Emulator

Confirmed. Here's some more details from visual studio:

Unhandled exception thrown: read access violation.
this->m_bytes._Mypair._Myval2._Myfirst was nullptr.

>	Dolphin.exe!IOS::ES::TicketReader::IsV1Ticket() Line 386	C++
 	Dolphin.exe!IOS::HLE::ESDevice::DeleteTicket(const unsigned char * ticket_view) Line 587	C++
 	Dolphin.exe!IOS::HLE::ESDevice::DeleteTicket(const IOS::HLE::IOCtlVRequest & request) Line 623	C++
 	Dolphin.exe!IOS::HLE::ESDevice::IOCtlV(const IOS::HLE::IOCtlVRequest & request) Line 647	C++
 	Dolphin.exe!IOS::HLE::Kernel::HandleIPCCommand(const IOS::HLE::Request & request) Line 717	C++
 	[Inline Frame] Dolphin.exe!IOS::HLE::Kernel::ExecuteIPCCommand(unsigned int) Line 739	C++
 	Dolphin.exe!IOS::HLE::Kernel::UpdateIPC() Line 800	C++
 	[Inline Frame] Dolphin.exe!CoreTiming::CoreTimingManager::Advance() Line 326	C++
 	Dolphin.exe!CoreTiming::GlobalAdvance() Line 518	C++
 	00000261cb208087()	Unknown
 	0000026044200000()	Unknown
 	0000026044200000()	Unknown
 	Dolphin.exe!00007ff7c6b18040()	C++
 	0000000000009032()	Unknown
 	0000000000000048()	Unknown
 	ffffffffffffffff()	Unknown
 	0000025e2cc90000()	Unknown

this->m_bytes is a vector of length 0. IsV1Ticket() calls GetVersion() which uses m_bytes[offsetof(Ticket, version)] (which will always be out of bounds for a zero-length vector).

Here's the relevant code:

ReturnCode ESDevice::DeleteTicket(const u8* ticket_view)
{
  // ...
  ticket.DeleteTicket(ticket_id);

  const std::vector<u8>& new_ticket = ticket.GetBytes();
  const std::string ticket_path = ticket.IsV1Ticket() ? Common::GetV1TicketFileName(title_id) :
                                                        Common::GetTicketFileName(title_id);

  if (!new_ticket.empty())
  {
    const auto file = fs->OpenFile(PID_KERNEL, PID_KERNEL, ticket_path, FS::Mode::ReadWrite);
    if (!file || !file->Write(new_ticket.data(), new_ticket.size()))
      return ES_EIO;
  }
  else
  {
    // Delete the ticket file if it is now empty.
    fs->Delete(PID_KERNEL, PID_KERNEL, ticket_path);
  }
  // ...
}

This seems to have regressed in https://github.com/dolphin-emu/dolphin/commit/2fd9852ca89e4f07f6231ec3ddab5656f2b7856c (5.0-17887), but I haven't actually confirmed this.

Appears to have actually broken in 5.0-18106; 5.0-18104 is fine. But my understanding is that https://github.com/dolphin-emu/dolphin/commit/1f1474f8aca0f706154faa3be9d4127258463b5c only fixed the previous change not actually doing anything.

Should be fixed by https://github.com/dolphin-emu/dolphin/pull/11592