Source mapping
==============

MariaDB Server tag mariadb-11.4.12 resolves to:
  b4a80422bfeec93079a430c080fffbda8f6fa574

Its storage/columnstore/columnstore submodule resolves to:
  962e861c6a11e375cd95c78a517ab2b5d50e0076

Relevant ColumnStore 25.10.4 code
=================================

dbcon/mysql/ha_mcs_impl_if.h:654
  cal_connection_info contains the connection-level columnTypes vector.

dbcon/mysql/ha_mcs_impl.cpp:3122-3127
  ha_mcs_impl_start_bulk_insert() reserves capacity and appends ColType entries
  without clearing existing entries first.

dbcon/mysql/ha_mcs_impl.cpp:3442-3452
  The thd->killed cpimport path sends SIGUSR1, closes the stream, and waits for
  cpimport. It does not clear columnTypes or reset cpimport_pid.

dbcon/mysql/ha_mcs_impl.cpp:3465
  cpimport_pid is reset in the non-killed else branch, which also handles
  cpimport failures.

dbcon/mysql/ha_mcs_impl.cpp:3525
  columnTypes.clear() is also only in the non-killed else branch.

dbcon/mysql/ha_mcs_dml.cpp:707
  ha_mcs_impl_write_batch_row_() loops until colpos reaches
  ci.columnTypes.size().

dbcon/mysql/ha_mcs_dml.cpp:751
  The same colpos is used for table->field[colpos] without comparing it to the
  actual table field count.

dbcon/mysql/ha_mcs_impl.cpp:3706-3708
  cal_connection_info is deleted when the physical database connection is
  closed. Reconnecting is a proposed mitigation, not a validated workaround.

Comparison with ColumnStore 25.10.5-1
=====================================

The relevant start, cancelled completion, normal cleanup, and batch-write
logic is unchanged in 25.10.5-1. Changes between the revisions in these files
are unrelated to columnTypes cleanup.

Assessment
==========

Confirmed source defect:
  The cancelled cpimport branch does not perform the same connection-state
  cleanup as the normal branch.

Strong incident hypothesis:
  A cancelled bulk insert leaves stale columnTypes entries. A later bulk
  insert on the same connection appends another set of entries. The write loop
  can then index table->field past the real field count and crash.

Not yet confirmed:
  Installed plugin binary correspondence and runtime reproduction.
  Register/local-variable values at the exact crash instruction. A binary core
  dump and matching debug symbols would be required for final confirmation.

The nullable-column header bounds check at ha_mcs_dml.cpp:722-727 can return
an error before invalid field access. A crash is therefore layout-dependent.