You are right, I have no clear proof. However, here is a second trace from the same system. Another system has crashed, I have not recovered the trace yet. The context, that there is a RSSI notification just beforehand, is exactly the same (as the initial bug report). You have a clue? Aug 16 11:03:32 h63 wpa_supplicant[389]: wlan0: Associated with xx:xx:xx:xx:00:91 Aug 16 11:03:32 h63 wpa_supplicant[389]: wlan0: CTRL-EVENT-CONNECTED - Connection to xx:xx:xx:xx:00:91 completed [id=0 id_str=] Aug 16 11:03:32 h63 wpa_supplicant[389]: wlan0: CTRL-EVENT-SUBNET-STATUS-UPDATE status=0 Aug 16 11:03:32 h63 NetworkManager[373]: <info> [1692176612.2898] device (wlan0): supplicant interface state: associating -> completed Aug 16 11:03:32 h63 NetworkManager[373]: <info> [1692176612.2933] device (p2p-dev-wlan0): supplicant management interface state: associating -> completed Aug 16 11:03:32 h63 kernel: brcmfmac: brcmf_cfg80211_get_station RSSI -63 dBm Aug 16 11:03:32 h63 kernel: brcmfmac: brcmf_rx_event Enter: mmc1:0001:1: rxp=00000000b1aa24a9 Aug 16 11:03:32 h63 kernel: brcmfmac: brcmf_fweh_event_worker event RSSI (56) ifidx 0 bsscfg 0 addr 00:00:00:ab:c0:c1 Aug 16 11:03:32 h63 kernel: brcmfmac: brcmf_fweh_event_worker version 2 flags 0 status 0 reason 0 Aug 16 11:03:32 h63 kernel: brcmutil: event payload, len=12 Aug 16 11:03:32 h63 kernel: 00000000: ff ff ff c1 00 00 00 00 ff ff ff a5 ............ Aug 16 11:03:35 h63 kernel: brcmfmac: brcmf_cfg80211_get_station RSSI -63 dBm Aug 16 11:03:40 h63 kernel: Unable to handle kernel NULL pointer dereference at virtual address 00000000000000cc Aug 16 11:03:40 h63 kernel: Mem abort info: Aug 16 11:03:41 h63 kernel: ESR = 0x0000000096000005 Aug 16 11:03:41 h63 kernel: EC = 0x25: DABT (current EL), IL = 32 bits Aug 16 11:03:41 h63 kernel: SET = 0, FnV = 0 Aug 16 11:03:41 h63 kernel: EA = 0, S1PTW = 0 Aug 16 11:03:41 h63 kernel: FSC = 0x05: level 1 translation fault Aug 16 11:03:41 h63 kernel: Data abort info: Aug 16 11:03:41 h63 kernel: ISV = 0, ISS = 0x00000005 Aug 16 11:03:41 h63 kernel: CM = 0, WnR = 0 Aug 16 11:03:41 h63 kernel: user pgtable: 4k pages, 39-bit VAs, pgdp=0000000049427000 Aug 16 11:03:41 h63 kernel: [00000000000000cc] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 Aug 16 11:03:41 h63 kernel: Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP Aug 16 11:03:41 h63 kernel: Modules linked in: rtc_pcf85063 ov9281 regmap_i2c brcmfmac vc4 brcmutil cfg80211 snd_soc_hdmi_codec drm_display_helper cec drm_dma_helper drm_kms_helper v3d gpu_sched binfmt_mis> Aug 16 11:03:41 h63 kernel: CPU: 2 PID: 491 Comm: Xorg Tainted: G C 6.1.45-v8-gdc69f9d60872 #3 Aug 16 11:03:41 h63 kernel: Hardware name: Raspberry Pi Compute Module 4 Rev 1.0 (DT) Aug 16 11:03:41 h63 kernel: pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) Aug 16 11:03:41 h63 kernel: pc : drm_ioctl+0x284/0x440 [drm] Aug 16 11:03:41 h63 kernel: lr : drm_ioctl+0xac/0x440 [drm] Aug 16 11:03:41 h63 kernel: sp : ffffffc00935bca0 Aug 16 11:03:41 h63 kernel: x29: ffffffc00935bcb0 x28: ffffff8045499f00 x27: 0000000000000000 Aug 16 11:03:41 h63 kernel: x26: 0000000000000000 x25: ffffff804806a800 x24: 0000000000000041 Aug 16 11:03:41 h63 kernel: x23: ffffff804946d900 x22: 00000000c0106441 x21: 0000007fc2a766f8 Aug 16 11:03:41 h63 kernel: x20: ffffff8040370000 x19: 0000000000000001 x18: 0000000000000000 Aug 16 11:03:41 h63 kernel: x17: 0000000000000000 x16: ffffffe34ff1a2d0 x15: 0000000000000000 Aug 16 11:03:41 h63 kernel: x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 Aug 16 11:03:41 h63 kernel: x11: 0000000000000000 x10: 0000000000000000 x9 : ffffffe315a9eed0 Aug 16 11:03:41 h63 kernel: x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000159ba4 Aug 16 11:03:41 h63 kernel: x5 : 0000000000159ba5 x4 : 0000000000000000 x3 : 0000000000000001 Aug 16 11:03:41 h63 kernel: x2 : ffffff8045499f00 x1 : ffffff9d2eca5000 x0 : 0000000000000004 Aug 16 11:03:41 h63 kernel: Call trace: Aug 16 11:03:41 h63 kernel: drm_ioctl+0x284/0x440 [drm] Aug 16 11:03:41 h63 kernel: __arm64_sys_ioctl+0xb0/0xf4 Aug 16 11:03:41 h63 kernel: invoke_syscall+0x50/0x120 Aug 16 11:03:41 h63 kernel: el0_svc_common.constprop.0+0x68/0x124 Aug 16 11:03:41 h63 kernel: do_el0_svc+0x34/0xd0 Aug 16 11:03:41 h63 kernel: el0_svc+0x30/0x94 Aug 16 11:03:41 h63 kernel: el0t_64_sync_handler+0xb8/0xbc Aug 16 11:03:41 h63 kernel: el0t_64_sync+0x18c/0x190 Aug 16 11:03:41 h63 kernel: Code: 35000455 a94673fb 17ffff7b f9401a80 (b940c800) Aug 16 11:03:41 h63 kernel: ---[ end trace 0000000000000000 ]--- Aug 16 11:03:41 h63 kernel: brcmfmac: brcmf_cfg80211_get_station RSSI -67 dBm Aug 16 11:03:45 h63 kernel: brcmfmac: brcmf_netdev_start_xmit wlan0: insufficient headroom (0) Aug 16 11:03:45 h63 kernel: brcmfmac: brcmf_netdev_start_xmit wlan0: insufficient headroom (0)
