This will be fixed by this upstream merge-request:

https://gitlab.freedesktop.org/plymouth/plymouth/-/merge_requests/354

I'm working on preparing a plymouth update addressing several issues including this one.

FEDORA-2025-bea98bd9ab (plymouth-24.004.60-19.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-bea98bd9ab

FEDORA-2025-bea98bd9ab (plymouth-24.004.60-19.fc43) has been pushed to the Fedora 43 stable repository.
If problem still persists, please make note of it in this bug report.

FEDORA-2025-84de48bce5 (plymouth-24.004.60-19.fc42) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-84de48bce5

Thanks. I tested this update plymouth-24.004.60-19.fc43 with Fedora-KDE-Desktop-Live-Rawhide-20250704.n.0.x86_64.iso in the same way. After I pressed Escape during early boot before the image check started, plymouthd crashed with a somewhat different trace in the console. I added the file and line numbers I got from running gdb on the files. plymouthd aborted in ply_array_get_uint32_elements (../src/libply/ply-array.c:139) due to a failed assertion array->element_type == PLY_ARRAY_ELEMENT_TYPE_UINT32

backtrace:
/lib64/libc.so.6(+0x19bf0)
/lib64/libc.so.6(+0x73c0c) in __pthread_kill_implementation (pthread_kill.c:44)
/lib64/libc.so.6(gsignal+0x1e) in __GI_raise (../sysdeps/posix/raise.c:27)
/lib64/libc.so.6(abort+0x26) in __GI_abort (abort.c:81)
/lib64/libc.so.6(__assert_perror_fail+0x0) in __GI___assert_perror_fail (assert-perr.c:31)
/lib64/libply.so.5(+0x1925) in ply_array_get_uint32_elements (../src/libply/ply-array.c:139)
/lib64/libply-splash-core.so.5(ply_terminal_emulator_get_nth_line+0x19) in ply_terminal_emulator_get_nth_line (../src/libply-splash-core/ply-terminal-emulator.c:1070)
/lib64/libply-splash-graphics.so.5(+0x5b38) in update_console_messages (../src/libply-splash-graphics/ply-console-viewer.c:202)
/lib64/libply.so.5(ply_event_loop_process_pending_events+0x125) in ply_event_loop_process_pending_events (../src/libply/ply-event-loop.c:1193).
/lib64/libply.so.5(ply_event_loop_run+0x28) in ply_event_loop_run (../src/libply/ply-event-loop.c:1310)
@usr/bin/plymouthd(main+0x9df) in main (../src/main.c:2596)
/lib64/libc.so.6(+0x35b5) in __libc_start_call_main (../sysdeps/nptl/libc_start_call_main.h:74)
/lib64/libc.so.6(_libc_start_main+0x88)
@usr/bin/plymouthd(_start+0x25)

(gdb) l *+0x1925
0x1925 is in ply_array_get_uint32_elements (../src/libply/ply-array.c:139).
134     }
135
136     uint32_t const *
137     ply_array_get_uint32_elements (ply_array_t *array)
138     {
139             assert (array->element_type == PLY_ARRAY_ELEMENT_TYPE_UINT32);
140             return (uint32_t const *) ply_buffer_get_bytes (array->buffer);
141     }
142
143     void **

plymouthd crashed a second time later in the boot in ply_event_loop_stop_watching_fd where the pointer destination was invalid.

Core was generated by `/usr/bin/plymouthd --mode=boot --pid-file=/run/plymouth/pid --attach-to-session'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007f899b429414 in ply_event_loop_stop_watching_fd (loop=0x555b50ad2450, watch=0x555b50b437d0)
    at ../src/libply/ply-event-loop.c:760
760             source = destination->source;

(gdb) bt
#0  0x00007f899b429414 in ply_event_loop_stop_watching_fd (loop=0x555b50ad2450, watch=0x555b50b437d0)
    at ../src/libply/ply-event-loop.c:760
#1  0x00007f899aff1f30 in close_input_source (backend=0x555b50adb580, input_source=0x555b50adb5b0)
    at ../src/plugins/renderers/drm/plugin.c:1981
#2  0x00007f899b4005f6 in ply_renderer_close_input_source (renderer=0x555b50ada000,
    input_source=<optimized out>) at ../src/libply-splash-core/ply-renderer.c:459
#3  0x00007f899b3fa7a9 in ply_keyboard_stop_watching_for_renderer_input (keyboard=0x555b50adc8f0)
    at ../src/libply-splash-core/ply-keyboard.c:402
#4  ply_keyboard_stop_watching_for_input (keyboard=keyboard@entry=0x555b50adc8f0)
    at ../src/libply-splash-core/ply-keyboard.c:491
#5  0x00007f899b3faaf2 in ply_device_manager_deactivate_keyboards (manager=0x555b50ad7ba0)
    at ../src/libply-splash-core/ply-device-manager.c:1432
#6  0x0000555b3fac16f9 in on_quit (state=0x7ffe93c7de60, retain_splash=false, quit_trigger=0x555b50b92f10)
    at ../src/main.c:1466
#7  0x0000555b3fac9790 in ply_boot_connection_on_request (connection=0x555b50ba50e0)
    at ../src/ply-boot-server.c:543
#8  0x00007f899b42d63d in ply_event_loop_handle_met_status_for_source (loop=<optimized out>,
    source=0x555b50ba5610, status=<optimized out>) at ../src/libply/ply-event-loop.c:1040
#9  ply_event_loop_process_pending_events (loop=0x555b50ad2450) at ../src/libply/ply-event-loop.c:1279
#10 0x00007f899b42da88 in ply_event_loop_run (loop=0x555b50ad2450) at ../src/libply/ply-event-loop.c:1311
#11 0x0000555b3fab5a5f in main (argc=<optimized out>, argv=<optimized out>) at ../src/main.c:2595
(gdb) frame 0
#0  0x00007f899b429414 in ply_event_loop_stop_watching_fd (loop=0x555b50ad2450, watch=0x555b50b437d0) at ../src/libply/ply-event-loop.c:760
760             source = destination->source;
(gdb) p destination
$1 = (ply_event_destination_t *) 0x555e050f0074
(gdb) p *destination
Cannot access memory at address 0x555e050f0074

watch->destination was at the the same invalid address.

(gdb) p watch
$4 = (ply_fd_watch_t *) 0x555b50b437d0
(gdb) p *watch
$5 = {destination = 0x555e050f0074}
(gdb) p *watch->destination
Cannot access memory at address 0x555e050f0074

FEDORA-2025-84de48bce5 has been pushed to the Fedora 42 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-84de48bce5`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-84de48bce5

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

FEDORA-2025-84de48bce5 (plymouth-24.004.60-19.fc42) has been pushed to the Fedora 42 stable repository.
If problem still persists, please make note of it in this bug report.

I'm reopening this again due to the crashes I described in comment 5.

So I am looking at the first crash in Comment 5.
It seems something VERY weird is happening

Looking at the stack trace
```
/lib64/libc.so.6(__assert_perror_fail+0x0) in __GI___assert_perror_fail (assert-perr.c:31)
/lib64/libply.so.5(+0x1925) in ply_array_get_uint32_elements (../src/libply/ply-array.c:139)
/lib64/libply-splash-core.so.5(ply_terminal_emulator_get_nth_line+0x19) in ply_terminal_emulator_get_nth_line (../src/libply-splash-core/ply-terminal-emulator.c:1070)
```

```
ply_rich_text_t *
ply_terminal_emulator_get_nth_line (ply_terminal_emulator_t *terminal_emulator,
                                    int                      line_number)
{
        ply_rich_text_t *const *console_lines = (ply_rich_text_t *const *) ply_array_get_pointer_elements (terminal_emulator->lines);
        return console_lines[line_number % terminal_emulator->number_of_rows];
}

```


It should be calling ply_array_get_pointer_elements, NOT ply_array_get_uint32_elements . That is weird, I am struggling to see how a fairly simple function like `ply_terminal_emulator_get_nth_line` is calling the *wrong function*, unless I am missing something, I am not sure how that is really even possible, but that would be why the assert fails. 

It also seems that that line should be 1069, not 1070. I wonder if something out of upstream is getting applied there?

Yeah, I thought that the ply_array_get_uint32_elements was odd given that ply_array_get_pointer_elements was called in ply_terminal_emulator_get_nth_line. There was the cast (ply_rich_text_t *const *) ply_array_get_pointer_elements, but I don't know if that could affect it. The functions, files and lines I put in the first trace were what gdb gave me when I ran lines like the following in Konsole in the image Fedora-KDE-Desktop-Live-Rawhide-20250704.n.0.x86_64.iso with the relevant plymouth-24.004.60-19.fc43 debuginfo rpms installed.
gdb /lib64/libply.so.5
(gdb) l *+0x1925

Could the kernel which looked to have output that trace and gdb have calculated the offsets differently? There were 18 patches applied to plymouth-24.004.60-19.fc43 in plymouth.spec https://src.fedoraproject.org/rpms/plymouth/tree/rawhide Fedora used the simpledrm driver for plymouth by default https://bugzilla.redhat.com/show_bug.cgi?id=2346150 I could try disabling simpledrm with plymouth.use-simpledrm=0 on the kernel command line. https://fedoraproject.org/wiki/Changes/PlymouthUseSimpledrm Thanks.

I tested disabling simpledrm with plymouth.use-simpledrm=0 on the kernel command line with Fedora-KDE-Desktop-Live-Rawhide-20250704.n.0.x86_64.iso on bare metal. I pressed Escape when plymouth first appeared before the image check. Several normal systemd messages were shown, but then the screen went black for about 30 seconds. The first type of crash wasn't shown on the terminal or in the journal later. The plymouth spinner screen appeared later. When I pressed Escape again, the terminal output wasn't shown. plymouthd crashed in ply_event_loop_stop_watching_fd at a later line than the crash in comment 5. The pointer source was to an invalid address 0xd, so source->fd was inaccessible.

Core was generated by `/usr/bin/plymouthd --mode=boot --pid-file=/run/plymouth/pid --attach-to-session'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  ply_event_loop_stop_watching_fd (loop=0x55ecfb983450, watch=0x55ecfb9f47d0) at ../src/libply/ply-event-loop.c:768
768             assert (source->fd >= 0); 

(gdb) bt
#0  ply_event_loop_stop_watching_fd (loop=0x55ecfb983450, watch=0x55ecfb9f47d0) at ../src/libply/ply-event-loop.c:768
#1  0x00007f0d2ab8ef30 in close_input_source (backend=0x55ecfb98c580, input_source=0x55ecfb98c5b0) at ../src/plugins/renderers/drm/plugin.c:1981
#2  0x00007f0d2af9d5f6 in ply_renderer_close_input_source (renderer=0x55ecfb98b000, input_source=<optimized out>) at ../src/libply-splash-core/ply-renderer.c:459
#3  0x00007f0d2af977a9 in ply_keyboard_stop_watching_for_renderer_input (keyboard=0x55ecfb98d8f0) at ../src/libply-splash-core/ply-keyboard.c:402
#4  ply_keyboard_stop_watching_for_input (keyboard=keyboard@entry=0x55ecfb98d8f0) at ../src/libply-splash-core/ply-keyboard.c:491
#5  0x00007f0d2af97af2 in ply_device_manager_deactivate_keyboards (manager=0x55ecfb988ba0) at ../src/libply-splash-core/ply-device-manager.c:1432
#6  0x000055ecdc6246f9 in on_quit (state=0x7ffed2c426b0, retain_splash=false, quit_trigger=0x55ecfbaf83b0) at ../src/main.c:1466
#7  0x000055ecdc62c790 in ply_boot_connection_on_request (connection=0x55ecfbb44550) at ../src/ply-boot-server.c:543
#8  0x00007f0d2afca63d in ply_event_loop_handle_met_status_for_source (loop=<optimized out>, source=0x55ecfbb445f0, status=<optimized out>)
    at ../src/libply/ply-event-loop.c:1040
#9  ply_event_loop_process_pending_events (loop=0x55ecfb983450) at ../src/libply/ply-event-loop.c:1279
#10 0x00007f0d2afcaa88 in ply_event_loop_run (loop=0x55ecfb983450) at ../src/libply/ply-event-loop.c:1311
#11 0x000055ecdc618a5f in main (argc=<optimized out>, argv=<optimized out>) at ../src/main.c:2595
(gdb) p source->fd
Cannot access memory at address 0xd
(gdb) p source
$1 = (ply_event_source_t *) 0xd

This crash happened at the same time as plymouth-quit-wait.service and plymouth-quit.service started.