Hello, I have a consistent crash that Claude has diagnosed as a brcmfmac error that causes kernel panic. I want to make sure Claude's summary is correct before I try to report it on GitHub. Currently running on the pi: hostapd to act as a hotspot; dnsmasq as dns; iptables as firewall; rootful docker for home assistant; tailscale. more info on setup is here if needed: https://github.com/PAYS0N/home-network. Below is Claude's summary of what the issue is that I want to confirm before moving on. I attempted to set modprobe parameter p2pon=0, but that did nothing as far as i can tell, modinfo showed it as existing, but $ ls -la /sys/module/brcmfmac/parameters/ didnt. The crash has happened twice, both at about 15 days uptime. As far as I know the only reproducibility is "Set up Raspberry Pi 5 with built-in WiFi Configure hostapd in AP mode (standard config, no P2P) Run continuously for 15-20 days".
Problem Summary
Kernel panic in brcmfmac WiFi driver causing complete system hang
Hardware: Raspberry Pi 5 Model B Rev 1.1 (8GB)
Kernel: Linux 6.12.47+rpt-rpi-2712 #1 SMP PREEMPT Debian 1:6.12.47-1+rpt1~bookworm
Driver: brcmfmac (built-in WiFi)
Use case: Running hostapd as WiFi access point
Frequency: Approximately every 15-16 days uptime
Impact: Complete system freeze requiring hard reboot
Crash Details
Error: NULL pointer dereference at virtual address 0x0000000000000000
Crash location:
pc : brcmf_p2p_send_action_frame+0x23c/0xc58 [brcmfmac]
lr : brcmf_p2p_send_action_frame+0x200/0xc58 [brcmfmac]
Call trace:
brcmf_p2p_send_action_frame+0x23c/0xc58 [brcmfmac]
brcmf_cfg80211_mgmt_tx+0x304/0x5c0 [brcmfmac]
cfg80211_mlme_mgmt_tx+0x1b0/0x428 [cfg80211]
nl80211_tx_mgmt+0x238/0x388 [cfg80211]
genl_family_rcv_msg_doit+0xe0/0x158
[... system call path ...]
Triggering process: hostapd (PID varies)
Memory abort info:
ESR = 0x0000000096000005
EC = 0x25: DABT (current EL), IL = 32 bits
FSC = 0x05: level 1 translation fault
System Config:
interface=wlan0
driver=nl80211
ssid=Payson
hw_mode=g
channel=6
country_code=US
ap_isolate=0
ieee80211n=1
ieee80211d=1
ieee80211h=0
wmm_enabled=1
wpa=2
wpa_passphrase=<redacted>
wpa_key_mgmt=WPA-PSK
rsn_pairwise=CCMP
Note: Configuration does NOT enable P2P/WiFi Direct features - running standard AP mode only.
P2P capabilities still advertised:
$ iw list | grep -i p2p
* P2P-client
* P2P-GO
* P2P-device
* start_p2p_device
[... additional P2P capabilities listed ...]
Root Cause Analysis
The driver crashes when attempting to send P2P (WiFi Direct) action frames, even though:
hostapd configuration does not enable P2P mode
User is running standard AP mode only
No P2P functionality is being intentionally used
Hypothesis: External WiFi clients probing for WiFi Direct/P2P capabilities trigger the buggy code path, causing NULL pointer dereference in brcmf_p2p_send_action_frame.
Problem Summary
Kernel panic in brcmfmac WiFi driver causing complete system hang
Hardware: Raspberry Pi 5 Model B Rev 1.1 (8GB)
Kernel: Linux 6.12.47+rpt-rpi-2712 #1 SMP PREEMPT Debian 1:6.12.47-1+rpt1~bookworm
Driver: brcmfmac (built-in WiFi)
Use case: Running hostapd as WiFi access point
Frequency: Approximately every 15-16 days uptime
Impact: Complete system freeze requiring hard reboot
Crash Details
Error: NULL pointer dereference at virtual address 0x0000000000000000
Crash location:
pc : brcmf_p2p_send_action_frame+0x23c/0xc58 [brcmfmac]
lr : brcmf_p2p_send_action_frame+0x200/0xc58 [brcmfmac]
Call trace:
brcmf_p2p_send_action_frame+0x23c/0xc58 [brcmfmac]
brcmf_cfg80211_mgmt_tx+0x304/0x5c0 [brcmfmac]
cfg80211_mlme_mgmt_tx+0x1b0/0x428 [cfg80211]
nl80211_tx_mgmt+0x238/0x388 [cfg80211]
genl_family_rcv_msg_doit+0xe0/0x158
[... system call path ...]
Triggering process: hostapd (PID varies)
Memory abort info:
ESR = 0x0000000096000005
EC = 0x25: DABT (current EL), IL = 32 bits
FSC = 0x05: level 1 translation fault
System Config:
interface=wlan0
driver=nl80211
ssid=Payson
hw_mode=g
channel=6
country_code=US
ap_isolate=0
ieee80211n=1
ieee80211d=1
ieee80211h=0
wmm_enabled=1
wpa=2
wpa_passphrase=<redacted>
wpa_key_mgmt=WPA-PSK
rsn_pairwise=CCMP
Note: Configuration does NOT enable P2P/WiFi Direct features - running standard AP mode only.
P2P capabilities still advertised:
$ iw list | grep -i p2p
* P2P-client
* P2P-GO
* P2P-device
* start_p2p_device
[... additional P2P capabilities listed ...]
Root Cause Analysis
The driver crashes when attempting to send P2P (WiFi Direct) action frames, even though:
hostapd configuration does not enable P2P mode
User is running standard AP mode only
No P2P functionality is being intentionally used
Hypothesis: External WiFi clients probing for WiFi Direct/P2P capabilities trigger the buggy code path, causing NULL pointer dereference in brcmf_p2p_send_action_frame.
Statistics: Posted by pays0n — Tue Feb 03, 2026 5:40 pm — Replies 0 — Views 21