Tvheadend

As you already figured out, ev is pointing to something that doesn't exist. As i seems to be negative you need to figure out why that happened. That can only happen if ev->len was negative before or if there is an overflow. When you can reproduce this reliably you can always just break there, single step and then watch why it gets negative.

I am lost in what messages in the buffer mean and their meaning. This is the output after dvr-inotify tracing was enabled:

2020-05-15 15:20:22.719 [ TRACE]:dvr-inotify: i=0 len=294 name=Říše stříbra-Prima Zoom CZ2020-05-1220-55.ts
2020-05-15 15:20:22.719 [ TRACE]:dvr-inotify: i=66 len=294 from=Říše stříbra-Prima Zoom CZ2020-05-1220-55.ts cookie=15089
2020-05-15 15:20:22.720 [ TRACE]:dvr-inotify: i=66 len=294 name=.íše stříbra-Prima Zoom CZ2020-05-1220-55.ts.removing
2020-05-15 15:20:22.720 [ TRACE]:dvr-inotify: i=141 len=294 to_cookie=15089 from_cookie=15089 cookie_prev=0
2020-05-15 15:20:22.720 [ DEBUG]:dvr: inotify: moved from_fd: 1 path: "/tv/live/Říše stříbra-Prima Zoom CZ2020-05-1220-55.ts" to: ".íše stříbra-Prima Zoom CZ2020-05-1220-55.ts.removing" to_fd: 1
2020-05-15 15:20:22.742 [ TRACE]:dvr-inotify: i=141 len=294 name=Teorie velkého třesku-Prima Cool CZ2020-05-1220-45.ts
2020-05-15 15:20:22.742 [ TRACE]:dvr-inotify: i=213 len=294 from=Teorie velkého třesku-Prima Cool CZ2020-05-1220-45.ts cookie=15088
2020-05-15 15:20:22.742 [ TRACE]:dvr-inotify: i=213 len=294 name=.eorie velkého třesku-Prima Cool CZ2020-05-1220-45.ts.removing
2020-05-15 15:20:22.742 [ TRACE]:dvr-inotify: i=294 len=294 to_cookie=15088 from_cookie=15088 cookie_prev=0
2020-05-15 15:20:22.742 [ DEBUG]:dvr: inotify: moved from_fd: 1 path: "/tv/live/Teorie velkého třesku-Prima Cool CZ2020-05-1220-45.ts" to: ".eorie velkého třesku-Prima Cool CZ2020-05-1220-45.ts.removing" to_fd: 1
2020-05-15 15:20:22.766 [ TRACE]:dvr-inotify: i=0 len=335 name=.eorie velkého třesku-Prima Cool CZ2020-05-1220-45.ts.removing
2020-05-15 15:20:22.766 [ DEBUG]:dvr: inotify: moved from_fd: 1 path: "/tv/live/.eorie velkého třesku-Prima Cool CZ2020-05-1220-45.ts.removing" to: "<none>" to_fd: -1
2020-05-15 15:20:22.794 [ TRACE]:dvr-inotify: i=81 len=335 name=Letní hokej-CT2 CZ2020-05-1221-00.ts
2020-05-15 15:20:22.794 [ DEBUG]:dvr: inotify: moved from_fd: 1 path: "/tv/live/Letní hokej-CT2 CZ2020-05-1221-00.ts" to: "<none>" to_fd: -1
2020-05-15 15:20:22.817 [ TRACE]:dvr-inotify: i=135 len=335 name=Říše stříbra-Prima Zoom CZ2020-05-1220-55-1.ts
2020-05-15 15:20:22.817 [ DEBUG]:dvr: inotify: moved from_fd: 1 path: "/tv/live/Říše stříbra-Prima Zoom CZ2020-05-1220-55-1.ts" to: "<none>" to_fd: -1
2020-05-15 15:20:22.841 [ TRACE]:dvr-inotify: i=203 len=335 name=Letní hokej-CT2 CZ2020-05-1221-00-2.ts
2020-05-15 15:20:22.842 [ TRACE]:dvr-inotify: i=259 len=335 from=Letní hokej-CT2 CZ2020-05-1221-00-2.ts cookie=15119
2020-05-15 15:20:22.842 [ TRACE]:dvr-inotify: i=259 len=335 name=.etní hokej-CT2 CZ2020-05-1221-00-2.ts.removing
2020-05-15 15:20:22.842 [ TRACE]:dvr-inotify: i=324 len=335 to_cookie=15119 from_cookie=15119 cookie_prev=0
2020-05-15 15:20:22.842 [ DEBUG]:dvr: inotify: moved from_fd: 1 path: "/tv/live/Letní hokej-CT2 CZ2020-05-1221-00-2.ts" to: ".etní hokej-CT2 CZ2020-05-1221-00-2.ts.removing" to_fd: 1

Do you see the issue from this or should I continue with debugging, please?

You need to figure out what happened to the inotify_event at 0x7fffdd3e7e60. Either something overwrote it or it was indeed read like this. Maybe the check that would issue a break should also check for negative values, I need to think about that again. It shouldn't become negative in the first place though, that check seems to be a detection for broken values though (as otherwise it would never match).... You can try to see if that helps though, so make it

if (i > len || i < 0)

I have tried to remove 100 files, no crash. The question is whether it is a fix or rather a workaround. :)

Anyway, thank you very much indeed.

It could even be that the len attribute of the event before had an invalid length and then caused parsing of the following event to get invalid data. That would need more investigation to prevent issues in the future, it would be great if you could look into that a little more (check what exactly is *ev right before the iteration that causes the crash).