SECURE FAULT during FOTA download when using SMP client with Advanced Firmware Update (3 instances)

Hello Nordic Team,

I'm implementing a multi-instance FOTA system using the Advanced Firmware Update object (33629) with 3 instances:
- Instance 0: nRF9160 application (working)
- Instance 1: nRF9160 modem (disabled)
- Instance 2: nRF54L15 via SMP over UART (crashing)

## Hardware Setup
- **Main board:** nRF9160DK (application processor + LwM2M client)
- **Secondary board:** nRF54L15DK (Bluetooth controller + SMP server)
- **Connection:** UART2 (nRF9160) <--> UART20 (nRF54L15) at 115200 baud
- nRF9160 P0.23 (TX) → nRF54L15 P1.05 (RX)
- nRF9160 P0.21 (RX) → nRF54L15 P1.04 (TX)

## Software Configuration

**nRF Connect SDK:** v3.1.1

**nRF9160 (LwM2M Client + SMP Client):**
```c
CONFIG_LWM2M_CLIENT_UTILS_ADV_FIRMWARE_UPDATE_OBJ_SUPPORT=y
CONFIG_LWM2M_CLIENT_UTILS_ADV_FOTA_INSTANCE_COUNT=3
CONFIG_NRF_MCUMGR_SMP_CLIENT=y
CONFIG_DFU_TARGET_SMP=y
CONFIG_MCUMGR_TRANSPORT_UART=y
CONFIG_SMP_CLIENT=y
CONFIG_FOTA_DOWNLOAD=y

CONFIG_MAIN_STACK_SIZE=5120
CONFIG_SYSTEM_WORKQUEUE_STACK_SIZE=3072
CONFIG_DOWNLOADER_STACK_SIZE=2560
CONFIG_HEAP_MEM_POOL_SIZE=24576
```

**nRF54L15 (SMP Server):**
```c
CONFIG_MCUMGR=y
CONFIG_MCUMGR_TRANSPORT_UART=y
CONFIG_MCUMGR_TRANSPORT_UART_MTU=256
CONFIG_BOOTLOADER_MCUBOOT=y
CONFIG_SPI_NOR=y
CONFIG_PM_EXTERNAL_FLASH_MCUBOOT_SECONDARY=y
```

## The Problem

Instance 0 (nRF9160 application FOTA) works perfectly:
- Downloads 348KB firmware via HTTPS 
- MCUboot swap successful 
- Device reboots with new version 

Instance 2 (nRF54L15 via SMP) crashes during download:
- All 3 LwM2M instances created successfully 
- LwM2M registration to Leshan server OK 
- SMP server starts correctly on nRF54L15 

partie nrf54L15DK

*** Booting MCUboot v2.1.0-dev-9b4ae4cbc9e2 ***
*** Using nRF Connect SDK v3.1.1-e2a97fe2578a ***
*** Using Zephyr OS v4.1.99-ff8f0c579eeb ***
I: Starting bootloader
W: Cannot upgrade: not a compatible amount of sectors
I: Bootloader chainload address offset: 0xe000
I: Image version: v0.0.0
[00:00:00.003,031] <inf> spi_nor: mx25r6435f@0: SFDP v 1.6 AP ff with 3 PH
[00:00:00.003,045] <inf> spi_nor: PH0: ff00 rev 1.6: 16 DW @ 30
[00:00:00.003,180] <inf> spi_nor: mx25r6435f@0: 8 MiBy flash
[00:00:00.003,190] <inf> spi_nor: PH1: ffc2 rev 1.0: 4 DW @ 110
*** Booting nRF Connect SDK v3.1.1-e2a97fe2578a ***
*** Using Zephyr OS v4.1.99-ff8f0c579eeb ***
[00:00:00.005,470] <inf> smp_sample: Starting MCUmgr UART transport
[00:00:00.005,488] <inf> smp_sample: MCUmgr UART ready on uart@c6000
[00:00:00.005,492] <inf> smp_sample: build time: May  7 2026 15:07:48

partie nrf9160 DK 

[00:00:20.690,612] <dbg> lwm2m_firmware: write_dl_uri: write URI: https://xxxxxxxxxxxx/nrf54l15.signed.bin
[00:00:20.693,084] <dbg> lwm2m_firmware: write_resource_to_settings: Permanently stored lwm2m:fir/33629/2/5
[00:00:20.695,617] <dbg> lwm2m_firmware: write_resource_to_settings: Permanently stored lwm2m:fir/33629/2/3
[00:00:20.695,648] <inf> app_lwm2m_client: FOTA download started for instance 2
[00:00:20.695,678] <dbg> lwm2m_adv_firmware: lwm2m_adv_firmware_set_update_state: Update 33629/2/3 state = 1
[00:00:20.698,333] <dbg> lwm2m_firmware: write_image_type_to_settings: Permanently stored lwm2m:fir/33629/2
[00:00:20.698,364] <inf> fota_download_util: Download url https://xxxxxxxxxxxxx/nrf54l15.signed.bin
[00:00:20.698,455] <inf> fota_download_util: Download Path nrf54l15.signed.bin host https://xxxxxxxxxxxxx.cloud
[00:00:20.698,455] <err> fota_download_full_modem: dfu_target_full_modem_cfg failed: -22
[00:00:20.698,486] <err> fota_download_util: Full modem stream init fail -22
[00:00:20.699,432] <dbg> fota_download: set_host_and_file: URI checksums 2077867784,881407557,0,0

[00:00:20.699,523] <dbg> downloader: downloader_start: URL: https://xxxxxxxxxxxxxxx/nrf54l15.signed.bin
[00:00:20.699,645] <dbg> downloader: state_set: state = 2 ()
[00:00:20.699,676] <dbg> downloader: parse_protocol: Port not specified, using default: 443
[00:00:20.700,683] <inf> downloader: Host lookup failed for hostname firmware.egconnect.cloud on IPv6 (err -22), attempting IPv4
[00:00:20.700,744] <dbg> downloader: dl_socket_host_lookup: host lookup xxxxxxxxxxxxxx.cloud, pdn id 0, family 1
[00:00:20.722,686] <dbg> lwm2m_firmware: write_dl_uri: write URI: https://xxxxxxxxxxxx/nrf54l15.signed.bin
[00:00:20.851,501] <dbg> downloader: dl_socket_create_and_connect: family: 1, type: 1, proto: 258
[00:00:20.851,989] <dbg> downloader: dl_socket_create_and_connect: Socket opened, fd 5
[00:00:20.852,020] <inf> downloader: Setting up TLS credentials, sec tag count 1
[00:00:20.852,142] <inf> downloader: Connecting to 91.134.59.209
[00:00:20.852,203] <dbg> downloader: dl_socket_create_and_connect: fd 5, addrlen 8, fam IPv4, port 443
[00:00:23.216,033] <dbg> downloader: http_get_request_send: Range request up to 2048 bytes
[00:00:23.216,094] <dbg> downloader: http_get_request_send: http request:
                                                                         GET /nrf54l15.signed.bin HTTP/1.1
Host: firmware.egconnect.cloud
Range: bytes=0-2047
Connection: keep-alive


[00:00:23.216,888] <dbg> downloader: dl_http_download: Receiving up to 2048 bytes at 0x2001eb0a...
[00:00:23.339,294] <dbg> downloader: http_header_parse: (partial) http header response:
                                                                                       HTTP/1.1 206 Partial Content
Server: nginx
Date: Wed, 13 May 2026 07:54:30 GMT
Content-Type: application/octet-stream
Content-Length: 2048
Connection: keep-alive
Last-Modified: Mon, 27 Apr 2026 14:00:54 GMT
ETag: "69ef6c16-ab000"
Content-Range: bytes 0-2047/700416


[00:00:23.339,538] <dbg> downloader: http_header_parse: File size = 700416
[00:00:23.339,660] <dbg> downloader: dl_http_download: Receiving up to 2048 bytes at 0x2001eb0a...
[00:00:23.462,005] <dbg> downloader: dl_transport_evt_data: Read 2048 bytes from transport
[00:00:23.462,005] <inf> downloader: Downloaded 2048/700416 bytes (0%)
[00:00:23.464,691] <err> os: ***** SECURE FAULT *****
[00:00:23.464,721] <err> os:   Address: 0x30
[00:00:23.464,721] <err> os:   Attribution unit violation
[00:00:23.464,752] <err> os: r0/a1:  0x2002cd90  r1/a2:  0x00000000  r2/a3:  0x2002cdac
[00:00:23.464,752] <err> os: r3/a4:  0x2002cdac r12/ip:  0xffffffff r14/lr:  0x000259f5
[00:00:23.464,782] <err> os:  xpsr:  0x61000000
[00:00:23.464,782] <err> os: Faulting instruction address (r15/pc): 0x00051d94
[00:00:23.464,813] <err> os: >>> ZEPHYR FATAL ERROR 41: Unknown error on CPU 0
[00:00:23.464,874] <err> os: Current thread: 0x20011a10 (downloader)
[00:00:23.677,947] <err> os: Halting system

## Code Implementation

**Callback after download (working):**
```c
case FOTA_DOWNLOAD_EVT_FINISHED:
download_active = false;
#if defined(CONFIG_APP_SMP_CLIENT_FOTA_EXTERNAL)
extern int fota_external_start(int obj_inst_id);
int ret = fota_external_start(2); // Instance 2
if (ret) {
LOG_ERR("Failed to start SMP transfer: %d", ret);
}
#endif
break;
```

**SMP client implementation:**
```c
int fota_external_start(int obj_inst_id)
{
LOG_INF("Starting SMP FOTA transfer for instance %d", obj_inst_id);
int ret = mcumgr_smp_client_update();
if (ret) {
LOG_ERR("SMP client update failed: %d", ret);
}
return ret;
}
```

## What I've Tried
 Reduced log levels
 Verified UART connections physically
 Tested SMP server standalone (boots correctly)
 Verified all 3 instances are created
 Still crashes on first downloaded packet

## Questions

1. Is there a known memory conflict between `fota_download` and `mcumgr_smp_client`?
2. Should I disable certain features when using SMP client with LwM2M?
3. Is the SECURE FAULT related to TF-M permissions when accessing DFU target?
4. Are there recommended partition sizes for this use case?
5. Should I use a different approach for external MCU FOTA via UART?

## Additional Information

- Instance 0 FOTA tested successfully multiple times
- nRF54L15 SMP server responds to basic commands when tested separately
- The crash happens BEFORE any SMP transfer starts (during HTTP download phase)
- Memory usage: ~349KB FLASH (82%), ~144KB RAM (68%) on nRF9160

Any guidance would be greatly appreciated!

Best regards

Related