Johannes, thank you very much. However, bad luck again, I get the following crash. Scouring the logs, this time I have no "rcu notice" or any other error beforehand. But the timing again suggest a strong connection with RSSI update in progress. h63 wpa_supplicant[433]: wlan0: CTRL-EVENT-CONNECTED - Connection to xx:xx:xx:xx:00:91 completed [id=0 id_str=] h63 kernel: brcmfmac: brcmf_cfg80211_get_station RSSI -57 dBm h63 kernel: brcmfmac: brcmf_cfg80211_get_station RSSI -57 dBm h63 wpa_supplicant[433]: wlan0: CTRL-EVENT-SUBNET-STATUS-UPDATE status=0 h63 NetworkManager[429]: <info> [1692169608.6737] device (wlan0): supplicant interface state: associating -> completed h63 NetworkManager[429]: <info> [1692169608.6764] device (p2p-dev-wlan0): supplicant management interface state: associating -> completed h63 kernel: brcmfmac: brcmf_cfg80211_get_station RSSI -57 dBm h63 kernel: brcmfmac: brcmf_rx_event Enter: mmc1:0001:1: rxp=00000000414022d6 h63 kernel: brcmfmac: brcmf_fweh_event_worker event RSSI (56) ifidx 0 bsscfg 0 addr 00:00:00:00:00:00 h63 kernel: brcmfmac: brcmf_fweh_event_worker version 2 flags 0 status 0 reason 0 h63 kernel: brcmutil: event payload, len=12 h63 kernel: 00000000: ff ff ff c6 00 00 00 00 ff ff ff a5 ............ h63 kernel: brcmfmac: brcmf_netdev_start_xmit wlan0: insufficient headroom (0) h63 kernel: Unable to handle kernel paging request at virtual address ffff8061d9850028 h63 kernel: Mem abort info: h63 kernel: ESR = 0x0000000096000004 h63 kernel: EC = 0x25: DABT (current EL), IL = 32 bits h63 kernel: SET = 0, FnV = 0 h63 kernel: EA = 0, S1PTW = 0 h63 kernel: FSC = 0x04: level 0 translation fault h63 kernel: Data abort info: h63 kernel: ISV = 0, ISS = 0x00000004 h63 kernel: CM = 0, WnR = 0 h63 kernel: [ffff8061d9850028] address between user and kernel address ranges h63 kernel: Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP h63 kernel: Modules linked in: rtc_pcf85063 regmap_i2c ov9281 v3d brcmfmac vc4 gpu_sched raspberrypi_hwmon drm_shmem_helper binfmt_misc brcmutil gpio_keys snd_soc_hdmi_codec i2c_mux_pinctrl> h63 kernel: CPU: 3 PID: 493 Comm: Xorg Tainted: G C 6.1.45-v8-gdc69f9d60872 #3 h63 kernel: Hardware name: Raspberry Pi Compute Module 4 Rev 1.0 (DT) h63 kernel: pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) h63 kernel: pc : dma_resv_add_fence+0x80/0x260 h63 kernel: lr : v3d_attach_fences_and_unlock_reservation+0x6c/0x1c0 [v3d] h63 kernel: sp : ffffffc0093abb00 h63 kernel: x29: ffffffc0093abb00 x28: 0000000000000048 x27: ffffffc0093abd38 h63 kernel: x26: 0000000000000001 x25: ffffff80481e8e00 x24: ffffffc0093abc08 h63 kernel: x23: 0000000000000001 x22: ffffff805701ac40 x21: ffffffc0093abc20 h63 kernel: x20: ffffff804b995200 x19: ffff8061d9850000 x18: 0000000000000000 h63 kernel: x17: 0000000000000000 x16: ffffffdcdd1b9ba0 x15: 00000055b7e860c0 h63 kernel: x14: 0000000000000000 x13: 0000000000000202 x12: 0000000000000202 h63 kernel: x11: 0000000000000202 x10: 0000000000001a90 x9 : ffffffdc7c7bdecc h63 kernel: x8 : 0000000000000228 x7 : ffffff804416caa8 x6 : 0000000000000000 h63 kernel: x5 : ffffff805701ac40 x4 : ffffff805701ac78 x3 : 0000000000000000 h63 kernel: x2 : ffffffdc7c685478 x1 : ffffffdcdd680ce8 x0 : ffffffdcdd680d30 h63 kernel: Call trace: h63 kernel: dma_resv_add_fence+0x80/0x260 h63 kernel: v3d_attach_fences_and_unlock_reservation+0x6c/0x1c0 [v3d] h63 kernel: v3d_submit_cl_ioctl+0x540/0x70c [v3d] h63 kernel: drm_ioctl_kernel+0xcc/0x180 [drm] h63 kernel: drm_ioctl+0x210/0x440 [drm] h63 kernel: __arm64_sys_ioctl+0xb0/0xf4 h63 kernel: invoke_syscall+0x50/0x120 h63 kernel: el0_svc_common.constprop.0+0x68/0x124 h63 kernel: do_el0_svc+0x34/0xd0 h63 kernel: el0_svc+0x30/0x94 h63 kernel: el0t_64_sync_handler+0xb8/0xbc h63 kernel: el0t_64_sync+0x18c/0x190 h63 kernel: Code: fa401044 54000061 d4210000 d503201f (f9401678) h63 kernel: ---[ end trace 0000000000000000 ]---
