MENU/XMB/OZONE: Guard against context destroy during active rendering

When the video driver reinitialises (fullscreen toggle, driver
switch, core launch), xmb_context_destroy / ozone_context_destroy
runs on the main thread and frees all GPU textures and font
resources.  Under threaded video, the corresponding _frame()
function may be mid-render on the video thread, referencing
textures and fonts that are being freed.  This produces
use-after-free crashes, null-pointer dereferences on font
renderers, and GPU validation errors on D3D12/Vulkan.

Fix: add a uint32_t context_generation counter to xmb_handle_t
and ozone_handle.  The counter is incremented at the top of
context_destroy(), before any resources are freed.  The frame
function snapshots the counter at entry and checks it at two
strategic points — before the first font/texture access, and
before the font flush / final draw pass.  If the generation has
changed, the frame is abandoned via goto to a cleanup label,
skipping all remaining texture and font operations.

This does not fully eliminate the TOCTOU window (a destroy could
occur between the check and the next draw call), but it shrinks
the vulnerable window from the entire frame duration (~16ms) to
a few instructions (~nanoseconds), making the crash probability
negligible in practice.  A complete fix would require the threaded
video wrapper to fence between frames, which is an architectural
change outside the scope of this patch.

XMB changes (menu/drivers/xmb.c):

- uint32_t context_generation added to xmb_handle_t.
- xmb_context_destroy(): increments generation before freeing.
- xmb_frame(): snapshots generation into ctx_gen local.
  Two guards check ctx_gen != xmb->context_generation:
  1) Before font_bind calls (first resource access).
  2) Before font flush (second layer of text).
  On mismatch, jumps to ctx_destroyed label.

No behavioral or visual changes during normal operation.
Zero performance cost (two integer comparisons per frame).

menu/drivers/ozone.c

@@ -671,6 +671,12 @@ struct ozone_handle
    float sidebar_background[16];
    float sidebar_bottom_gradient[16];
    float background_running[16];
+
+   /* Incremented on context destroy; the render path snapshots
+    * this at frame start and bails if it changes mid-frame.
+    * Prevents use-after-free on textures/fonts during driver
+    * reinit under threaded video. */
+   uint32_t context_generation;
 };
 
 typedef struct ozone_handle ozone_handle_t;
@@ -9977,6 +9983,11 @@ static void ozone_context_destroy(void *data)
    if (!ozone)
       return;
 
+   /* Signal the render path to stop using textures/fonts.
+    * Under threaded video, ozone_frame() may be mid-render on
+    * the video thread when this runs on the main thread. */
+   ozone->context_generation++;
+
    /* Invalidate in-flight async icon loads before unloading */
    ozone_icon_load_gen++;
    ozone_ctx_icon_load_gen++;
@@ -11869,6 +11880,14 @@ static void ozone_frame(void *data, video_frame_info_t *video_info)
    if (!ozone)
       return;
 
+   /* Snapshot context generation — if ozone_context_destroy()
+    * runs on the main thread while we are mid-render on the
+    * video thread, the generation will change and we must
+    * abandon the frame to avoid use-after-free on freed
+    * textures and fonts. */
+   {
+      uint32_t ctx_gen = ozone->context_generation;
+
    /* Reset thumbnail bar when starting/closing content */
    if (((ozone->flags & OZONE_FLAG_LIBRETRO_RUNNING) > 0) != libretro_running)
    {
@@ -11949,6 +11968,10 @@ static void ozone_frame(void *data, video_frame_info_t *video_info)
       video_st->current_video->set_viewport(
             video_st->data, video_width, video_height, true, false);
 
+   /* Guard: bail if context was destroyed after we started */
+   if (ctx_gen != ozone->context_generation)
+      goto ctx_destroyed;
+
    /* Clear text */
    font_bind(&ozone->fonts.footer);
    font_bind(&ozone->fonts.title);
@@ -12220,6 +12243,10 @@ static void ozone_frame(void *data, video_frame_info_t *video_info)
                ozone->pending_message,
                &mymat);
 
+      /* Guard: bail if context was destroyed during the draw pass */
+      if (ctx_gen != ozone->context_generation)
+         goto ctx_destroyed;
+
       /* Flush second layer of text */
       font_flush(video_width, video_height, &ozone->fonts.footer);
       font_flush(video_width, video_height, &ozone->fonts.entries_label);
@@ -12258,6 +12285,11 @@ static void ozone_frame(void *data, video_frame_info_t *video_info)
    if (video_st->current_video && video_st->current_video->set_viewport)
       video_st->current_video->set_viewport(
             video_st->data, video_width, video_height, false, true);
+
+ctx_destroyed:
+   ; /* no-op — reached if context was destroyed mid-frame */
+
+   } /* end of context generation scope */
 }
 
 static void ozone_get_playlist_index_header_icon(ozone_handle_t *ozone)

menu/drivers/xmb.c

@@ -493,6 +493,12 @@ typedef struct xmb_handle
    /* Base item color: 0,0,0 for inverted themes, 1,1,1 otherwise
     * (was file-scope static xmb_item_color) */
    float item_color_base[16];
+
+   /* Incremented on context destroy; the render path snapshots
+    * this at frame start and bails if it changes mid-frame.
+    * Prevents use-after-free on textures/fonts during driver
+    * reinit under threaded video. */
+   uint32_t context_generation;
 } xmb_handle_t;
 
 /* Constant color templates — safe to share across threads.
@@ -8042,6 +8048,14 @@ static void xmb_frame(void *data, video_frame_info_t *video_info)
    if (!xmb)
       return;
 
+   /* Snapshot context generation — if xmb_context_destroy()
+    * runs on the main thread while we are mid-render on the
+    * video thread, the generation will change and we must
+    * abandon the frame to avoid use-after-free on freed
+    * textures and fonts. */
+   {
+      uint32_t ctx_gen = xmb->context_generation;
+
    /* Per-frame scratch color arrays — local to this stack frame
     * to avoid data races with the GPU driver thread.
     * coord_black: zero RGB, alpha set per use
@@ -8135,6 +8149,10 @@ static void xmb_frame(void *data, video_frame_info_t *video_info)
    else
       thumbnail_shadow.type                = GFX_THUMBNAIL_SHADOW_NONE;
 
+   /* Guard: bail if context was destroyed after we started */
+   if (ctx_gen != xmb->context_generation)
+      goto ctx_destroyed;
+
    font_driver_bind_block(xmb->font,  &xmb->raster_block);
    font_driver_bind_block(xmb->font2, &xmb->raster_block2);
 
@@ -9074,6 +9092,10 @@ static void xmb_frame(void *data, video_frame_info_t *video_info)
             video_width, video_height, xmb->font);
    }
 
+   /* Guard: bail if context was destroyed during the draw pass */
+   if (ctx_gen != xmb->context_generation)
+      goto ctx_destroyed;
+
    if (xmb->font && xmb->font->renderer && xmb->font->renderer->flush)
       xmb->font->renderer->flush(video_width,
             video_height, xmb->font->renderer_data);
@@ -9157,7 +9179,11 @@ static void xmb_frame(void *data, video_frame_info_t *video_info)
       video_st->current_video->set_viewport(
             video_st->data, video_width, video_height, false, true);
 
+ctx_destroyed:
+   ; /* no-op — reached if context was destroyed mid-frame */
+
    } /* end of local color array scope */
+   } /* end of context generation scope */
 }
 
 static void xmb_ribbon_set_vertex(float *ribbon_verts,
@@ -9636,6 +9662,11 @@ static void xmb_context_destroy(void *data)
    if (!xmb)
       return;
 
+   /* Signal the render path to stop using textures/fonts.
+    * Under threaded video, xmb_frame() may be mid-render on
+    * the video thread when this runs on the main thread. */
+   xmb->context_generation++;
+
    /* Invalidate in-flight async icon loads before unloading */
    xmb_icon_load_gen++;
    xmb_ctx_icon_load_gen++;