JD I have found the reason of the crash in mariokrt on MacOSX. there are out of bound accesses in the following routines that you can fix as follows

N64TexturePipeT::MaskCoupled (and possibly N64TexturePipeT::Mask too)
-		INT32 maskbits_s = m_maskbits_table[tile[num].mask_s];
-		INT32 maskbits_t = m_maskbits_table[tile[num].mask_t];
+		INT32 maskbits_s = m_maskbits_table[tile[num].mask_s & 0x0f];
+		INT32 maskbits_t = m_maskbits_table[tile[num].mask_t & 0x0f];

-	return ((this)->*(TexelFetch[index]))(s, t, tbase, tpal, userdata);
+	return ((this)->*(TexelFetch[index & 79]))(s, t, tbase, tpal, userdata);

however the resulting code produces glitches around (e.g. invisible cars in Mario Kart and broken menus in many games)

also I have noticed two things in the Mask/MaskCoupled routines: you define them for "INT32 num" but Cycle() pass them a "UINT32 tilenum" and I would expect in fact such a tilenum to be in the 0-7 range, given that the n64_rdp class has
N64Tile		m_tiles[8];
is there any missing mask?

I hope this report might help you to find the proper solution to have both the crash fixed and the cars visible smile