[ci-scan] Test failure: X509Certificate2CollectionRemoveRangeArray under crossgen2 R2R

[github-actions]

Build Information

Build: https://dev.azure.com/dnceng-public/public/_build/results?buildId=1455442
Build error leg or test failing: linux-x64 Release TestReadyToRun_Libraries - System.Security.Cryptography.Tests

Error Details

CollectionTests.X509Certificate2CollectionRemoveRangeArray fails under R2R/crossgen2. The test calls RemoveRange on an X509Certificate2Collection and expects 2 certificates to remain, but finds 0.

Prior KBEs #128993, #128815, and #128538 were filed and closed, but the failure persists.

[FAIL] System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509Certificate2CollectionRemoveRangeArray
Assert.Equal() Failure: Values differ
Expected: 2
Actual:   0
   at System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509Certificate2CollectionRemoveRangeArray() in /_/src/libraries/System.Security.Cryptography/tests/X509Certificates/CollectionTests.cs:line 1037

Affected legs:

• runtime-coreclr crossgen2 (def 124): linux-x64 Release TestReadyToRun_Libraries
• runtime-coreclr crossgen2 (def 124): windows-x64 Release TestReadyToRun_Libraries
• runtime-coreclr crossgen2 (def 124): osx-x64 Release TestReadyToRun_Libraries

First build it occurred:

• Build: https://dev.azure.com/dnceng-public/public/_build/results?buildId=1426059
• Finished: 2026-05-19
• Persistent across the entire scanned window; true origin may predate 2026-05-19.

Related: #128993 (closed), #128815 (closed), #128538 (closed)

Error Message

{
  "ErrorMessage": ["X509Certificate2CollectionRemoveRangeArray", "Assert.Equal() Failure: Values differ", "Expected: 2", "Actual:   0"],
  "ErrorPattern": "",
  "BuildRetry": false,
  "ExcludeConsoleLog": false
}

---

Filed by ci-failure-scan (detection only). ci-failure-fix walks open [ci-scan] KBEs and either opens a small fix PR or comments here to loop in owners — it never disables the test.

Note

🔒 Integrity filter blocked 10 items

The following items were blocked because they don't meet the GitHub integrity level.

• #124417 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #129159 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #48070 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #114222 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #74555 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #85747 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #124206 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #92420 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #111752 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #110173 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

Generated by CI Outer-Loop Failure Scanner · ● 86.7M · ◷

Report

Build	Repository	Test	Pull Request
1465888	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509Certificate2CollectionRemoveRangeArray

Summary

24-Hour Hit Count	7-Day Hit Count	1-Month Count
1	1	1

[vcsjones]

This is a duplicate of all of these "related" issues: "#128993 (closed), #128815 (closed), #128538 (closed)"

#128392 is the canonical issue tracking this problem because it has the most discussion.

Can this workflow be tweaked to consider duplicates first?

I'm not going to close this issue despite being a duplicate because I feel like the workflow is just going to keep creating new ones.

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[kotlarmilos]

Duplicate of #128392, which tracks the same X509Certificate2CollectionRemoveRangeArray failure and is open (area-CodeGen-coreclr, blocking-clean-ci-optional). This was re-filed because #128392 was integrity-filtered and not visible to the scanner. The crossgen2/R2R leg is still failing (last 2026-06-16); consolidating onto #128392.