But:

#0  std::_List_iterator<std::pair<std::shared_ptr<boost::re_detail_500::cpp_regex_traits_implementation<char> const>, boost::re_detail_500::cpp_regex_traits_base<char> const*> >::operator++ (this=<optimized out>)
    at /nix/store/yps9cjmi8g58mh0f7pw902br7gxwg2dz-gcc-14.3.0/include/c++/14.3.0/bits/stl_list.h:290
#1  std::__cxx11::list<std::pair<std::shared_ptr<boost::re_detail_500::cpp_regex_traits_implementation<char> const>, boost::re_detail_500::cpp_regex_traits_base<char> const*>, std::allocator<std::pair<std::shared_ptr<boost::re_detail_500::cpp_regex_traits_implementation<char> const>, boost::re_detail_500::cpp_regex_traits_base<char> const*> > >::splice (this=0x7ff093ffcc00, __position={...},
    __i=<error reading variable: Cannot access memory at address 0x50>, __x=...)
    at /nix/store/yps9cjmi8g58mh0f7pw902br7gxwg2dz-gcc-14.3.0/include/c++/14.3.0/bits/stl_list.h:1672
#2  std::__cxx11::list<std::pair<std::shared_ptr<boost::re_detail_500::cpp_regex_traits_implementation<char> const>, boost::re_detail_500::cpp_regex_traits_base<char> const*>, std::allocator<std::pair<std::shared_ptr<boost::re_detail_500::cpp_regex_traits_implementation<char> const>, boost::re_detail_500::cpp_regex_traits_base<char> const*> > >::splice (this=0x7ff093ffcc00, __position={...},
    __i=<error reading variable: Cannot access memory at address 0x50>, __x=...)
    at /nix/store/yps9cjmi8g58mh0f7pw902br7gxwg2dz-gcc-14.3.0/include/c++/14.3.0/bits/stl_list.h:1699
#3  boost::object_cache<boost::re_detail_500::cpp_regex_traits_base<char>, boost::re_detail_500::cpp_regex_traits_implementation<char> >::do_get (k=..., l_max_cache_size=l_max_cache_size@entry=5)
    at /nix/store/zw6w6chqvqsh2c6jfsb4pw9bpgdkmjnh-boost-1.87.0-dev/include/boost/regex/v5/object_cache.hpp:100
#4  0x00007ff4bd772e95 in boost::object_cache<boost::re_detail_500::cpp_regex_traits_base<char>, boost::re_detail_500::cpp_regex_traits_implementation<char> >::get (k=..., l_max_cache_size=5)
    at /nix/store/zw6w6chqvqsh2c6jfsb4pw9bpgdkmjnh-boost-1.87.0-dev/include/boost/regex/v5/object_cache.hpp:70
#5  boost::re_detail_500::create_cpp_regex_traits<char> (l=Python Exception <class 'gdb.error'>: There is no member named _M_impl.
)
    at /nix/store/zw6w6chqvqsh2c6jfsb4pw9bpgdkmjnh-boost-1.87.0-dev/include/boost/regex/v5/cpp_regex_traits.hpp:729
#6  0x00007ff4bd772d7f in boost::cpp_regex_traits<char>::cpp_regex_traits (this=0x7ff08c009ef0)
    at /nix/store/zw6w6chqvqsh2c6jfsb4pw9bpgdkmjnh-boost-1.87.0-dev/include/boost/regex/v5/cpp_regex_traits.hpp:749
#7  boost::regex_traits<char, boost::cpp_regex_traits<char> >::regex_traits (this=0x7ff08c009ef0)
    at /nix/store/zw6w6chqvqsh2c6jfsb4pw9bpgdkmjnh-boost-1.87.0-dev/include/boost/regex/v5/regex_traits.hpp:39
#8  boost::regex_traits_wrapper<boost::regex_traits<char, boost::cpp_regex_traits<char> > >::regex_traits_wrapper (this=0x7ff08c009ef0)
    at /nix/store/zw6w6chqvqsh2c6jfsb4pw9bpgdkmjnh-boost-1.87.0-dev/include/boost/regex/v5/regex_traits.hpp:121
#9  boost::re_detail_500::regex_data<char, boost::regex_traits<char, boost::cpp_regex_traits<char> > >::regex_data (this=0x7ff08c009d50)
    at /nix/store/zw6w6chqvqsh2c6jfsb4pw9bpgdkmjnh-boost-1.87.0-dev/include/boost/regex/v5/basic_regex.hpp:172
#10 0x00007ff4bd7729bd in boost::re_detail_500::basic_regex_implementation<char, boost::regex_traits<char, boost::cpp_regex_traits<char> > >::basic_regex_implementation (this=0x7ff08c009d50)
    at /nix/store/zw6w6chqvqsh2c6jfsb4pw9bpgdkmjnh-boost-1.87.0-dev/include/boost/regex/v5/basic_regex.hpp:212
#11 boost::basic_regex<char, boost::regex_traits<char, boost::cpp_regex_traits<char> > >::do_assign (
    this=this@entry=0x7ff4bd90cad0 <nix::quoteRegexChars(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&)::specialRegex>, p1=p1@entry=0x7ff4bd580f79 <.L.str.27> "[.^$\\\\*+?()\\[\\]{}|]", p2=0x7ff4bd580f8c <.L.str.27+19> "", f=f@entry=0)
    at /nix/store/zw6w6chqvqsh2c6jfsb4pw9bpgdkmjnh-boost-1.87.0-dev/include/boost/regex/v5/basic_regex.hpp:640
#12 0x00007ff4bd76d593 in boost::basic_regex<char, boost::regex_traits<char, boost::cpp_regex_traits<char> > >::assign (
    this=0x7ff4bd90cad0 <nix::quoteRegexChars(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&)::specialRegex>, p1=0x7ff4bd580f79 <.L.str.27> "[.^$\\\\*+?()\\[\\]{}|]", p2=0x7ff093ffcc00 "", p2@entry=0x0, f=0)
    at /nix/store/zw6w6chqvqsh2c6jfsb4pw9bpgdkmjnh-boost-1.87.0-dev/include/boost/regex/v5/basic_regex.hpp:387
#13 boost::basic_regex<char, boost::regex_traits<char, boost::cpp_regex_traits<char> > >::assign (
    this=0x7ff4bd90cad0 <nix::quoteRegexChars(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&)::specialRegex>, p=0x7ff4bd580f79 <.L.str.27> "[.^$\\\\*+?()\\[\\]{}|]", f=0)

yeah i just...

diff --git a/src/libstore/local-gc.cc b/src/libstore/local-gc.cc
index e3c74f357..32a20c0ea 100644
--- a/src/libstore/local-gc.cc
+++ b/src/libstore/local-gc.cc
@@ -66,3 +66,3 @@ Roots findRuntimeRootsUnchecked(const StoreDirConfig & config)
     auto procDir = AutoCloseDir{opendir("/proc")};
-    if (procDir) {
+    if (procDir && false) {
         struct dirent * ent;

but this doesn't trip?

#ifndef BOOST_HAS_THREADS
#error "what"
#endif

Ok my hypothesis was wrong. Boost's BOOST_HAS_THREADS is never false for us. It seems like a cross-thread ownership issue:

SUMMARY: ThreadSanitizer: heap-use-after-free (/nix/store/cgz3m1ahqxkw9f59b5vfxrdck0nksapi-nix-store-2.35.0pre/lib/libnixstore.so.2.35.0+0x2892d4) in nix::findRuntimeRootsUnchecked[abi:cxx11](nix::StoreDirConfig const&)
==================
==================
WARNING: ThreadSanitizer: heap-use-after-free (pid=765420)
  Read of size 4 at 0x724c00020230 by thread T18:
    #0 nix::findRuntimeRootsUnchecked[abi:cxx11](nix::StoreDirConfig const&) <null> (libnixstore.so.2.35.0+0x289504)
    #1 nix::LocalStore::findRuntimeRoots(boost::unordered::unordered_flat_map<nix::StorePath, boost::unordered::unordered_flat_set<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nix::StringViewHash, std::equal_to<void>, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >, std::hash<nix::StorePath>, std::equal_to<nix::StorePath>, std::allocator<std::pair<nix::StorePath const, boost::unordered::unordered_flat_set<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nix::StringViewHash, std::equal_to<void>, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > > > >&, bool) <null> (libnixstore.so.2.35.0+0x238a15)
    #2 nix::LocalStore::findRootsNoTemp(boost::unordered::unordered_flat_map<nix::StorePath, boost::unordered::unordered_flat_set<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nix::StringViewHash, std::equal_to<void>, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >, std::hash<nix::StorePath>, std::equal_to<nix::StorePath>, std::allocator<std::pair<nix::StorePath const, boost::unordered::unordered_flat_set<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nix::StringViewHash, std::equal_to<void>, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > > > >&, bool) <null> (libnixstore.so.2.35.0+0x23bc45)
    #3 nix::LocalStore::collectGarbage(nix::GCOptions const&, nix::GCResults&) <null> (libnixstore.so.2.35.0+0x24339b)
    #4 nix::LocalStore::autoGC(bool)::{lambda()#2}::operator()() [clone .lto_priv.0] <null> (libnixstore.so.2.35.0+0x242752)
    #5 std::thread::_State_impl<std::thread::_Invoker<std::tuple<nix::LocalStore::autoGC(bool)::{lambda()#2}> > >::_M_run() [clone .lto_priv.0] <null> (libnixstore.so.2.35.0+0x4955ad)
    #6 execute_native_thread_routine <null> (libstdc++.so.6+0xed063)

  Previous write of size 8 at 0x724c00020230 by thread T18:
    #0 operator delete(void*, unsigned long) <null> (libtsan.so.2+0xa4a2b)
    #1 nix::readProcLink(std::filesystem::__cxx11::path const&, boost::unordered::unordered_flat_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, boost::unordered::unordered_flat_set<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nix::StringViewHash, std::equal_to<void>, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >, nix::StringViewHash, std::equal_to<void>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, boost::unordered::unordered_flat_set<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nix::StringViewHash, std::equal_to<void>, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > > > >&) [clone .lto_priv.0] <null> (libnixstore.so.2.35.0+0x282dd7)
    #2 nix::findRuntimeRootsUnchecked[abi:cxx11](nix::StoreDirConfig const&) <null> (libnixstore.so.2.35.0+0x28b066)
    #3 nix::LocalStore::findRuntimeRoots(boost::unordered::unordered_flat_map<nix::StorePath, boost::unordered::unordered_flat_set<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nix::StringViewHash, std::equal_to<void>, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >, std::hash<nix::StorePath>, std::equal_to<nix::StorePath>, std::allocator<std::pair<nix::StorePath const, boost::unordered::unordered_flat_set<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nix::StringViewHash, std::equal_to<void>, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > > > >&, bool) <null> (libnixstore.so.2.35.0+0x238a15)
    #4 nix::LocalStore::findRootsNoTemp(boost::unordered::unordered_flat_map<nix::StorePath, boost::unordered::unordered_flat_set<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nix::StringViewHash, std::equal_to<void>, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >, std::hash<nix::StorePath>, std::equal_to<nix::StorePath>, std::allocator<std::pair<nix::StorePath const, boost::unordered::unordered_flat_set<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nix::StringViewHash, std::equal_to<void>, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > > > >&, bool) <null> (libnixstore.so.2.35.0+0x23bc45)
    #5 nix::LocalStore::collectGarbage(nix::GCOptions const&, nix::GCResults&) <null> (libnixstore.so.2.35.0+0x24339b)
    #6 nix::LocalStore::autoGC(bool)::{lambda()#2}::operator()() [clone .lto_priv.0] <null> (libnixstore.so.2.35.0+0x242752)
    #7 std::thread::_State_impl<std::thread::_Invoker<std::tuple<nix::LocalStore::autoGC(bool)::{lambda()#2}> > >::_M_run() [clone .lto_priv.0] <null> (libnixstore.so.2.35.0+0x4955ad)
    #8 execute_native_thread_routine <null> (libstdc++.so.6+0xed063)