EXC_BAD_ACCESS in SkyLight SLSWindowServerClientManagedDisplayGetCurrentSpace called from `-[NSScreen _notchFrame]` during display cycle (macOS 14.7.4, Intel MacBook Pro)

Our macOS app crashes intermittently on the main thread inside system frames only. No frame of our own code is in the crashed thread's stack. I would like to know whether others have seen this, and whether there is a known cause or workaround.

• macOS 14.7.4 (23H420)
• MacBookPro16,1 (16-inch, 2019), Intel Core i7-9750H, dual GPU (Intel UHD Graphics 630 + AMD Radeon Pro 5300M, automatic graphics switching)
• Built-in display only, as far as we can tell. We have no record of an external display being connected.
• The same machine crashed 3 times in 7 days with this same crash signature.

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x000000010a5f9008
Crashed Thread:  0  Dispatch queue: com.apple.main-thread
Time Since Wake: 4798 seconds

VM Region Info: 0x10a5f9008 is not in any region.
  CoreAnimation  10a5f8000-10a5f9000  [4K]  rw-/rwx
--->  GAP OF 0x2000 BYTES
  CoreAnimation  10a5fb000-10a5fd000  [8K]  r--/r--

Thread 0 Crashed:
0   SkyLight   SLSWindowServerClientManagedDisplayGetCurrentSpace + 181
1   AppKit     -[NSScreen _notchFrame] + 85
2   AppKit     _NSScreenFrameByAdjustingFrameForNotch + 55
3   AppKit     -[NSScreen _layoutFrame] + 130
4   AppKit     -[NSScreen visibleFrame] + 47
5   AppKit     -[NSWindow(NSWindowResizing) _resizableEdgesForGrowing:shrinking:] + 589
6   AppKit     -[NSWindow(NSWindowResizing) _getEdgeResizingRects:] + 37
7   AppKit     -[NSWindow(NSWindow_Theme) _regionForOpaqueViewsModifiedForResizing:] + 53
8   AppKit     -[NSWindow(NSWindow_Theme) _resetDragMargins] + 343
9   AppKit     -[NSWindow(NSWindow_Theme) _resetDragMarginsIfNeeded] + 43
10  AppKit     __NSWindowGetDisplayCycleObserverForUpdateStructuralRegions_block_invoke + 375
11  AppKit     NSDisplayCycleObserverInvoke + 140
12  AppKit     NSDisplayCycleFlush + 878
13  QuartzCore CA::Transaction::run_commit_handlers(CATransactionPhase) + 95
14  QuartzCore CA::Transaction::commit() + 377
15  AppKit     -[_NSScrollingConcurrentMainThreadSynchronizer _synchronize:preCommitHandler:completionHandler:] + 336
...

• The faulting address is just past a mapped 4K CoreAnimation region, which suggests a stale pointer into a dynamically mapped region. Near the faulting instruction there is a loop that advances by 0x14 bytes per iteration, which might be a table walk. This is our reading of the disassembly only, not confirmed.
• About 1 second before the crash, our app closed a secondary window (a standalone chat window). This is the only UI action we see just before the crash, and it happened once, so we cannot say it is the trigger.
• The crash is not tied to a specific app feature, and it was not right after wake (about 80 minutes after the last wake).
• Separately, we see crashes on other Intel Macs inside SkyLight called from NSDisplayTiming, across macOS 13 to 26, with the same kind of "address outside any mapped region" fault. We believe they may share a root cause, but we have not proven it.

1. Has anyone seen _notchFrame / SLSWindowServerClientManagedDisplayGetCurrentSpace crashing like this, especially on a Mac with no physical notch?
2. Is -[NSWindow _resetDragMargins] known to read screen geometry at a time when the display configuration or active space can change?
3. Is there anything an app can do (for example, when and how it closes windows, or where it reads NSScreen.visibleFrame) to avoid this, or is this a system bug that should go to Feedback Assistant?

I can share the full crash report if it helps. I'll also file a Feedback and post the FB number here.