From a1a07ffe49bd7faea92a437a2d1457a1382a2acd Mon Sep 17 00:00:00 2001
From: Zach Madsen <zach@zachmadsen.com>
Date: Fri, 15 May 2026 07:14:54 -0700
Subject: [PATCH 1/2] Allow <module!_start as a valid top frame

---
 src/TraceEvent/TraceEventStacks.cs | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/TraceEvent/TraceEventStacks.cs b/src/TraceEvent/TraceEventStacks.cs
index f92c41bfc..53eeaac64 100644
--- a/src/TraceEvent/TraceEventStacks.cs
+++ b/src/TraceEvent/TraceEventStacks.cs
@@ -673,6 +673,14 @@ private bool ReasonableTopFrame(StackSourceCallStackIndex callStackIndex, Thread
                     return true;
                 }
 
+                // On Linux, <processName>!_start is an ELF entry point for C programs.
+                string processName = m_log.Threads[threadIndex].Process.Name;
+                if (string.Compare(moduleFileName, processName, StringComparison.OrdinalIgnoreCase) == 0)
+                {
+                    m_goodTopModuleIndex = moduleFileIndex;
+                    return true;
+                }
+
                 // The special processes 4 (System) and 0 (Kernel) can stay in the kernel without being broken.  
                 if (moduleFile.FilePath.EndsWith("ntoskrnl.exe", StringComparison.OrdinalIgnoreCase))
                 {

From 6bfa831114ae7c8dd155be6afa75ca8a36fb9674 Mon Sep 17 00:00:00 2001
From: Zach Madsen <zach@zachmadsen.com>
Date: Fri, 15 May 2026 07:16:13 -0700
Subject: [PATCH 2/2] Add one to symbol length to catch addresses on symbol
 boundaries, like _start

---
 src/TraceEvent/TraceLog.cs | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/TraceEvent/TraceLog.cs b/src/TraceEvent/TraceLog.cs
index fb0f65fe1..f397c03bb 100644
--- a/src/TraceEvent/TraceLog.cs
+++ b/src/TraceEvent/TraceLog.cs
@@ -8570,10 +8570,12 @@ internal void AddUniversalDynamicSymbol(ProcessSymbolTraceData data, TraceProces
         {
             Debug.Assert(process != null);
 
+            // EndAddress is inclusive, so add one to get the exclusive length.
+            long symbolLength = (long)(data.EndAddress - data.StartAddress + 1);
+
             // Skip symbols with invalid address ranges. The length parameter to ForAllUnresolvedCodeAddressesInRange
             // is a signed long, so ranges whose unsigned size exceeds long.MaxValue (e.g., [0x0, 0xFFFFFFFFFFFFFFFF)
             // from zeroed /proc/kallsyms on Linux without root) would overflow to a negative value and must be rejected.
-            long symbolLength = (long)(data.EndAddress - data.StartAddress);
             if (symbolLength <= 0)
             {
                 return;