[ci-scan] Test failure: X509Certificate2CollectionRemoveRangeArray under crossgen2 R2R (recurrence)

[github-actions]

Build Information

Build: https://dev.azure.com/dnceng-public/public/_build/results?buildId=1467809
Build error leg or test failing: linux-x64 Release TestReadyToRun_Libraries - System.Security.Cryptography.Tests

Error Details

CollectionTests.X509Certificate2CollectionRemoveRangeArray fails under R2R/crossgen2. The test calls RemoveRange on an X509Certificate2Collection and expects 2 certificates to remain, but finds 0.

Prior KBEs #129210, #128993, #128815, and #128538 were filed and closed, but the failure persists.

[FAIL] System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509Certificate2CollectionRemoveRangeArray
Assert.Equal() Failure: Values differ
Expected: 2
Actual:   0
   at System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509Certificate2CollectionRemoveRangeArray()
   in /_/src/libraries/System.Security.Cryptography/tests/X509Certificates/CollectionTests.cs:line 1037

Affected legs:

• runtime-coreclr crossgen2 (def 124): linux-x64 Release TestReadyToRun_Libraries
• runtime-coreclr crossgen2 (def 124): windows-x64 Release TestReadyToRun_Libraries
• runtime-coreclr crossgen2 (def 124): osx-x64 Release TestReadyToRun_Libraries

First build it occurred:

• Persistent across the entire scanned window (15+ consecutive failures); true origin may predate 2026-06-04.
• Confirmed in follow-up: https://dev.azure.com/dnceng-public/public/_build/results?buildId=1470164 (2026-06-18), all 3 legs still failing.

Predecessor: #129210 (closed 2026-06-16 as not_planned; source build finished after closure)
Related: #128993, #128815, #128538

Error Message

{
  "ErrorMessage": ["X509Certificate2CollectionRemoveRangeArray", "Assert.Equal() Failure: Values differ", "Expected: 2", "Actual:   0"],
  "ErrorPattern": "",
  "BuildRetry": false,
  "ExcludeConsoleLog": false
}

---

Filed by ci-failure-scan (detection only). ci-failure-fix walks open [ci-scan] KBEs and either opens a small fix PR or comments here to loop in owners — it never disables the test.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• dotnet.github.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "dotnet.github.io"

See Network Configuration for more information.

Note

🔒 Integrity filter blocked 1 item

The following item was blocked because it doesn't meet the GitHub integrity level.

• #101522 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

Generated by CI Outer-Loop Failure Scanner · ● 50.8M · ◷

Report

Summary

24-Hour Hit Count	7-Day Hit Count	1-Month Count
0	0	0

[dotnet-policy-service]

Tagging subscribers to this area: @bartonjs, @vcsjones, @dotnet/area-system-security
See info in area-owners.md if you want to be subscribed.