  "procExitAbsTime" : 60507032613,
  "procName" : "sshfs",
  "procPath" : "\/usr\/local\/bin\/sshfs",
  "parentProc" : "launchd",
  "parentPid" : 1,
  "coalitionName" : "com.googlecode.iterm2",
  "crashReporterKey" : "C85561C1-847C-52E4-551C-190E6936CA25",
  "appleIntelligenceStatus" : {"state":"available"},
  "responsiblePid" : 483,
  "responsibleProc" : "iTerm2",
  "codeSigningID" : "sshfs",
  "codeSigningTeamID" : "3T5GSNBU6W",
  "codeSigningFlags" : 570503953,
  "codeSigningValidationCategory" : 6,
  "codeSigningTrustLevel" : 4294967295,
  "codeSigningAuxiliaryInfo" : 0,
  "instructionByteStream" : {"beforePC":"fyMD1f17v6n9AwCRm+D\/l78DAJH9e8Go\/w9f1sADX9YQKYDSARAA1A==","atPC":"AwEAVH8jA9X9e7+p\/QMAkZDg\/5e\/AwCR\/XvBqP8PX9bAA1\/WcAqA0g=="},
  "bootSessionUUID" : "3F0B4D44-5821-445E-92AF-60380200043A",
  "wakeTime" : 1211,
  "sleepWakeUUID" : "0EE9C91A-3E06-44CE-A9F8-560D6258D778",
  "sip" : "enabled",
  "exception" : {"codes":"0x0000000000000000, 0x0000000000000000","rawCodes":[0,0],"type":"EXC_CRASH","signal":"SIGABRT"},
  "termination" : {"flags":0,"code":6,"namespace":"SIGNAL","indicator":"Abort trap: 6","byProc":"sshfs","byPid":1783},
  "asi" : {"libsystem_c.dylib":["crashed on child side of fork pre-exec"]},
  "extMods" : {"caller":{"thread_create":0,"thread_set_state":0,"task_for_pid":0},"system":{"thread_create":0,"thread_set_state":0,"task_for_pid":0},"targeted":{"thread_create":0,"thread_set_state":0,"task_for_pid":0},"warnings":0},
  "faultingThread" : 6,
  "threads" : [{"id":37584,"threadState":{"x":[{"value":14},{"value":8589934595},{"value":171798697235},{"value":4410931413251},{"value":14680198217728},{"value":4410931412992},{"value":48},{"value":0},{"value":0},{"value":1},{"value":0},{"value":2},{"value":8403486872,"symbolLocation":0,"symbol":"vm_page_size"},{"value":105553175328945},{"value":4294967279},{"value":4344370322},{"value":18446744073709551580},{"value":8420582872},{"value":0},{"value":4955593392},{"value":4955593328},{"value":18446744073709551615},{"value":0},{"value":0},{"value":6129986576},{"value":105553163812864},{"value":4338703644,"symbolLocation":340,"symbol":"sshfs"},{"value":4338703304,"symbolLocation":0,"symbol":"sshfs"},{"value":4338700288,"symbolLocation":200,"symbol":"workaround_opts"}],"flavor":"ARM_THREAD_STATE64","lr":{"value":6556604768},"cpsr":{"value":1610616832},"fp":{"value":6129986432},"sp":{"value":6129986416},"esr":{"value":1442840704,"description":" Address size fault"},"pc":{"value":6558129072},"far":{"value":0}},"queue":"com.apple.main-thread","frames":[{"imageOffset":2992,"symbol":"semaphore_wait_trap","symbolLocation":8,"imageIndex":2},{"imageOffset":14688,"symbol":"_dispatch_sema4_wait","symbolLocation":28,"imageIndex":3},{"imageOffset":16144,"symbol":"_dispatch_semaphore_wait_slow","symbolLocation":132,"imageIndex":3},{"imageOffset":79152,"symbol":"fuse_session_loop_mt_312","symbolLocation":284,"imageIndex":1},{"imageOffset":20400,"symbol":"fuse_loop_mt_312","symbolLocation":84,"imageIndex":1},{"imageOffset":20744,"symbol":"fuse_loop_mt_31","symbolLocation":56,"imageIndex":1},{"imageOffset":13832,"symbol":"main","symbolLocation":3056,"imageIndex":0},{"imageOffset":27544,"symbol":"start","symbolLocation":6076,"imageIndex":4}]},{"id":37585,"frames":[{"imageOffset":6108,"symbol":"read","symbolLocation":8,"imageIndex":2},{"imageOffset":95928,"imageIndex":1},{"imageOffset":80612,"imageIndex":1},{"imageOffset":27592,"symbol":"_pthread_start","symbolLocation":136,"imageIndex":6},{"imageOffset":7040,"symbol":"thread_start","symbolLocation":8,"imageIndex":6}],"threadState":{"x":[{"value":4},{"value":0},{"value":4198400},{"value":1},{"value":4688200400},{"value":4},{"value":2},{"value":6131110740},{"value":0},{"value":5226172948},{"value":3},{"value":6131118246},{"value":0},{"value":0},{"value":8363565056,"symbolLocation":6840,"symbol":"read_memory"},{"value":4},{"value":3},{"value":8420578608},{"value":0},{"value":5226172928},{"value":4955593432},{"value":1},{"value":4198400},{"value":0},{"value":4344463360},{"value":5226172948},{"value":5226173376},{"value":0},{"value":0}],"flavor":"ARM_THREAD_STATE64","lr":{"value":4344297144},"cpsr":{"value":1610616832},"fp":{"value":6131117968},"sp":{"value":6131117888},"esr":{"value":1442840704,"description":" Address size fault"},"pc":{"value":6558132188},"far":{"value":0}}},{"id":37586,"frames":[{"imageOffset":6108,"symbol":"read","symbolLocation":8,"imageIndex":2},{"imageOffset":95928,"imageIndex":1},{"imageOffset":80612,"imageIndex":1},{"imageOffset":27592,"symbol":"_pthread_start","symbolLocation":136,"imageIndex":6},{"imageOffset":7040,"symbol":"thread_start","symbolLocation":8,"imageIndex":6}],"threadState":{"x":[{"value":4},{"value":0},{"value":4198400},{"value":1},{"value":4688200400},{"value":4},{"value":2},{"value":6131684180},{"value":0},{"value":5226172948},{"value":3},{"value":6131691686},{"value":0},{"value":0},{"value":8363565056,"symbolLocation":6840,"symbol":"read_memory"},{"value":4},{"value":3},{"value":8420578608},{"value":0},{"value":5226172928},{"value":4955593528},{"value":1},{"value":4198400},{"value":0},{"value":4344463360},{"value":5226172948},{"value":5226173376},{"value":0},{"value":0}],"flavor":"ARM_THREAD_STATE64","lr":{"value":4344297144},"cpsr":{"value":1610616832},"fp":{"value":6131691408},"sp":{"value":6131691328},"esr":{"value":1442840704,"description":" Address size fault"},"pc":{"value":6558132188},"far":{"value":0}}},{"id":37587,"frames":[{"imageOffset":6108,"symbol":"read","symbolLocation":8,"imageIndex":2},{"imageOffset":38772,"symbol":"sftp_read","symbolLocation":76,"imageIndex":0},{"imageOffset":37948,"symbol":"process_requests","symbolLocation":168,"imageIndex":0},{"imageOffset":27592,"symbol":"_pthread_start","symbolLocation":136,"imageIndex":6},{"imageOffset":7040,"symbol":"thread_start","symbolLocation":8,"imageIndex":6}],"threadState":{"x":[{"value":4},{"value":0},{"value":5},{"value":4689249152},{"value":1103806595328},{"value":256},{"value":0},{"value":0},{"value":0},{"value":2563},{"value":2149818432},{"value":2149818432},{"value":41104},{"value":4339190304},{"value":0},{"value":16},{"value":3},{"value":8420587120},{"value":0},{"value":4689249136},{"value":105553145955072},{"value":6132264792},{"value":6132264791},{"value":5},{"value":4689249136},{"value":1209},{"value":4689249104},{"value":4338703824,"symbolLocation":520,"symbol":"sshfs"},{"value":4338703560,"symbolLocation":256,"symbol":"sshfs"}],"flavor":"ARM_THREAD_STATE64","lr":{"value":4336932724},"cpsr":{"value":1610616832},"fp":{"value":6132264720},"sp":{"value":6132264656},"esr":{"value":1442840704,"description":" Address size fault"},"pc":{"value":6558132188},"far":{"value":0}}},{"id":37590,"frames":[{"imageOffset":6108,"symbol":"read","symbolLocation":8,"imageIndex":2},{"imageOffset":95928,"imageIndex":1},{"imageOffset":80612,"imageIndex":1},{"imageOffset":27592,"symbol":"_pthread_start","symbolLocation":136,"imageIndex":6},{"imageOffset":7040,"symbol":"thread_start","symbolLocation":8,"imageIndex":6}],"threadState":{"x":[{"value":4},{"value":0},{"value":4198400},{"value":1},{"value":4687151696},{"value":4},{"value":2},{"value":6132831060},{"value":0},{"value":5226172948},{"value":3},{"value":6132838566},{"value":0},{"value":0},{"value":3},{"value":129},{"value":3},{"value":8420578608},{"value":0},{"value":5226172928},{"value":4690296984},{"value":1},{"value":4198400},{"value":0},{"value":4344463360},{"value":5226172948},{"value":5226173376},{"value":0},{"value":0}],"flavor":"ARM_THREAD_STATE64","lr":{"value":4344297144},"cpsr":{"value":1610616832},"fp":{"value":6132838288},"sp":{"value":6132838208},"esr":{"value":1442840704,"description":" Address size fault"},"pc":{"value":6558132188},"far":{"value":0}}},{"id":37597,"frames":[{"imageOffset":6108,"symbol":"read","symbolLocation":8,"imageIndex":2},{"imageOffset":95928,"imageIndex":1},{"imageOffset":80612,"imageIndex":1},{"imageOffset":27592,"symbol":"_pthread_start","symbolLocation":136,"imageIndex":6},{"imageOffset":7040,"symbol":"thread_start","symbolLocation":8,"imageIndex":6}],"threadState":{"x":[{"value":4},{"value":0},{"value":4198400},{"value":1},{"value":4688200400},{"value":4},{"value":2},{"value":6133404500},{"value":0},{"value":5226172948},{"value":3},{"value":6133412006},{"value":0},{"value":0},{"value":8363565056,"symbolLocation":6840,"symbol":"read_memory"},{"value":4},{"value":3},{"value":8420578608},{"value":0},{"value":5226172928},{"value":4418715800},{"value":1},{"value":4198400},{"value":0},{"value":4344463360},{"value":5226172948},{"value":5226173376},{"value":0},{"value":0}],"flavor":"ARM_THREAD_STATE64","lr":{"value":4344297144},"cpsr":{"value":1610616832},"fp":{"value":6133411728},"sp":{"value":6133411648},"esr":{"value":1442840704,"description":" Address size fault"},"pc":{"value":6558132188},"far":{"value":0}}},{"triggered":true,"id":37601,"threadState":{"x":[{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":46},{"value":2},{"value":0},{"value":2002880453841459263},{"value":2002880450025367615},{"value":10},{"value":0},{"value":50},{"value":0},{"value":0},{"value":16},{"value":328},{"value":8420578632},{"value":0},{"value":6},{"value":3331},{"value":6133985504},{"value":22},{"value":4338623198},{"value":8363569152,"symbolLocation":8,"symbol":"_OBJC_PROTOCOL_$_OS_dispatch_source_data_or"},{"value":3},{"value":4955593600},{"value":0},{"value":5224030272}],"flavor":"ARM_THREAD_STATE64","lr":{"value":6558398536},"cpsr":{"value":1073745920},"fp":{"value":6133983872},"sp":{"value":6133983840},"esr":{"value":1442840704,"description":" Address size fault"},"pc":{"value":6558163848,"matchesCrashFrame":1},"far":{"value":0}},"frames":[{"imageOffset":37768,"symbol":"__pthread_kill","symbolLocation":8,"imageIndex":2},{"imageOffset":26696,"symbol":"pthread_kill","symbolLocation":296,"imageIndex":6},{"imageOffset":494052,"symbol":"abort","symbolLocation":124,"imageIndex":7},{"imageOffset":490520,"symbol":"__assert_rtn","symbolLocation":284,"imageIndex":7},{"imageOffset":467652,"symbol":"sshfs_readdir.cold.2","symbolLocation":40,"imageIndex":0},{"imageOffset":28916,"symbol":"sshfs_readdir","symbolLocation":652,"imageIndex":0},{"imageOffset":69776,"imageIndex":1},{"imageOffset":106952,"imageIndex":1},{"imageOffset":94228,"symbol":"fuse_session_process_buf_internal","symbolLocation":1272,"imageIndex":1},{"imageOffset":80776,"imageIndex":1},{"imageOffset":27592,"symbol":"_pthread_start","symbolLocation":136,"imageIndex":6},{"imageOffset":7040,"symbol":"thread_start","symbolLocation":8,"imageIndex":6}]},{"id":37602,"frames":[{"imageOffset":6108,"symbol":"read","symbolLocation":8,"imageIndex":2},{"imageOffset":95928,"imageIndex":1},{"imageOffset":80612,"imageIndex":1},{"imageOffset":27592,"symbol":"_pthread_start","symbolLocation":136,"imageIndex":6},{"imageOffset":7040,"symbol":"thread_start","symbolLocation":8,"imageIndex":6}],"threadState":{"x":[{"value":4},{"value":0},{"value":4198400},{"value":1},{"value":4688200400},{"value":4},{"value":2},{"value":0},{"value":0},{"value":5226172948},{"value":3},{"value":6134558886},{"value":0},{"value":0},{"value":8363565056,"symbolLocation":6840,"symbol":"read_memory"},{"value":4},{"value":3},{"value":8420578608},{"value":0},{"value":5226172928},{"value":5225071480},{"value":1},{"value":4198400},{"value":0},{"value":4344463360},{"value":5226172948},{"value":5226173376},{"value":0},{"value":0}],"flavor":"ARM_THREAD_STATE64","lr":{"value":4344297144},"cpsr":{"value":1610616832},"fp":{"value":6134558608},"sp":{"value":6134558528},"esr":{"value":1442840704,"description":" Address size fault"},"pc":{"value":6558132188},"far":{"value":0}}},{"id":37603,"frames":[{"imageOffset":6108,"symbol":"read","symbolLocation":8,"imageIndex":2},{"imageOffset":95928,"imageIndex":1},{"imageOffset":80612,"imageIndex":1},{"imageOffset":27592,"symbol":"_pthread_start","symbolLocation":136,"imageIndex":6},{"imageOffset":7040,"symbol":"thread_start","symbolLocation":8,"imageIndex":6}],"threadState":{"x":[{"value":4},{"value":0},{"value":4198400},{"value":1},{"value":4689248768},{"value":4},{"value":2},{"value":0},{"value":0},{"value":5226172948},{"value":3},{"value":6135132326},{"value":0},{"value":0},{"value":0},{"value":2147483648},{"value":3},{"value":8420578608},{"value":0},{"value":5226172928},{"value":5224026520},{"value":1},{"value":4198400},{"value":0},{"value":4344463360},{"value":5226172948},{"value":5226173376},{"value":0},{"value":0}],"flavor":"ARM_THREAD_STATE64","lr":{"value":4344297144},"cpsr":{"value":1610616832},"fp":{"value":6135132048},"sp":{"value":6135131968},"esr":{"value":1442840704,"description":" Address size fault"},"pc":{"value":6558132188},"far":{"value":0}}},{"id":37604,"frames":[{"imageOffset":6108,"symbol":"read","symbolLocation":8,"imageIndex":2},{"imageOffset":95928,"imageIndex":1},{"imageOffset":80612,"imageIndex":1},{"imageOffset":27592,"symbol":"_pthread_start","symbolLocation":136,"imageIndex":6},{"imageOffset":7040,"symbol":"thread_start","symbolLocation":8,"imageIndex":6}],"threadState":{"x":[{"value":4},{"value":0},{"value":4198400},{"value":1},{"value":4688200400},{"value":4},{"value":2},{"value":0},{"value":0},{"value":5226172948},{"value":3},{"value":6135705766},{"value":0},{"value":0},{"value":8363565056,"symbolLocation":6840,"symbol":"read_memory"},{"value":4},{"value":3},{"value":8420578608},{"value":0},{"value":5226172928},{"value":4418716056},{"value":1},{"value":4198400},{"value":0},{"value":4344463360},{"value":5226172948},{"value":5226173376},{"value":0},{"value":0}],"flavor":"ARM_THREAD_STATE64","lr":{"value":4344297144},"cpsr":{"value":1610616832},"fp":{"value":6135705488},"sp":{"value":6135705408},"esr":{"value":1442840704,"description":" Address size fault"},"pc":{"value":6558132188},"far":{"value":0}}},{"id":37605,"frames":[{"imageOffset":6108,"symbol":"read","symbolLocation":8,"imageIndex":2},{"imageOffset":95928,"imageIndex":1},{"imageOffset":80612,"imageIndex":1},{"imageOffset":27592,"symbol":"_pthread_start","symbolLocation":136,"imageIndex":6},{"imageOffset":7040,"symbol":"thread_start","symbolLocation":8,"imageIndex":6}],"threadState":{"x":[{"value":4},{"value":0},{"value":4198400},{"value":1},{"value":4688200400},{"value":4},{"value":2},{"value":0},{"value":0},{"value":5226172948},{"value":3},{"value":6136279206},{"value":0},{"value":0},{"value":8363565056,"symbolLocation":6840,"symbol":"read_memory"},{"value":4},{"value":3},{"value":8420578608},{"value":0},{"value":5226172928},{"value":5224027384},{"value":1},{"value":4198400},{"value":0},{"value":4344463360},{"value":5226172948},{"value":5226173376},{"value":0},{"value":0}],"flavor":"ARM_THREAD_STATE64","lr":{"value":4344297144},"cpsr":{"value":1610616832},"fp":{"value":6136278928},"sp":{"value":6136278848},"esr":{"value":1442840704,"description":" Address size fault"},"pc":{"value":6558132188},"far":{"value":0}}},{"id":37606,"frames":[{"imageOffset":6108,"symbol":"read","symbolLocation":8,"imageIndex":2},{"imageOffset":95928,"imageIndex":1},{"imageOffset":80612,"imageIndex":1},{"imageOffset":27592,"symbol":"_pthread_start","symbolLocation":136,"imageIndex":6},{"imageOffset":7040,"symbol":"thread_start","symbolLocation":8,"imageIndex":6}],"threadState":{"x":[{"value":4},{"value":0},{"value":4198400},{"value":1},{"value":4955594368},{"value":4},{"value":2},{"value":0},{"value":0},{"value":5226172948},{"value":3},{"value":6136852646},{"value":0},{"value":0},{"value":8363565056,"symbolLocation":6840,"symbol":"read_memory"},{"value":128},{"value":3},{"value":8420578608},{"value":0},{"value":5226172928},{"value":5225072344},{"value":1},{"value":4198400},{"value":0},{"value":4344463360},{"value":5226172948},{"value":5226173376},{"value":0},{"value":0}],"flavor":"ARM_THREAD_STATE64","lr":{"value":4344297144},"cpsr":{"value":1610616832},"fp":{"value":6136852368},"sp":{"value":6136852288},"esr":{"value":1442840704,"description":" Address size fault"},"pc":{"value":6558132188},"far":{"value":0}}}],
  "usedImages" : [
  {
    "source" : "P",
    "arch" : "arm64",
    "base" : 4336893952,
    "size" : 1785856,
    "uuid" : "bf8b19b7-7c53-3967-af89-da0fe38b0cd8",
    "path" : "\/usr\/local\/bin\/sshfs",
    "name" : "sshfs"
  },
  {
    "source" : "P",
    "arch" : "arm64",
    "base" : 4344201216,
    "size" : 180224,
    "uuid" : "c28dc693-b389-3fcb-ab94-227c490a8c6d",
    "path" : "\/usr\/local\/lib\/libfuse3.4.dylib",
    "name" : "libfuse3.4.dylib"
  },
  {
    "source" : "P",
    "arch" : "arm64e",
    "base" : 6558126080,
    "size" : 243300,
    "uuid" : "e5d90565-fa1a-3112-b048-59e321191677",
    "path" : "\/usr\/lib\/system\/libsystem_kernel.dylib",
    "name" : "libsystem_kernel.dylib"
  },
  {
    "source" : "P",
    "arch" : "arm64e",
    "base" : 6556590080,
    "size" : 288608,
    "uuid" : "63a54ce1-2ab6-3673-82e4-d8489d811475",
    "path" : "\/usr\/lib\/system\/libdispatch.dylib",
    "name" : "libdispatch.dylib"
  },
  {
    "source" : "P",
    "arch" : "arm64e",
    "base" : 6554566656,
    "size" : 636284,
    "uuid" : "037bb3c1-5c6c-3ec9-af31-f5bded703b36",
    "path" : "\/usr\/lib\/dyld",
    "name" : "dyld"
  },
  {
    "size" : 0,
    "source" : "A",
    "base" : 0,
    "uuid" : "00000000-0000-0000-0000-000000000000"
  },
  {
    "source" : "P",
    "arch" : "arm64e",
    "base" : 6558371840,
    "size" : 51832,
    "uuid" : "022dc315-cf35-38da-939e-03800b5beff2",
    "path" : "\/usr\/lib\/system\/libsystem_pthread.dylib",
    "name" : "libsystem_pthread.dylib"
  },
  {
    "source" : "P",
    "arch" : "arm64e",
    "base" : 6556893184,
    "size" : 528888,
    "uuid" : "e098cb59-2c56-395c-ade1-6ef590e61199",
    "path" : "\/usr\/lib\/system\/libsystem_c.dylib",
    "name" : "libsystem_c.dylib"
  }
],
  "sharedCache" : {
  "base" : 6553731072,
  "size" : 5039669248,
  "uuid" : "b395a5f6-c55f-3776-8d60-908ce43d7959"
},
  "vmSummary" : "ReadOnly portion of Libraries: Total=847.8M resident=0K(0%) swapped_out_or_unallocated=847.8M(100%)\nWritable regions: Total=1.2G written=337K(0%) resident=337K(0%) swapped_out=0K(0%) unallocated=1.2G(100%)\n\n                                VIRTUAL   REGION \nREGION TYPE                        SIZE    COUNT (non-coalesced) \n===========                     =======  ======= \nKernel Alloc Once                   32K        1 \nMALLOC                             1.2G       33 \nMALLOC guard page                   96K        6 \nSTACK GUARD                       56.2M       12 \nStack                             14.4M       13 \nStack Guard                         16K        1 \nVM_ALLOCATE                         16K        1 \n__AUTH                             822K      161 \n__AUTH_CONST                      12.8M      295 \n__DATA                            11.2M      277 \n__DATA_CONST                      10.8M      297 \n__DATA_DIRTY                       453K       88 \n__FONT_DATA                        2352        1 \n__LINKEDIT                       617.1M        3 \n__OBJC_RO                         61.4M        1 \n__OBJC_RW                         2396K        1 \n__TEXT                           230.7M      306 \n__TPRO_CONST                       128K        2 \npage table in kernel               337K        1 \nshared memory                       32K        1 \n===========                     =======  ======= \nTOTAL                              2.2G     1501 \n",
  "legacyInfo" : {
  "threadTriggered" : {

  }
},
  "logWritingSignature" : "473e8e6124cae7672dc266b90b64976919e61ccd",
  "trialInfo" : {
  "rollouts" : [
    {
      "rolloutId" : "645197bf528fbf3c3af54105",
      "factorPackIds" : {
        "SIRI_VALUE_INFERENCE_PERVASIVE_ENTITY_RESOLUTION" : "663e65b4a1526e1ca0e288a1"
      },
      "deploymentId" : 240000002
    },
    {
      "rolloutId" : "639124e81d92412bfb4880b3",
      "factorPackIds" : {

      },
      "deploymentId" : 240000012
    }
  ],
  "experiments" : [

  ]
}
}

Model: Mac14,5, BootROM 13822.41.1, proc 12:8:4 processors, 64 GB, SMC 
Graphics: Apple M2 Max, Apple M2 Max, Built-In
Display: Color LCD, 3024 x 1964 Retina, Main, MirrorOff, Online
Memory Module: LPDDR5, Hynix
AirPort: spairport_wireless_card_type_wifi (0x14E4, 0x4388), wl0: Jun 24 2025 05:20:23 version 23.40.31.0.41.51.179 FWID 01-b816d667
IO80211_driverkit-1485.12 "IO80211_driverkit-1485.12" Oct  7 2025 20:28:11
AirPort: 
Bluetooth: Version (null), 0 services, 0 devices, 0 incoming serial ports
Network Service: Wi-Fi, AirPort, en0
USB Device: USB31Bus
USB Device: USB31Bus
USB Device: USB31Bus
Thunderbolt Bus: MacBook Pro, Apple Inc.
Thunderbolt Bus: MacBook Pro, Apple Inc.
Thunderbolt Bus: MacBook Pro, Apple Inc.

[h4sh5]

@dtgriscom I've tested this with SSHFS 3.7.5 with macFUSE 4.8.2 on Sequoia 15.7.2 and it works - in the meantime can you downgrade to macFUSE 4.8.2 to test if the same issue exists?

[dtgriscom]

Interesting: my "Downloads" directory, which I never empty, only had macFUSE versions 5.1.2 (downloaded yesterday) and 4.8.2 (downloaded 14 months ago), which means I probably had version 4.8.2 installed up until yesterday. So, I was optimistic, but it didn't work.

Symptoms have changed slightly, though: now I can't even view the remote disk's top level in the Finder. But, command-line access still works, and I can still edit files with BBEdit if I don't use the "File/Open" dialog. I can even use BBEdit's disk browser window; just not the Finder.

Here are the two sshfs commands I've tried (each with the same symptoms):

sshfs user@1.2.3.4:/ /tmp/sshfs/driveName -o volname=driveName,cache=no,defer_permissions
sshfs user@1.2.3.4:/ /tmp/sshfs/driveName -o reconnect,ServerAliveInterval=1,volname=driveName,cache=no,defer_permissions

The Problem Reporter's output seems to show the same failure in sshreaddir().

Any other ideas? (Clearly I've broken something on my own system...)

[h4sh5]

Can you show your output of sshfs --version? Mine is:

$ sshfs --version
SSHFS version 3.7.5
FUSE library version 3.17.1
using FUSE kernel interface version 7.40
macFUSE mount version 4.10.2

It could also be that your xcode command line tool libraries are not installed or out of date, that's happened to me before which crashed some applications (not sshfs specifically).

My Xcode command line tool version is 26.1

pkgutil --pkg-info=com.apple.pkg.CLTools_Executables
package-id: com.apple.pkg.CLTools_Executables
version: 26.1.0.0.1.1761104275
volume: /
location: /

Another idea is you could compile sshfs from source to see if that solves the issue.

[dtgriscom]

Great questions!

mbpe-ethernet:~ griscom$ sshfs --version
SSHFS version 3.7.5
FUSE library version 3.17.4
using FUSE kernel interface version 7.40
macFUSE mount version 4.8.2

This program is not meant to be called directly. The macFUSE library calls it.
...

And then there's a bunch of command line option help text. (Is that, and that final line above, expected?)

Xcode command line tools are installed:

mbpe-ethernet:~ griscom$ pkgutil --pkg-info=com.apple.pkg.CLTools_Executables
package-id: com.apple.pkg.CLTools_Executables
version: 26.1.0.0.1.1761104275
volume: /
location: /
install-time: 1762313504
mbpe-ethernet:~ griscom$ 

And, I expect I can try building sshfs from source if you think that would help. (Does this smell like an sshfs problem rather than a MacFUSE problem?)

[h4sh5]

So according to your crash dump (Thread 6) below:

Thread 6 Crashed:
0   libsystem_kernel.dylib        	       0x186e5a388 __pthread_kill + 8
1   libsystem_pthread.dylib       	       0x186e93848 pthread_kill + 296
2   libsystem_c.dylib             	       0x186d9c9e4 abort + 124
3   libsystem_c.dylib             	       0x186d9bc18 __assert_rtn + 284
4   sshfs                         	       0x10286e2c4 sshfs_readdir.cold.2 + 40
5   sshfs                         	       0x1028030f4 sshfs_readdir + 652
6   libfuse3.4.dylib              	       0x102f05090 0x102ef4000 + 69776
7   libfuse3.4.dylib              	       0x102f0e1c8 0x102ef4000 + 106952
8   libfuse3.4.dylib              	       0x102f0b014 fuse_session_process_buf_internal + 1272
9   libfuse3.4.dylib              	       0x102f07b88 0x102ef4000 + 80776
10  libsystem_pthread.dylib       	       0x186e93bc8 _pthread_start + 136
11  libsystem_pthread.dylib       	       0x186e8eb80 thread_start + 8

I've used lldb (lldb $(which sshfs)) to disassemble some mentioned functions (such as sshfs_readdir, with disas -n sshfs_readdir -m) and found the sshfs_readdir.cold.2 symbol

the crash was allegedly at sshfs 0x10286e2c4 sshfs_readdir.cold.2 + 40 which is at the end of the sshfs_readdir.cold.2 label (the .cold.2 is the compiler assigned label for infrequent branches of the sshfs_readdir function)

(lldb) disass -s 0x10000b2d4 -e 0x10000b310
sshfs`sshfs_readdir.cold.2:
sshfs[0x10000b2d4] <+0>:  stp    x29, x30, [sp, #-0x10]!
sshfs[0x10000b2d8] <+4>:  mov    x29, sp
sshfs[0x10000b2dc] <+8>:  adrp   x0, 2
sshfs[0x10000b2e0] <+12>: add    x0, x0, #0xf1f ; "sftp_readdir_async"
sshfs[0x10000b2e4] <+16>: adrp   x1, 2
sshfs[0x10000b2e8] <+20>: add    x1, x1, #0xe99 ; "sshfs.c"
sshfs[0x10000b2ec] <+24>: adrp   x3, 2
sshfs[0x10000b2f0] <+28>: add    x3, x3, #0xf13 ; "offset == 0"
sshfs[0x10000b2f4] <+32>: mov    w2, #0x8e7 ; =2279
sshfs[0x10000b2f8] <+36>: bl     0x10000b7d0    ; symbol stub for: __assert_rtn

it corresponds to an assertion being not met (offset == 0) which I think is why 3 libsystem_c.dylib 0x186d9bc18 __assert_rtn + 284 is the next trace.

the sshfs_readdir in this case called sftp_readdir_async with I'm assuming a non-zero value of offset (I have no idea why)

static int sshfs_readdir(const char *path, void *dbuf, fuse_fill_dir_t filler,
			 off_t offset, struct fuse_file_info *fi,
			 enum fuse_readdir_flags flags)
{
	(void) path; (void) flags;
	int err;
	struct dir_handle *handle;

	handle = (struct dir_handle*) fi->fh;

	if (sshfs.sync_readdir)
		err = sftp_readdir_sync(handle->conn, &handle->buf, dbuf,
					offset, filler);
	else
		err = sftp_readdir_async(handle->conn, &handle->buf, dbuf,
					 offset, filler);

	return err;
}

which causes sftp_readdir_async to fail on that assert(offset == 0); statement

static int sftp_readdir_async(struct conn *conn, struct buffer *handle,
			      void *buf, off_t offset, fuse_fill_dir_t filler)
{
	int err = 0;
	int outstanding = 0;
	int max = READDIR_START;
	GList *list = NULL;

	int done = 0;

	assert(offset == 0); // <--- PROGRAM CRASHED HERE
	...

There's no comments / docs in the code suggesting why offset must be zero, nor does sftp_readdir_async nor sftp_readdir_sync functions actually use the offset parameter as far as I can see other than the assert statement. I am no familiar with this, @bfleischer can you please shed some light on this if you're able?

Either way commenting out the assert statements in sftp_readdir_async and sftp_readdir_sync should get rid of this crash. You can try that out @dtgriscom

[dtgriscom]

And, we have a winner! I'll do more testing, but for now I'm back on the air.

I'll add a PR with these changes.

Many thanks,
Dan

[dtgriscom]

I've done a bit more thinking, and I'm concerned.

It makes sense that the asserts caused the crash, and that more sophisticated uses of the file system (i.e. specifying an offset when fetching a directory) would become more common, especially in the Finder (which probably uses every knob it can get its hands on). And my system no longer crashes, which is good.

But, non-zero values of the offset are now being ignored, so when a read is requested of an offset point in a directory (?), it will return bad data. Maybe that's better than crashing, maybe not...

I'm no low-level file system programmer, so it isn't surprising that a quick scan of the code doesn't show how to extend this.

Any thoughts, @bfleischer ?

[dtgriscom]

And I've confirmed this. Whole directories seem to disappear at times, when seen from the sshfs client machine. Who knows what other mayhem is going on in the background.

This all started when I threw away all of my brew-installed packages and reinstalled them all. Any idea how that would trigger the use of offsets when reading from a directory?

[dtgriscom]

sftp_readdir_sync() and sftp_readdir_async() are called by sshfs_readdir(), which is added to the static struct fuse_operations sshfs_oper's .readdir field. Here's the doc for that field:

Read directory

The filesystem may choose between two modes of operation:

1. The readdir implementation ignores the offset parameter, and passes zero to the filler function's offset. The filler function will not return '1' (unless an error happens), so the whole directory is read in a single readdir operation.

2. The readdir implementation keeps track of the offsets of the directory entries. It uses the offset parameter and always passes non-zero offset to the filler function. When the buffer is full (or an error happens) the filler function will return '1'.

When FUSE_READDIR_PLUS is not set, only some parameters of the fill function (the fuse_fill_dir_t parameter) are actually used: The file type (which is part of stat::st_mode) is used. And if fuse_config::use_ino is set, the inode (stat::st_ino) is also used. The other fields are ignored when FUSE_READDIR_PLUS is not set.

So, it sounds like the file system (sshfs) can choose to ignore the offset parameter and always return the whole directory. How is this choosing done?