I believe there is some issue with the trampoline that's generated for AudioUnitRender or something. MobileSubstrate had an issue like this a while back, except it was for AudioUnitUninitialize. I messaged saurik about it and he provided me with a debugging tool that outputted a bunch of hex (presumably the calling convention for AudioUnitUninitialize and the trampoline substrate generated?), was wondering if there was something similar for substitute.
More about the issue itself: this only happens for a few of my users, but hooking the C function AudioUnitRender in mediaserverd causes some kind of undefined behavior. Most of the users who have reported this are getting some sort of infinite loop. Unfortunately this only happens for a select few people. I can't reproduce this on my test device but I'm working closely with a few people who can.
One user provided me with this crash log: https://pastebin.com/raw/rK0ZXEHv If you notice, it set the pointer for AudioUnitRender to NULL (the function MESubmixGraph::render is calling).