Qt 6.9 added via QRhi::setQueueSubmitParams the possibility to pass additional user-provided semaphores to the vkQueueSubmit and vkQueuePresent functions called by the RHI.

As per the Vulkan specs, VkSubmitInfo::pWaitDstStageMask is a pointer to an array of VkSubmitInfo::waitSemaphoreCount elements.

Unfortunately, this array was not modified for the case where more than one waitSemaphore is passed (happens when additional semaphores are passed via QRhi::setQueueSubmitParams), resulting in an out-of-bounds read by the driver.