C# VS Code extension 2.160.4 sends unsupported SHA384/SHA512 checksums and remote line breakpoints fail

[cn-asherpakula]

Environment data

dotnet --info output:

.NET SDK: 10.x
Target CLR Version: 10.0.1226.42308
Runtime Environment:
 OS: Ubuntu
 OS Version: 24.04
 Architecture: ARM64

VS Code version: 1.138.0

C# Extension version: 2.160.4

C# Dev Kit version: 3.40.204

Remote vsdbg version: 18.10.10709.3

Host OS: macOS ARM64

C# logs

C# output window contents:

The debugger attaches successfully, but setBreakpoints fails:

-> (C) {
  "command": "setBreakpoints",
  "arguments": {
    "source": {
      "checksums": [
        { "algorithm": "SHA1", "checksum": "[redacted]" },
        { "algorithm": "SHA256", "checksum": "[redacted]" },
        { "algorithm": "SHA384", "checksum": "[redacted]" },
        { "algorithm": "SHA512", "checksum": "[redacted]" },
        { "algorithm": "SHA1", "checksum": "[redacted]" },
        { "algorithm": "SHA256", "checksum": "[redacted]" },
        { "algorithm": "SHA384", "checksum": "[redacted]" },
        { "algorithm": "SHA512", "checksum": "[redacted]" }
      ]
    },
    "lines": [18],
    "breakpoints": [{ "line": 18 }],
    "sourceModified": false
  },
  "type": "request"
}

<- (E) {
  "event": "output",
  "body": {
    "category": "telemetry",
    "output": "VS/Diagnostics/Debugger/vsdbg/CommandFailed",
    "data": {
      "VS.Diagnostics.Debugger.vsdbg.ErrorCode": 3001,
      "VS.Diagnostics.Debugger.vsdbg.Command": "setBreakpoints",
      "VS.Diagnostics.Debugger.vsdbg.TargetCLRVersion": "10.0.1226.42308",
      "VS.Diagnostics.Debugger.vsdbg.AdapterId": "coreclr",
      "VS.Diagnostics.Debugger.vsdbg.Distribution.Version": "24.04",
      "VS.Diagnostics.Debugger.vsdbg.Distribution.Name": "ubuntu",
      "VS.Diagnostics.Debugger.vsdbg.OSFamily": "Linux",
      "VS.Diagnostics.Debugger.vsdbg.Version": "18.10.10709.3"
    }
  }
}

<- (R) {
  "success": false,
  "command": "setBreakpoints",
  "message": "Incorrect breakpoint request format."
}

The adapter's initialize response advertises:

"supportedChecksumAlgorithms": ["MD5", "SHA1", "SHA256"]

Steps to reproduce

1. Install C# extension 2.160.4 and C# Dev Kit 3.40.204.
2. Attach to a .NET process in a Linux ARM64 Docker container using pipeTransport.
3. Set a line breakpoint in loaded application code.
4. Execute the affected code.
5. Observe that the breakpoint remains solid red but never triggers.
6. Enable debugger protocol logging and observe that setBreakpoints fails with Incorrect breakpoint request format.
7. Downgrade only the C# extension to 2.140.9.
8. Repeat the same debugging session and observe that line breakpoints work.

Expected behavior

The debugger should install and trigger line breakpoints.

The C# debugger client should send only checksum algorithms listed in the adapter's supportedChecksumAlgorithms capability. In this case, it should not send SHA384 or SHA512.

If setBreakpoints fails, the breakpoint should be shown as unverified with the adapter error instead of remaining solid red.

Actual behavior

C# extension 2.160.4 sends SHA384 and SHA512 checksums even though the remote adapter advertises support for only MD5, SHA1 and SHA256.

The remote debugger rejects the entire setBreakpoints request, so no line breakpoint is installed.

The breakpoint is still displayed as solid red, hiding the failure.

Exception breakpoints and System.Diagnostics.Debugger.Break() continue to work because they use different debugger requests.

Downgrading only the C# extension from 2.160.4 to 2.140.9 fixes the issue. No application, source, PDB, Docker, SDK, runtime, Dev Kit or remote debugger changes are required.

Additional context

This appears to be a regression in the debugger client bundled with C# extension 2.160.4.

Suggested fix:

• Filter generated checksums against initialize.supportedChecksumAlgorithms before sending setBreakpoints.
• When that capability is absent, send only checksum algorithms supported by the negotiated Debug Adapter Protocol version.
• Reflect a failed setBreakpoints response in the breakpoint's verification state.

The duplicate checksum entries appear to represent the source file's raw CRLF content and the editor-normalized LF content. Older debugger versions accepted duplicate SHA1/SHA256 entries, so the likely regression is the newly included unsupported SHA384/SHA512 algorithms rather than the duplication itself.