How to reproduce:
1. Open the attached “IN-137513” project
2. In Build Profiles, make sure platform is set to Android
3. In the Menu bar, navigate to ABTools > 1. Build AssetBundle With DisableTypeTree
4. Back in Build Profiles, make sure Development Build is toggled on
5. Build and deploy to a device
6. On the device, tap the button in the middle of the screen
7. Observe the crash

Alternative steps to reproduce:
1. Open the attached “IN-137513” project
2. In Build Profiles, make sure platform is set to Mac
3. In the Menu bar, navigate to ABTools > 1. Build AssetBundle With DisableTypeTree
4. Back in Build Profiles, make sure Development Build is toggled on
5. Build and run the project
6. Click the button in the middle of the Player
7. Observe the crash

Reproducible with: 6000.2.0b1 (d17678da8412), 6000.3.11f1, 6000.4.0f1, 6000.5.0b1, 6000.6.0a1
Not reproducible with: 6000.0.71f1 (crashes when instantiating the object, not loading the bundle), 6000.2.0a10

Reproducible on: macOS 26.3 (M1 Pro)
Not reproducible on: No other environments tested

Reproducible with devices:
VLNQA00325 - Galaxy Note 10 Global (SM-N970F), CPU: Exynos 9 Series 9825, GPU: Mali-G76, OS: 12
VLNQA00663 - Samsung Galaxy S26 Ultra (SM-S948B), CPU: Snapdragon 8 Elite Gen 5 (SM8850), GPU: Adreno 840, OS: 16
VLNQA00472 - Samsung Galaxy A52 (SM-A525F), CPU: Snapdragon 720G (SM7125), GPU: Adreno 618, OS: 12
VLNQA00466 - Google Pixel 4 (Pixel 4), CPU: Snapdragon 855 SM8150, GPU: Adreno 640, OS: 12
VLNQA00375 - Galaxy S21 Plus 5G (SM-G996U), CPU: Snapdragon 888, GPU: Adreno 660, OS: 11
VLNQA00470 - Samsung Galaxy S8 (SM-G950F), CPU: Exynos 9 Octa 8895, GPU: Mali-G71, OS: 8.0.0
VLNQA00531 - OnePlus 11 5G (CPH2449), CPU: Snapdragon 8 Gen 2 (SM8550), GPU: Adreno 740, OS: 13
VLNQA00648 - iPhone Air (MG2P4QN/A), CPU: Apple A19 Pro, OS: 26.0.1

Notes:
- Does not reproduce when running a Release Build
- Does not reproduce when building AssetBundle without “{{DisableWriteTypeTree}}" option

Beginning of stack trace:
CachedReader::OutOfBoundsError(unsigned long, unsigned long)
CachedReader::Read(void*, unsigned long)
void StreamedBinaryRead::TransferSTLStyleArray<core::string_with_label<1, char>>(core::string_with_label<1, char>&, TransferMetaFlags)
void SerializeTraits<ShaderLab::FastPropertyName>::Transfer<StreamedBinaryRead>(ShaderLab::FastPropertyName&, StreamedBinaryRead&)
void VFXLayoutElementDesc::Transfer<StreamedBinaryRead>(StreamedBinaryRead&)