BT_OBSERVER scan callbacks stop after a while with CONFIG_BT_EXT_ADV=y on NCS v3.4.0 (nRF5340)

[Fluke]

Hi,

I am testing on the nRF5340dk using NCS v3.4.0. I took the official Zephyr Extended Advertising advertiser sample (samples/bluetooth/extended_adv/advertiser) and added a passive scanner to it.

Problem: After receiving a few devices, the scan callback stops being called completely. No more advertising reports are delivered to the host. The scanner simply stops working after a short time.

When setting CONFIG_BT_EXT_ADV=n, the scanner works fine and callbacks are received continuously.

What I need: I need both roles active simultaneously on the same device on the nRF5340:

Extended Advertising (sending)
Scanner receiving Extended Advertising packets from other devices
I am aware of the known issue DRGN-25859 which describes exactly this behavior, but according to the SoftDevice Controller changelog it was fixed in NCS v3.1.0. I am using v3.4.0 and still experiencing the issue.

The available workarounds are not suitable for my use case:

CONFIG_BT_EXT_ADV=n → removes Extended Advertising
hci_vs_sdc_scan_accept_ext_adv_packets_set(false) → scanner no longer receives Extended Advertising packets
Question: Is there a known solution or additional configuration required to run Extended Advertising and the Observer role simultaneously on NCS v3.4.0 on the nRF5340? Is DRGN-25859 really fully fixed or are there remaining edge cases?

Add/refactore this to the advertiser sources:

main.c

static void scan_recv(const struct bt_le_scan_recv_info *info, struct net_buf_simple *buf)
{
	char addr_str[BT_ADDR_LE_STR_LEN];

	bt_addr_le_to_str(info->addr, addr_str, sizeof(addr_str));

    printk("Device found: %s, RSSI %d, Adv type %u, AD data len %u\n", addr_str, info->rssi, info->adv_type, buf->len);
}

static struct bt_le_scan_cb scan_callbacks = {
	.recv = scan_recv,
};

int main(void)
{
...
	bt_le_scan_cb_register(&scan_callbacks);

	err = bt_le_scan_start(BT_LE_SCAN_PASSIVE, NULL);
	if (err) {
		printk("failed (err %d)\n", err);
	}
...
}

prj.conf

CONFIG_POLL=y

CONFIG_BT=y
CONFIG_BT_DEVICE_NAME="test_ext_adv"
CONFIG_BT_PERIPHERAL=y
CONFIG_BT_EXT_ADV=y
CONFIG_BT_OBSERVER=y

CONFIG_ASSERT=y

sysbuild/ipc_radio.conf

CONFIG_BT_CTLR_ADV_EXT=y

sysbuild.conf

# Enable IPC Radio for the network core
SB_CONFIG_NETCORE_IPC_RADIO=y
# Configure protocol for IPC Radio (Bluetooth HCI)
SB_CONFIG_NETCORE_IPC_RADIO_BT_HCI_IPC=y

Any help is appreciated!

Best regards
Fluke

[Fluke]

I had already tried that. But I wanted to stay consistent with the scanner example (github.com/.../scanner).

Unfortunately, that doesn't solve the problem. After a few callbacks, it froze again.

[Einar Thorsrud]

Hi,

I was able to reproduce this on my end as well. The network core is crashing due to  too small event buffers. These should be 255 byte to match the host configuration when both extended advertising and observer is enabled. The fix is to add this to your sysbuild/ipc_radio.conf:

CONFIG_BT_BUF_EVT_RX_SIZE=255
CONFIG_BT_BUF_CMD_TX_SIZE=255

[Fluke]

Thank you so much for looking into this and verifying the issue!

Adding CONFIG_BT_BUF_EVT_RX_SIZE=255 and CONFIG_BT_BUF_CMD_TX_SIZE=255 to sysbuild/ipc_radio.conf completely resolved the problem on my end as well.

I have to admit that this was extremely difficult to diagnose. Because the network core crashed silently without emitting any error logs on the application core's UART, it just looked like the scanner stopped receiving callbacks.

Thanks again for your great support!