Start11 2.81 reproducible explorer.exe crash with Dragon NaturallySpeaking 15

Windows Version Number: Windows 11 26H2, build 26300.9818 x64
App Version: Start11 2.81 (Start10_64.dll 2.8.1.0), freshly installed on Nov 1, 2026



Environment
- Windows 11 26H2, build 26300.9818 x64
- Start11 2.81 (Start10_64.dll 2.8.1.0), freshly installed on Nov 1, 2026
- Dragon NaturallySpeaking 15 (in daily use for medical dictation)
- Bitdefender Security (bdhkm64.dll injected into explorer.exe)
- Fast Startup is off

Summary
With Start11 2.81 and Dragon running, explorer.exe crashes repeatedly in oleacc.dll. Each episode leaves two events a few seconds apart: an access violation, then 0xC000041D. Episodes so far: Nov 1 at 09:10–09:12 (a loop of 4 explorer restarts), and Nov 2 at 11:14, 11:20, 12:27 and 12:34. After the first crash in a session, every press of the Start button crashed again. The Application event log goes back to Oct 13. In the 19 days before Start11 was installed, with the same software (Dragon included), there were no explorer.exe crashes at all.

Stack analysis (explorer.exe.26748.dmp, Nov 1; explorer.exe.22840.dmp, Nov 2 – identical)
FAILURE_ID_HASH: {2c1ae615-014d-5387-ab15-052cccf0501d}
FAILURE_BUCKET_ID: INVALID_POINTER_READ_c0000005_oleacc.dll!CListView32::get_accName
1. The faulting thread was created by Start11: thread start Start10_64!SetWB1+0x8f35a -> Start10_64!RepaintTask+0x76229 -> user32!GetMessageW.
2. During GetMessageW, Dragon's global hook (dd10hook_x64) runs dd10axa_x64!AccTrackControlsCallback+0x156.
3. That callback walks the MSAA tree recursively and calls oleacc!AccWrap_Annotate::get_accName -> oleacc!CListView32::get_accName, which reads a NULL pointer.
Dragon's own log at the time of the crash shows AccTrackControlsCallback taking over 1 second per call, then "Wait for injectMutex abandoned" when explorer died.
I believe this is the Dragon + Start11 crash reported in earlier forum threads, which you could not reproduce because there is no Dragon trial.

Tests
- "Launch folder windows in a separate process" enabled: the crashes kept happening in the shell process.
- Start menu style changed from "Windows Pro" to "Windows 11": the crashes continued.
- Start11 Start menu turned OFF, Start11 taskbar kept ON, reboot (Nov 2, around 12:40): no explorer.exe crashes since (the last one in the event log is Nov 2 at 12:34:43; checked on Nov 3 at 09:52), with Dragon in normal daily use. So the Start11 thread involved seems to belong to the Start menu component.

Secondary, isolated crash (explorer.exe.27496.dmp, Nov 1 17:06, Dragon NOT running)
FAILURE_BUCKET_ID: INVALID_POINTER_READ_c0000005_Start10_64.dll!Unknown
- Faulting IP: Start10_64+0x33263 (cmp dword ptr [rcx+38h],0; rcx = ef00040009003c00)
- Call chain: bdhkm64 (Bitdefender) -> user32!SendMessageW -> Start11 window procedure (return offsets +0x143c1, +0x4862f, +0x3e45c) -> crash

Dumps (minidumps, zipped): see the External Link of this post.
More dumps from Nov 2 are available on request, and I can capture full dumps if needed.