RE: BUS Fault on BLE connection

reavertm — Thu, 24 Sep 2026 16:47:30 GMT

Whenever I was having crash during connection, it was usually due to memory corruption. And often here:

static atomic_ptr_t buf_rx_freed_cb;

static void buf_rx_freed_notify(enum bt_buf_type mask)
{
	bt_buf_rx_freed_cb_t cb;
	bool in_isr = k_is_in_isr();

	if (!in_isr) {
		k_sched_lock();
	}

	cb = (bt_buf_rx_freed_cb_t)atomic_ptr_get(&buf_rx_freed_cb);

	if (cb != NULL) {
		cb(mask); <-------------------
	}

	if (!in_isr) {
		k_sched_unlock();
	}
}

Linker placed buf_rx_freed_cb (which you can inspect in zephyr.map) after some static array, and code managing that array was having a bug and was writing outside of array, overwriting this callback pointer with some garbage. In my case either it was broken Segger RTT driver, or my code.

I recommend:

1. Enable coredump, decode it and check what pointer is being resolved in place where crash happens

2. If that pointer is statically allocated, inspect zephyr.map to see what code is placed just before it - this is your suspect

RE: BUS Fault on BLE connection

Pallavi Patil — Thu, 24 Sep 2026 12:59:53 GMT

Hi,

Can you please find the associated .dtsi file to see the declared RAM base address and size. For nRF54LM20A, the ram starts from 0x20000080 while from your logs, it starts at 0x2000000. This has 1 i missing digit and thus falls far outside that range leading to an invalid/corrupted pointer.
This could be the probable reason.
Can you please fix this issue and let us know if you face more issues.

Regards

Pallavi