Reproducible crash in Oculus Integration v31.2 using OVRHaptics

I can confirm that this is still an issue with Oculus Integration v40 and all of the other settings you listed above.  Your theory is correct, GetControllerHapticsDesc() returns invalid values if hand tracking is active when the app is launched.  These invalid values cause m_nativeBuffer to be initialized with a capacity of 0, which leads to a crash in OVRHapticsOutput.Process() when Marshal.Copy() attempts to copy data into the empty buffer.

The crash can be prevented by wrapping each call to Marshal.Copy() with an if statement that checks whether m_nativeBuffer.GetCapacity() is large enough to accept the data being copied.  The side effect is that the haptics simply won't work if you switch from hand tracking to controllers after the app starts.  Making this change yourself also means you will have to manually restore your edits to OVRHaptics.cs every time you update the Oculus Integration scripts, at least until the issue with GetControllerHapticsDesc() is fixed.