src/Hooks/ProvideBeatsaverLevelHooks.cpp (2)

28-33: Respect cancellation and guard against faulted/canceled base task before dereferencing Result.

• The hook receives a CancellationToken but it isn’t passed to StartTask, and the polling loops don’t check for cancellation.
• ‘t->Result’ is read even if ‘t’ was canceled/faulted.

Apply this diff to propagate cancelToken and add guards:

-        return MultiplayerCore::StartTask<bool>([=](){
+        return MultiplayerCore::StartTask<bool>([=](::System::Threading::CancellationToken token){
             using namespace std::chrono_literals;
-            while (!(t->IsCompleted || t->IsCanceled)) std::this_thread::sleep_for(50ms);
-            // if orig says it's available, cool beans
-            if (t->Result) return true;
+            while (!(t->IsCompleted || t->IsCanceled)) {
+                if (token.get_IsCancellationRequested()) return false;
+                std::this_thread::sleep_for(50ms);
+            }
+            // if orig says it's available, cool beans
+            if (t->IsFaulted || t->IsCanceled) return false;
+            if (t->Result) return true;
@@
-        });
+        }, std::forward<::System::Threading::CancellationToken>(cancelToken));

---

19-22: Root the captured managed Task to prevent GC collection

After inspecting ProvideBeatsaverLevelHooks.cpp and tasks.hpp, it’s clear that the hook’s lambda captures the raw managed pointer t (the original Task<bool>) without any GC rooting. Since the hook returns a new Task<bool> to the managed side, there are no remaining managed references to the original t, allowing the GC to collect it while the background thread is still polling it—potentially leading to sporadic crashes when calling t->IsCompleted or reading t->Result.

To fix this, you must ensure the original Task<bool>* t remains rooted for the lifetime of the polling logic. Two approaches are acceptable:

• Use a SafePtr wrapper around the original task pointer to pin it in the GC heap. For example:

auto t = BeatmapLevelsModel_CheckBeatmapLevelDataExistsAsync(self, levelID, beatmapLevelDataVersion, cancelToken);
// root the original Task<bool>
MultiplayerCore::SafePtr<System::Threading::Tasks::Task_1<bool>> safeT{t};
// …
return MultiplayerCore::StartTask<bool>([=](){
    auto* rootedT = safeT.get();           // safely rooted pointer
    using namespace std::chrono_literals;
    while (!(rootedT->IsCompleted || rootedT->IsCanceled)) std::this_thread::sleep_for(50ms);
    if (rootedT->Result) return true;
    // …
});

• Alternatively, leverage the managed Task’s continuation API instead of manual polling. For example:

auto t = BeatmapLevelsModel_CheckBeatmapLevelDataExistsAsync(self, levelID, beatmapLevelDataVersion, cancelToken);
// return a continuation directly on ‘t’
return t->ContinueWith([](System::Threading::Tasks::Task_1<bool>* completed) {
    if (completed->Result) return true;
    // perform Beatsaver lookup and download…
});

Both approaches ensure the original task object remains alive until your custom logic completes.

Relevant location:

• src/Hooks/ProvideBeatsaverLevelHooks.cpp, lines ~19–22, where auto t = … is declared and captured.

src/Objects/MpEntitlementChecker.cpp (1)

84-105: Async captures ‘this’ without lifetime guarantees; risk of UAF during shutdown.

The lambda captures ‘this’ and updates members after waiting on baseTask. If the checker is destroyed (e.g., scene change) before the lambda runs, dereferencing ‘this’ yields UAF.

Mitigations:

• Capture a SafePtr/Weak pointer to the checker and early-return if it expired.
• Consider adding a CancellationTokenSource owned by the checker, cancel it in OnDestroy_override, and pass its token to StartTask so pending work exits.

Example pattern (sketch; adjust to your SafePtr utilities):

-        auto task = StartTask<GlobalNamespace::EntitlementsStatus>([this, baseTask, levelId](){
+        auto self = SafePtr(this);
+        auto task = StartTask<GlobalNamespace::EntitlementsStatus>([self, baseTask, levelId](){
             using namespace std::chrono_literals;
+            if (!self) return GlobalNamespace::EntitlementsStatus::Unknown;
@@
-            _entitlementsDictionary[_sessionManager->localPlayer->userId][levelId] = entitlement;
+            self->_entitlementsDictionary[self->_sessionManager->localPlayer->userId][levelId] = entitlement;
             return entitlement;
         });

If you prefer cancellation:

• Add a field CancellationTokenSource _cts; cancel it in OnDestroy_override; pass _cts.Token to StartTask and check token inside the lambda loops.

src/Objects/MpLevelLoader.cpp (2)

148-176: Cancellation token is passed but unused; honor it to prevent long-running work after abort.

You accept a CancellationToken and spawn a cancellation-aware StartTask, but the lambda doesn’t check ‘token’. Add early-outs before and after blocking calls.

-        return StartTask<GlobalNamespace::LoadBeatmapLevelDataResult>([this, levelId](CancellationToken token) -> GlobalNamespace::LoadBeatmapLevelDataResult {
+        return StartTask<GlobalNamespace::LoadBeatmapLevelDataResult>([this, levelId](CancellationToken token) -> GlobalNamespace::LoadBeatmapLevelDataResult {
             try {
+                if (token.get_IsCancellationRequested()) {
+                    DEBUG("Download for {} canceled before start", levelId);
+                    return ::GlobalNamespace::LoadBeatmapLevelDataResult::getStaticF_Error();
+                }
                 auto success = _levelDownloader->TryDownloadLevelAsync(levelId, std::bind(&MpLevelLoader::Report, this, std::placeholders::_1)).get();
+                if (token.get_IsCancellationRequested()) {
+                    DEBUG("Download for {} canceled after TryDownloadLevelAsync", levelId);
+                    return ::GlobalNamespace::LoadBeatmapLevelDataResult::getStaticF_Error();
+                }
                 if (!success) {
                     DEBUG("Failed to download level");
@@
                 auto level = _runtimeSongLoader->GetLevelByLevelID(levelId);
                 if (!level) {
                     DEBUG("Couldn't get level by id");
                     return ::GlobalNamespace::LoadBeatmapLevelDataResult::getStaticF_Error();
                 }
                 if (!level->beatmapLevelData) {
                     DEBUG("level data is null!");
                     return ::GlobalNamespace::LoadBeatmapLevelDataResult::getStaticF_Error();
                 }
             } catch(std::exception const& e) {
                 ERROR("Caught error during beatmap level download: {}, what: {}", typeid(e).name(), e.what());
             }
             return ::GlobalNamespace::LoadBeatmapLevelDataResult::getStaticF_Error();
         }, std::forward<CancellationToken>(cancellationToken));

---

128-133: Bug: requirement check early-returns on has_value(); condition is inverted.

If ‘diffDataOpt’ has a value, we should analyze requirements; the current code returns immediately, making the block below unreachable.

-        if (diffDataOpt.has_value()) return;
+        if (!diffDataOpt.has_value()) return;
 
-        auto& diffData = diffDataOpt->get();
+        auto& diffData = diffDataOpt->get();

src/Beatmaps/BeatSaverPreviewMediaData.cpp (1)

73-101: Check UnityWebRequest result and dispose to avoid leaks.

After SendWebRequest completes, validate the request result and dispose the handle once content is extracted.

                     auto webRequest = UnityEngine::Networking::UnityWebRequestMultimedia::GetAudioClip(v->GetPreviewURL(), UnityEngine::AudioType::MPEG);
                     auto www = webRequest->SendWebRequest();
-                    while (!www->get_isDone()) std::this_thread::sleep_for(std::chrono::milliseconds(100));
+                    while (!www->get_isDone()) std::this_thread::sleep_for(std::chrono::milliseconds(100));
+                    // Validate request succeeded
+                    if (webRequest->get_result() != UnityEngine::Networking::UnityWebRequest::Result::Success) {
+                        return (UnityEngine::AudioClip*)nullptr;
+                    }
@@
-                    BSML::MainThreadScheduler::Schedule([webRequest, &result](){
-                        result = UnityEngine::Networking::DownloadHandlerAudioClip::GetContent(webRequest);
+                    BSML::MainThreadScheduler::Schedule([webRequest, &result](){
+                        result = UnityEngine::Networking::DownloadHandlerAudioClip::GetContent(webRequest);
+                        // Dispose on main thread after extracting content to free native resources
+                        webRequest->Dispose();
                     });

Also consider using Task_1UnityEngine::AudioClip*::FromResult(_cachedAudioClip) for consistency with GetCoverSpriteAsync’s FromResult usage.

src/Hooks/PlatformAuthenticationTokenProviderHooks.cpp (2)

36-84: Avoid UAF and data races in async token hook; snapshot self fields, make flags atomic, and bound the wait.

The lambda runs on a background il2cpp-aware thread and captures self by value (raw pointer). If the provider is destroyed before the lambda completes, this can crash. Also, userEntitled and entitltiementCheckRan are written from the Oculus callback and read on this thread without synchronization (data race), and the wait can spin forever if callbacks aren’t pumped.

Apply this diff to snapshot fields, fix the racy flags, and bound the wait (5s):

-    return MultiplayerCore::StartTask<GlobalNamespace::AuthenticationToken>([=](){
+    // Snapshot fields before crossing the thread boundary to avoid UAF on `self`
+    auto platform_snapshot = self->_platform;
+    auto userId_snapshot = self->_userId;
+    auto userName_snapshot = self->_userName;
+    return MultiplayerCore::StartTask<GlobalNamespace::AuthenticationToken>([=](){
         using namespace std::chrono_literals;
         while (!(t->IsCompleted || t->IsCanceled)) std::this_thread::sleep_for(50ms);
         GlobalNamespace::AuthenticationToken token = t->ResultOnSuccess;
         bool hasToken = !System::String::IsNullOrEmpty(token.sessionToken);
         if (token && hasToken) {
             INFO("Successfully got auth token, returning it!");
             if (token.platform == GlobalNamespace::AuthenticationToken::Platform::Oculus) 
                 token.platform = GlobalNamespace::AuthenticationToken::Platform::OculusQuest; // Makes sure platform is set to OculusQuest
             return token;
         }
-        else if (!hasToken && self->_platform.value__ != 20) ERROR("Session token is null or empty!!! Either they don't own the game or modded games no longer have access to tokens");
+        else if (!hasToken && platform_snapshot.value__ != 20) ERROR("Session token is null or empty!!! Either they don't own the game or modded games no longer have access to tokens");
         WARNING("Failed to get auth token, returning custom authentication token!");
 
         // Check users entitlement to the app
-        bool userEntitled = true;
-        if (self->_platform.value__ != 20)
+        std::atomic_bool userEntitled{true};
+        if (platform_snapshot.value__ != 20)
         {
-            bool entitltiementCheckRan = false;
+            std::atomic_bool entitlementCheckRan{false};
             INFO("Checking entitlement to the app");
             // auto request = Oculus::Platform::Entitlements::IsUserEntitledToApplication();
             auto request = Oculus::Platform::Request::New_ctor(
                 Oculus::Platform::CAPI::ovr_Entitlement_GetIsViewerEntitled());
             request->OnComplete(custom_types::MakeDelegate<Oculus::Platform::Message::Callback*>(
                 std::function<void(Oculus::Platform::Message*)>([&](Oculus::Platform::Message* msg) {
                     if (msg->IsError) {
                         ERROR("User is not entitled to the app: {}", msg->GetError()->Message);
-                        userEntitled = false;
+                        userEntitled.store(false, std::memory_order_relaxed);
                     }
                     else {
                         INFO("User is entitled to the app, returning custom authentication token!");
                         // userEntitled = true;
                     }
-                    entitltiementCheckRan = true;
+                    entitlementCheckRan.store(true, std::memory_order_release);
                 }
             )));
 
-            while (!entitltiementCheckRan) std::this_thread::sleep_for(50ms);
+            // Bound wait to avoid indefinite hang if callbacks aren't pumped
+            for (int i = 0; i < 100 && !entitlementCheckRan.load(std::memory_order_acquire); ++i) {
+                std::this_thread::sleep_for(50ms);
+            }
         }
 
         return GlobalNamespace::AuthenticationToken(
-            self->_platform == GlobalNamespace::AuthenticationToken::Platform::Oculus ? GlobalNamespace::AuthenticationToken::Platform::OculusQuest : self->_platform,
-            self->_userId, // Important for server and client to keep track of players, should not be messed with if possible
-            self->_userName,
-            userEntitled ? dummy_auth : nullptr
+            platform_snapshot == GlobalNamespace::AuthenticationToken::Platform::Oculus ? GlobalNamespace::AuthenticationToken::Platform::OculusQuest : platform_snapshot,
+            userId_snapshot, // Important for server and client to keep track of players, should not be messed with if possible
+            userName_snapshot,
+            userEntitled.load(std::memory_order_relaxed) ? dummy_auth : nullptr
         );
     });

Follow-ups:

• Consider replacing literal 20 with a named constant for Pico (see separate nit).
• If entitlement callbacks require a pump, consider scheduling the entitlement check differently or explicitly documenting where callbacks are pumped. I can help wire a pump into a central tick if needed.

---

109-137: Fix uninitialized pointer on fault path and propagate cancellation to StartTask.

info is used uninitialized when t->IsFaulted is true, and cancellation from ctx is ignored. Both can cause crashes or hangs.

Apply this diff:

-        try {
-            return MultiplayerCore::StartTask<GlobalNamespace::UserInfo*>([=](){
+        try {
+            return MultiplayerCore::StartTask<GlobalNamespace::UserInfo*>([=](){
                 using namespace std::chrono_literals;
                 DEBUG("Start UserInfoTask");
-                while (!(t->IsCompleted || t->IsCanceled)) std::this_thread::sleep_for(50ms);
-                GlobalNamespace::UserInfo* info;
-                if (!t->IsFaulted) {
-                    info = t->Result;
-                } else ERROR("UserInfo Task faulted");
+                while (!(t->IsCompleted || t->IsCanceled || t->IsFaulted)) std::this_thread::sleep_for(50ms);
+                if (t->IsCanceled) {
+                    DEBUG("UserInfo Task canceled");
+                    return static_cast<GlobalNamespace::UserInfo*>(nullptr);
+                }
+                if (t->IsFaulted) {
+                    ERROR("UserInfo Task faulted");
+                    return static_cast<GlobalNamespace::UserInfo*>(nullptr);
+                }
+                GlobalNamespace::UserInfo* info = t->Result;
                 if (info) {
                     // INFO("Successfully got user info, returning it!");
                     // if (isPico.load())
                     // {
                     INFO("User is on Pico, changing platform to 20");
                     info->platform = GlobalNamespace::UserInfo::Platform(20);
                     // }
                 } else {
                     ERROR("UserInfo null!");
                 }
                 return info;
-            });
+            }, std::move(ctx));
         } catch (const std::exception& ex) {
             ERROR("Could not Start Task: {}", ex.what());
             return t;
         }

This prevents undefined behavior and respects the caller’s cancellation token.