diff --git a/AGENTS.md b/AGENTS.md
index 866b48404..c69f02df4 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -437,6 +437,19 @@ table: see [doc/build/JdkUpgrades.md](doc/build/JdkUpgrades.md).
 - All code needs to strive to be lean in terms of resources consumption and easy to follow -
     do not shy away from factoring out self containing code to shorter functions with explicit name
 
+## CI / Automation Script Changes
+- Before rewriting or replacing a script invoked from `.gitlab-ci.yml`, `.gitlab/**/*.yml`, or any CI job,
+  run `git log -p -- <script>` (or diff against the version being replaced) and enumerate every behavior
+  branch it has — fallbacks, env-var-driven paths, error exits. Preserve all of them unless explicitly
+  asked to drop one; do not silently narrow behavior while refactoring.
+- Grep the calling `.gitlab-ci.yml` / `.gitlab/**/*.yml` jobs for how the script is invoked (env vars set,
+  exit codes expected) and confirm the rewrite still satisfies every caller, not just the common/local case.
+- When removing an item from a default list or config (an antagonist, a test tag, a feature flag), cite
+  the exact file/line proving it is inert or unused in that context before removing it — never remove
+  based on assumption alone.
+- After changing a CI-invoked script, run a syntax check (e.g. `bash -n <script>`) and trace through each
+  CI job that calls it before considering the change complete.
+
 ### C/C++ Code Style
 - **Indentation**: Match the exact indentation style of the surrounding code in each file. Do not introduce inconsistent indentation — reviewers will flag it.
 - **Minimal complexity**: Do not split inline logic into separate helper functions unless the helpers are reused or the original is genuinely hard to follow. Unnecessary splits add indirection without value.
diff --git a/ddprof-lib/src/main/cpp/counters.h b/ddprof-lib/src/main/cpp/counters.h
index 4ef2d5ae1..41c26eb3c 100644
--- a/ddprof-lib/src/main/cpp/counters.h
+++ b/ddprof-lib/src/main/cpp/counters.h
@@ -74,6 +74,7 @@
   X(UNWINDING_TIME_JVMTI, "unwinding_ticks_jvmti")                             \
   X(CALLTRACE_STORAGE_DROPPED, "calltrace_storage_dropped_traces")             \
   X(LINE_NUMBER_TABLES, "line_number_tables")                                  \
+  X(LINE_NUMBER_TABLE_UNREADABLE, "line_number_table_unreadable")              \
   X(REMOTE_SYMBOLICATION_FRAMES, "remote_symbolication_frames")                \
   X(REMOTE_SYMBOLICATION_LIBS_WITH_BUILD_ID, "remote_symbolication_libs_with_build_id") \
   X(REMOTE_SYMBOLICATION_BUILD_ID_CACHE_HITS, "remote_symbolication_build_id_cache_hits") \
diff --git a/ddprof-lib/src/main/cpp/flightRecorder.cpp b/ddprof-lib/src/main/cpp/flightRecorder.cpp
index c219bf40d..86134652c 100644
--- a/ddprof-lib/src/main/cpp/flightRecorder.cpp
+++ b/ddprof-lib/src/main/cpp/flightRecorder.cpp
@@ -47,6 +47,16 @@
 static const char *const SETTING_RING[] = {NULL, "kernel", "user", "any"};
 static const char *const SETTING_CSTACK[] = {NULL, "no", "fp", "dwarf", "lbr"};
 
+// JVM spec SS4.7.3 caps a method's bytecode (code_length) at 65535 bytes (u2),
+// so a well-formed LineNumberTable can never have more entries than that.
+// Used to sanity-bound line_number_table_size before it drives the byte-count
+// passed to SafeAccess::safeCopy(): if GetLineNumberTable()
+// returns a corrupted pointer for a stale jmethodID (see the TOCTOU race
+// documented in fillJavaMethodInfo below), the paired out-param size is just
+// as likely to be corrupted, and an implausible size should be rejected
+// before it is trusted to compute a byte range.
+static const jint MAX_LINE_NUMBER_TABLE_ENTRIES = 65535;
+
 // Compute a non-negative event duration from TSC timestamps.  Unsigned u64
 // subtraction wraps to a near-2^64 value when end < start, which can happen if
 // the thread migrates cores between the two TSC reads and the per-core counters
@@ -360,18 +370,50 @@ void Lookup::fillJavaMethodInfo(MethodInfo *mi, jmethodID method,
       // the JVMTI-allocated memory immediately. This keeps _ptr valid even
       // after the underlying class is unloaded.
       void *owned_table = nullptr;
-      if (line_number_table_size > 0) {
+      if (line_number_table_size > 0 &&
+          line_number_table_size <= MAX_LINE_NUMBER_TABLE_ENTRIES) {
         size_t bytes = (size_t)line_number_table_size * sizeof(jvmtiLineNumberEntry);
+        // GetLineNumberTable() is called on the same possibly-stale jmethodID
+        // that GetMethodDeclaringClass/GetClassSignature/GetMethodName above
+        // were probed for -- the TOCTOU race documented above (class
+        // unloaded between sample capture and dump) applies here just as
+        // much as to those calls, and crash telemetry already showed those
+        // sibling calls returning JVMTI_ERROR_NONE with unmapped string
+        // pointers despite the spec saying the returned array should be a
+        // fresh, caller-owned allocation. A genuinely-valid returned table is
+        // fully decoupled from jmethodID lifetime per the JVMTI spec and
+        // can't be invalidated later by class unload; the actual risk is a
+        // corrupted pointer that happens to alias other live memory at
+        // check-time and stops being mapped moments later. A separate
+        // isReadableRange() probe followed by a plain memcpy() would still
+        // race that window, so copy via safeCopy() instead: it fault-protects
+        // each read as it happens rather than trusting a point-in-time check
+        // before an unprotected copy.
         owned_table = malloc(bytes);
         if (owned_table != nullptr) {
-          memcpy(owned_table, line_number_table, bytes);
+          if (!SafeAccess::safeCopy(owned_table, line_number_table, bytes)) {
+            free(owned_table);
+            owned_table = nullptr;
+            line_number_table = nullptr; // make sure the invalid address is not used for jvmti->Deallocate
+            Counters::increment(LINE_NUMBER_TABLE_UNREADABLE);
+          }
         } else {
           TEST_LOG("Failed to allocate %zu bytes for line number table copy", bytes);
         }
+      } else if (line_number_table_size != 0) {
+        // A corrupted size out-param alongside a corrupted pointer is exactly
+        // as plausible as the corrupted-pointer case above (both come from
+        // the same GetLineNumberTable() call on the same stale jmethodID);
+        // an implausible entry count -- including a negative one, since this
+        // is a signed jint and a corrupted value can fall on either side of
+        // zero -- means the pointer can't be trusted for Deallocate() either,
+        // so treat it the same as the unreadable case.
+        line_number_table = nullptr;
+        Counters::increment(LINE_NUMBER_TABLE_UNREADABLE);
       }
-      jvmtiError dealloc_err = jvmti->Deallocate((unsigned char *)line_number_table);
-      if (dealloc_err != JVMTI_ERROR_NONE) {
-        TEST_LOG("Unexpected error while deallocating linenumber table: %d", dealloc_err);
+      if (line_number_table != nullptr) {
+        jvmtiError dealloc_err = jvmti->Deallocate((unsigned char *)line_number_table);
+        assert(dealloc_err == JVMTI_ERROR_NONE && "Unexpected error while deallocating linenumber table");
       }
       if (owned_table != nullptr) {
         mi->_line_number_table = std::make_shared<SharedLineNumberTable>(
diff --git a/ddprof-lib/src/test/cpp/lineNumberTableCopy_ut.cpp b/ddprof-lib/src/test/cpp/lineNumberTableCopy_ut.cpp
new file mode 100644
index 000000000..33e59535a
--- /dev/null
+++ b/ddprof-lib/src/test/cpp/lineNumberTableCopy_ut.cpp
@@ -0,0 +1,206 @@
+/*
+ * Copyright 2026, Datadog, Inc.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+// Reproduces a crash reported in production:
+//
+//   __memcpy_evex_unaligned_erms
+//   Lookup::resolveMethod(_asgct_callframe&)
+//   ...
+//   Recording::writeStackTraces(Buffer*, Lookup*)
+//   ...
+//   Profiler::dump / FlightRecorder::dump
+//
+// Lookup::fillJavaMethodInfo() (inlined into resolveMethod() under -O2/-O3)
+// calls jvmtiEnv::GetLineNumberTable(method, ...) and then copied the
+// result with an unguarded:
+//
+//   memcpy(owned_table, line_number_table, bytes);
+//
+// (flightRecorder.cpp now guards this copy with SafeAccess::safeCopy() -- see
+// below -- so the line numbers of the unguarded version are no longer present
+// in the file; this file's tests reproduce that removed pattern. An earlier
+// version of the fix used a separate SafeAccess::isReadableRange() probe
+// followed by a plain memcpy(), but that still left a check-then-use race:
+// nothing stops the probed memory from becoming invalid in the gap between
+// the probe and the copy. safeCopy() closes that gap by fault-protecting
+// each read as it happens instead of trusting a point-in-time check.)
+//
+// Unlike the class_name/method_name/method_sig strings returned by the
+// preceding JVMTI calls (which ARE probed with SafeAccess::isReadableRange
+// before use, see PR #537 / commit ef13aa29f), the line_number_table pointer
+// is used directly.
+//
+// Per the JVMTI spec, GetLineNumberTable() hands back a freshly-allocated,
+// caller-owned array (hence the Deallocate() call after the copy) that is
+// decoupled from the Method's lifetime -- a spec-compliant implementation
+// cannot invalidate it out from under the caller. The actual risk, per the
+// comments already in fillJavaMethodInfo, is the TOCTOU race documented
+// right there: "GetMethodDeclaringClass may return a jclass wrapping a
+// stale/garbage oop when the class was unloaded between sample capture and
+// dump" -- a race against class unloading, not tied to any one JVM vendor.
+// That same comment block notes crash telemetry showed GetClassSignature/
+// GetMethodName returning JVMTI_ERROR_NONE with unmapped string pointers
+// despite the spec saying they should be valid (a separate OpenJ9-specific
+// jmethodID-corruption mode is also handled a few lines above, but is not
+// the only source of this). The production crash motivating this file was
+// on a stock HotSpot JDK 11, confirming the race is not OpenJ9-specific.
+// GetLineNumberTable() is called on the exact same jmethodID as
+// GetMethodDeclaringClass/GetClassSignature/GetMethodName, with nothing
+// about it that would exempt it from that same observed failure mode.
+//
+// These tests isolate the copy step from JVMTI/JNI (which fillJavaMethodInfo
+// requires and which is impractical to fake in a plain gtest) by exercising
+// the exact copy pattern against a pointer whose backing memory is gone --
+// standing in for "GetLineNumberTable() returned a bad pointer" regardless
+// of the precise reason. The result at the memcpy call site is identical
+// either way, so this is sufficient to prove both the crash and the fix.
+
+#include <gtest/gtest.h>
+#include <cstring>
+#include <signal.h>
+#include <sys/mman.h>
+#include <unistd.h>
+
+#include "flightRecorder.h"
+#include "os.h"
+#include "safeAccess.h"
+
+namespace {
+
+// SafeAccess::isReadableRange()/isReadable() rely on SIGSEGV/SIGBUS handlers
+// registered via OS::replaceSigsegvHandler()/replaceSigbusHandler() to catch
+// the fault at a known trampoline address and turn it into a safe return
+// value (see safefetch_ut.cpp for the same pattern). The safefetch trampoline
+// can fault with either signal depending on platform, so both must be
+// installed; otherwise a fault delivered as the other signal is an ordinary
+// unhandled fault.
+void (*orig_segvHandler)(int signo, siginfo_t *siginfo, void *ucontext);
+void (*orig_busHandler)(int signo, siginfo_t *siginfo, void *ucontext);
+
+void lineNumberTableSegvHandler(int signo, siginfo_t *siginfo, void *context) {
+  if (!SafeAccess::handle_safefetch(signo, context)) {
+    if (signo == SIGBUS) {
+      if (orig_busHandler != nullptr) {
+        orig_busHandler(signo, siginfo, context);
+      }
+    } else if (orig_segvHandler != nullptr) {
+      orig_segvHandler(signo, siginfo, context);
+    }
+  }
+}
+
+class LineNumberTableCopyTest : public ::testing::Test {
+protected:
+  void SetUp() override {
+    orig_segvHandler = OS::replaceSigsegvHandler(lineNumberTableSegvHandler);
+    orig_busHandler = OS::replaceSigbusHandler(lineNumberTableSegvHandler);
+  }
+
+  void TearDown() override {
+    OS::replaceSigsegvHandler(orig_segvHandler);
+    OS::replaceSigbusHandler(orig_busHandler);
+  }
+};
+
+// Allocates a page-sized region seeded with `count` jvmtiLineNumberEntry
+// records, standing in for a buffer jvmtiEnv::GetLineNumberTable() would
+// have returned.
+jvmtiLineNumberEntry *makeFakeLineNumberTable(void *page, int count) {
+  jvmtiLineNumberEntry *table = (jvmtiLineNumberEntry *)page;
+  for (int i = 0; i < count; i++) {
+    table[i].start_location = i * 4;
+    table[i].line_number = i + 1;
+  }
+  return table;
+}
+
+} // namespace
+
+// Reproducer: the code shape that used to be in flightRecorder.cpp's
+// fillJavaMethodInfo() before the fix, with no readability guard before the
+// memcpy. Demonstrates that once the source page is gone, the copy step used
+// by resolveMethod() crashes the process rather than failing gracefully.
+TEST(LineNumberTableCopyRawTest, UnguardedCopyCrashesWhenSourceUnmapped) {
+  EXPECT_DEATH(
+      {
+        long page_size = sysconf(_SC_PAGESIZE);
+        void *page = mmap(NULL, page_size, PROT_READ | PROT_WRITE,
+                          MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+        if (page == MAP_FAILED) {
+          _exit(1); // treat as death via non-zero exit if mmap itself fails
+        }
+        jint line_number_table_size = 4;
+        jvmtiLineNumberEntry *line_number_table =
+            makeFakeLineNumberTable(page, line_number_table_size);
+
+        // Stand-in for GetLineNumberTable() handing back a bad pointer for a
+        // corrupted/stale jmethodID: the backing memory is simply gone by
+        // the time the copy runs.
+        munmap(page, page_size);
+
+        // This mirrors the pre-fix fillJavaMethodInfo() shape verbatim: no
+        // readability check on line_number_table before the copy.
+        size_t bytes =
+            (size_t)line_number_table_size * sizeof(jvmtiLineNumberEntry);
+        void *owned_table = malloc(bytes);
+        memcpy(owned_table, line_number_table, bytes); // <-- crashes here
+        // Force the copied bytes to be observed before free(); otherwise an
+        // optimizing (Release) build can prove owned_table's contents are
+        // never read and eliminate the memcpy as dead code, silently
+        // skipping the very fault this test exists to demonstrate.
+        volatile unsigned char sink = *(volatile unsigned char *)owned_table;
+        (void)sink;
+        free(owned_table);
+      },
+      "");
+}
+
+// Documents the fix: copying via SafeAccess::safeCopy() (which fault-protects
+// each read as it happens, rather than a point-in-time isReadableRange()
+// probe followed by a separate, unprotected memcpy()) turns the crash into a
+// clean, detectable failure with no memory touched past the fault.
+TEST_F(LineNumberTableCopyTest, GuardedCopySkipsSafelyWhenSourceUnmapped) {
+  long page_size = sysconf(_SC_PAGESIZE);
+  void *page = mmap(NULL, page_size, PROT_READ | PROT_WRITE,
+                    MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+  ASSERT_NE(page, MAP_FAILED);
+
+  jint line_number_table_size = 4;
+  jvmtiLineNumberEntry *line_number_table =
+      makeFakeLineNumberTable(page, line_number_table_size);
+
+  ASSERT_EQ(0, munmap(page, page_size));
+
+  size_t bytes = (size_t)line_number_table_size * sizeof(jvmtiLineNumberEntry);
+  void *owned_table = malloc(bytes);
+  ASSERT_NE(owned_table, nullptr);
+  if (!SafeAccess::safeCopy(owned_table, line_number_table, bytes)) {
+    free(owned_table);
+    owned_table = nullptr;
+  }
+
+  EXPECT_EQ(nullptr, owned_table);
+}
+
+// Sanity check: the guard must not reject a genuinely valid table, or every
+// real dump would silently lose line-number info.
+TEST_F(LineNumberTableCopyTest, GuardedCopyStillWorksForValidSource) {
+  jint line_number_table_size = 8;
+  jvmtiLineNumberEntry stack_table[8];
+  jvmtiLineNumberEntry *line_number_table =
+      makeFakeLineNumberTable(stack_table, line_number_table_size);
+
+  size_t bytes = (size_t)line_number_table_size * sizeof(jvmtiLineNumberEntry);
+  void *owned_table = malloc(bytes);
+  ASSERT_NE(owned_table, nullptr);
+  if (!SafeAccess::safeCopy(owned_table, line_number_table, bytes)) {
+    free(owned_table);
+    owned_table = nullptr;
+  }
+
+  ASSERT_NE(nullptr, owned_table);
+  EXPECT_EQ(0, memcmp(owned_table, line_number_table, bytes));
+  free(owned_table);
+}
diff --git a/ddprof-test/src/test/java/com/datadoghq/profiler/memleak/JMethodIDInvalidationStressTest.java b/ddprof-test/src/test/java/com/datadoghq/profiler/memleak/JMethodIDInvalidationStressTest.java
new file mode 100644
index 000000000..40f28a7f6
--- /dev/null
+++ b/ddprof-test/src/test/java/com/datadoghq/profiler/memleak/JMethodIDInvalidationStressTest.java
@@ -0,0 +1,315 @@
+/*
+ * Copyright 2026, Datadog, Inc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.datadoghq.profiler.memleak;
+
+import org.junit.jupiter.api.Assumptions;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
+import org.objectweb.asm.ClassWriter;
+import org.objectweb.asm.Label;
+import org.objectweb.asm.MethodVisitor;
+import org.objectweb.asm.Opcodes;
+
+import java.io.IOException;
+import java.lang.reflect.Method;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.concurrent.atomic.AtomicLong;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * Exploratory stress test for jmethodID invalidation, motivated by PROF-15385 (SIGSEGV in
+ * {@code Lookup::fillJavaMethodInfo} copying a JVMTI line-number table for a stale jmethodID,
+ * fixed by guarding that copy with {@code SafeAccess::isReadableRange}).
+ *
+ * <p>That fix addressed one call site. This test does not target a specific call site; it tries
+ * to manufacture the same underlying condition — jmethodIDs whose declaring class is unloaded
+ * while the profiler is actively resolving/dumping — at high enough concurrency and volume that
+ * any *other*, currently-unguarded, use of a stale jmethodID has a chance to surface on its own.
+ *
+ * <p><b>Approach:</b>
+ * <ul>
+ *   <li>Several driver threads continuously define throwaway classes in fresh, disposable
+ *       {@link ClassLoader}s, invoke their methods a few times (so the jmethodIDs are actually
+ *       captured by the profiler), then drop every reference.</li>
+ *   <li>A dedicated thread calls {@code System.gc()} on a tight loop for the duration of the
+ *       test, to encourage the JVM to actually unload those discarded classes/loaders while the
+ *       other threads are still running — rather than letting them merely accumulate.</li>
+ *   <li>The main thread calls {@code profiler.dump()} repeatedly throughout, so
+ *       {@code writeStackTraces}/{@code Lookup::resolveMethod}/{@code cleanupUnreferencedMethods}
+ *       run concurrently with class unloading, not just class-loading.</li>
+ *   <li>Both the {@code cpu} and {@code alloc} engines are active, since each has its own path
+ *       into {@code Lookup} and its own timing relative to unload.</li>
+ * </ul>
+ *
+ * <p><b>Pass/fail signal:</b> a SIGSEGV/SIGABRT kills the whole JVM, so JUnit would never get to
+ * report a failure directly -- reaching {@code profiler.stop()} at all is one necessary signal.
+ * But that alone would pass vacuously if the churn never actually raced class unload against
+ * {@code Lookup::resolveMethod}/{@code fillJavaMethodInfo}. To rule that out, this test reads the
+ * native whitebox counters ({@code JavaProfiler#getDebugCounters()}) for {@code
+ * jmethodid_skipped_count} and {@code line_number_table_unreadable} -- both are incremented in
+ * {@code fillJavaMethodInfo} exactly when {@code SafeAccess::isReadableRange} rejects a stale
+ * jmethodID's class/method metadata or line-number table (see flightRecorder.cpp) -- and checks
+ * that at least one of them increased during the churn window. Whether the race is actually hit
+ * within the window is JVM/host-discretionary, so that check is a JUnit assumption rather than an
+ * assertion: if neither counter moved, the test is reported as skipped (not failed), since a
+ * healthy host that simply didn't race tightly enough this run is not evidence of a regression. A
+ * pass therefore means both "no crash" and "a stale jmethodID was actually observed and safely
+ * guarded"; a skip means only the former was exercised. We cannot run this under ASan
+ * here, since the profiler under test must run as a live JVMTI agent inside the same JVM process
+ * the test is driving, not as a standalone ASan-instrumented binary the way the gtest-level native
+ * unit tests can.
+ *
+ * <p><b>Limitations:</b> class unloading is JVM-discretionary and best-effort here — this test
+ * does not wait for or verify that any particular class actually unloads (unlike
+ * {@code CleanupAfterClassUnloadTest}/{@code WriteStackTracesAfterClassUnloadTest}, which target
+ * one specific, already-diagnosed race and gate on a confirmed unload). It relies on volume and
+ * concurrency to make unload-during-use likely across many call sites at once, but a clean run
+ * is evidence of nothing more than "no crash was hit this time" for whatever code paths happened
+ * to be exercised.
+ */
+public class JMethodIDInvalidationStressTest extends AbstractDynamicClassTest {
+
+  private static final int CHURN_THREADS = 4;
+  private static final long DURATION_MILLIS = 5_000;
+  private static final AtomicLong CLASS_COUNTER = new AtomicLong();
+  private static final AtomicLong CHURN_ITERATIONS = new AtomicLong();
+
+  @Override
+  protected String getProfilerCommand() {
+    return "cpu=1ms,alloc=512k";
+  }
+
+  @Test
+  @Timeout(60)
+  public void testProfilerSurvivesConcurrentClassUnloadDuringDump() throws Exception {
+    stopProfiler();
+
+    Path baseFile = tempFile("jmethodid-churn-base");
+    Path dumpFile = tempFile("jmethodid-churn-dump");
+
+    AtomicBoolean running = new AtomicBoolean(true);
+    List<Thread> churnThreads = new ArrayList<>();
+    Thread gcThread = null;
+
+    try {
+      profiler.execute(
+          "start," + getProfilerCommand() + ",jfr,mcleanup=true,file=" + baseFile.toAbsolutePath());
+      Thread.sleep(200); // let the profiler stabilize
+
+      Map<String, Long> before = profiler.getDebugCounters();
+
+      for (int i = 0; i < CHURN_THREADS; i++) {
+        Thread t = new Thread(() -> churnLoop(running), "jmethodid-churn-" + i);
+        t.setDaemon(true);
+        churnThreads.add(t);
+        t.start();
+      }
+
+      gcThread = new Thread(() -> {
+        while (running.get()) {
+          System.gc();
+          try {
+            Thread.sleep(20);
+          } catch (InterruptedException e) {
+            Thread.currentThread().interrupt();
+            return;
+          }
+        }
+      }, "jmethodid-churn-gc");
+      gcThread.setDaemon(true);
+      gcThread.start();
+
+      // Drive dumps from the main thread for the whole churn window so
+      // writeStackTraces/resolveMethod/cleanupUnreferencedMethods run concurrently
+      // with class unloading, not just after it.
+      long deadline = System.currentTimeMillis() + DURATION_MILLIS;
+      int dumps = 0;
+      while (System.currentTimeMillis() < deadline) {
+        profiler.dump(dumpFile);
+        dumps++;
+        Thread.sleep(50);
+      }
+
+      running.set(false);
+      for (Thread t : churnThreads) {
+        t.join(5_000);
+      }
+      gcThread.join(5_000);
+
+      // Reaching this line means the profiler survived the whole churn window.
+      Map<String, Long> after = profiler.getDebugCounters();
+      profiler.stop();
+
+      assertTrue(Files.size(dumpFile) > 0,
+          "Profiler produced no output after " + dumps + " dumps under jmethodID churn");
+
+      long churnIterations = CHURN_ITERATIONS.get();
+      assertTrue(churnIterations > 0,
+          "Churn threads never completed a single load/invoke/discard iteration -- the "
+              + "counter-delta assertion below would be meaningless without this, since it "
+              + "can't tell 'no stale jmethodID was hit' apart from 'churn never ran at all' "
+              + "(e.g. a regression in generateChurnClassBytecode or IsolatedClassLoader).");
+
+      long skippedDelta = after.getOrDefault("jmethodid_skipped_count", 0L)
+          - before.getOrDefault("jmethodid_skipped_count", 0L);
+      long unreadableLineTableDelta = after.getOrDefault("line_number_table_unreadable", 0L)
+          - before.getOrDefault("line_number_table_unreadable", 0L);
+
+      // Whether the stale-jmethodID race actually gets hit within the churn window is
+      // JVM/host-discretionary (see class javadoc); treat "never observed" as an aborted
+      // run rather than a failure so a healthy host that just didn't race tightly enough
+      // doesn't flake CI.
+      Assumptions.assumeTrue(skippedDelta > 0 || unreadableLineTableDelta > 0,
+          "Churn window completed without the profiler ever encountering a stale/unmapped "
+              + "jmethodID (jmethodid_skipped_count delta=" + skippedDelta
+              + ", line_number_table_unreadable delta=" + unreadableLineTableDelta
+              + ") -- this test is meant to prove the guard actually fires under class-unload "
+              + "churn, not just that the JVM didn't crash; if this keeps getting skipped, the "
+              + "churn isn't racing unload against resolveMethod/fillJavaMethodInfo tightly "
+              + "enough (consider more churn threads or a longer window).");
+    } finally {
+      running.set(false);
+      for (Thread t : churnThreads) {
+        try {
+          t.join(2_000);
+        } catch (InterruptedException ignored) {
+        }
+      }
+      if (gcThread != null) {
+        try {
+          gcThread.join(2_000);
+        } catch (InterruptedException ignored) {
+        }
+      }
+      try {
+        profiler.stop();
+      } catch (Exception ignored) {
+      }
+      try {
+        Files.deleteIfExists(baseFile);
+      } catch (IOException ignored) {
+      }
+      try {
+        Files.deleteIfExists(dumpFile);
+      } catch (IOException ignored) {
+      }
+    }
+  }
+
+  private void churnLoop(AtomicBoolean running) {
+    while (running.get()) {
+      try {
+        String className =
+            "com/datadoghq/profiler/generated/JMethodIDChurn" + CLASS_COUNTER.incrementAndGet();
+        byte[] bytecode = generateChurnClassBytecode(className);
+
+        IsolatedClassLoader loader = new IsolatedClassLoader();
+        Class<?> clazz = loader.defineClass(className.replace('/', '.'), bytecode);
+        Object instance = clazz.getDeclaredConstructor().newInstance();
+        Method compute = clazz.getDeclaredMethod("compute", int.class);
+        Method allocate = clazz.getDeclaredMethod("allocate", int.class);
+
+        for (int i = 0; i < 20; i++) {
+          compute.invoke(instance, i);
+          allocate.invoke(instance, i);
+        }
+        // loader/clazz/instance/compute/allocate go out of scope here with no other
+        // references -- eligible for unload as soon as the GC-pressure thread runs.
+        CHURN_ITERATIONS.incrementAndGet();
+      } catch (Throwable t) {
+        // A reflective/loading failure here is not itself a signal; the failure mode
+        // this test watches for is a JVM crash, not a Java-level exception. But we
+        // still need churn to actually be happening for the counter-delta assertion
+        // below to mean anything -- CHURN_ITERATIONS tracks that separately.
+      }
+    }
+  }
+
+  /**
+   * Generates a class with a {@code compute(int)} method (multi-line-number arithmetic, so
+   * {@code GetLineNumberTable} on it returns more than one entry) and an {@code allocate(int)}
+   * method (array allocation, so the alloc engine's stack capture includes this jmethodID too).
+   */
+  private byte[] generateChurnClassBytecode(String internalName) {
+    ClassWriter cw = new ClassWriter(ClassWriter.COMPUTE_FRAMES | ClassWriter.COMPUTE_MAXS);
+    cw.visit(Opcodes.V1_8, Opcodes.ACC_PUBLIC, internalName, null, "java/lang/Object", null);
+
+    MethodVisitor ctor = cw.visitMethod(Opcodes.ACC_PUBLIC, "<init>", "()V", null, null);
+    ctor.visitCode();
+    ctor.visitVarInsn(Opcodes.ALOAD, 0);
+    ctor.visitMethodInsn(Opcodes.INVOKESPECIAL, "java/lang/Object", "<init>", "()V", false);
+    ctor.visitInsn(Opcodes.RETURN);
+    ctor.visitMaxs(0, 0);
+    ctor.visitEnd();
+
+    // public int compute(int x) {
+    //   int r = x;        // line 10
+    //   r = r*1103515245 + 12345;  // line 11
+    //   return r;         // line 12
+    // }
+    MethodVisitor compute = cw.visitMethod(Opcodes.ACC_PUBLIC, "compute", "(I)I", null, null);
+    compute.visitCode();
+    Label l1 = new Label();
+    compute.visitLabel(l1);
+    compute.visitLineNumber(10, l1);
+    compute.visitVarInsn(Opcodes.ILOAD, 1);
+    compute.visitVarInsn(Opcodes.ISTORE, 2);
+    Label l2 = new Label();
+    compute.visitLabel(l2);
+    compute.visitLineNumber(11, l2);
+    compute.visitVarInsn(Opcodes.ILOAD, 2);
+    compute.visitLdcInsn(1103515245);
+    compute.visitInsn(Opcodes.IMUL);
+    compute.visitLdcInsn(12345);
+    compute.visitInsn(Opcodes.IADD);
+    compute.visitVarInsn(Opcodes.ISTORE, 2);
+    Label l3 = new Label();
+    compute.visitLabel(l3);
+    compute.visitLineNumber(12, l3);
+    compute.visitVarInsn(Opcodes.ILOAD, 2);
+    compute.visitInsn(Opcodes.IRETURN);
+    compute.visitMaxs(0, 0);
+    compute.visitEnd();
+
+    // public int[] allocate(int seed) {
+    //   int[] a = new int[16];
+    //   a[0] = seed;
+    //   return a;
+    // }
+    MethodVisitor allocate = cw.visitMethod(Opcodes.ACC_PUBLIC, "allocate", "(I)[I", null, null);
+    allocate.visitCode();
+    allocate.visitIntInsn(Opcodes.BIPUSH, 16);
+    allocate.visitIntInsn(Opcodes.NEWARRAY, Opcodes.T_INT);
+    allocate.visitVarInsn(Opcodes.ASTORE, 2);
+    allocate.visitVarInsn(Opcodes.ALOAD, 2);
+    allocate.visitInsn(Opcodes.ICONST_0);
+    allocate.visitVarInsn(Opcodes.ILOAD, 1);
+    allocate.visitInsn(Opcodes.IASTORE);
+    allocate.visitVarInsn(Opcodes.ALOAD, 2);
+    allocate.visitInsn(Opcodes.ARETURN);
+    allocate.visitMaxs(0, 0);
+    allocate.visitEnd();
+
+    cw.visitEnd();
+    return cw.toByteArray();
+  }
+}