Matter nRF54L15 kernel panic (abort) after adding a second On/Off endpoint, works after removing it

[Sathish K]

I’m building a Matter device on the nRF54L15DK with nRF Connect SDK v3.4.1 (Zephyr 4.4.2). The device has two plug endpoints, 1 and 2. I started from the Matter sample and used ZAP (west zap-gui, then west zap-generated) to add the endpoints.

The problem: with endpoint 1 only, everything works. When I add endpoint 2 and build, the device boots, restores the OnOff state for both endpoints, and then panics:

*** Booting My Application v0.0.0 - unknown commit ***
*** Using nRF Connect SDK v3.4.1-b20f8619ba9a ***
*** Using Zephyr OS v4.4.2-33fa6a7aac6a ***

uart:~$ I: 539 [DL]BLE address: FF:60:6A:28:84:76
I: Thread Network Diagnostics reporting started
I: 550 [DL]CHIP task running
I: Init CHIP stack
I: 554 [DL]OpenThread started: OK
I: 557 [DL]Setting OpenThread device type to ROUTER
I: 562 [DL]The device does not support hardware protection against write.
D: Registered new test event: 0xffffffff00000000
D: Registered new test event: 0xffffffff10000000
I: 578 [SVR]Initializing subscription resumption storage...
I: 585 [SVR]Server initializing...
I: 588 [TS]Last Known Good Time: 2023-10-14T01:16:48
I: 593 [DMG]AccessControl: initializing
I: 596 [DMG]Examples::AccessControlDelegate::Init
I: 601 [DMG]AccessControl: setting
I: 604 [DMG]DefaultAclStorage: initializing
I: 608 [DMG]DefaultAclStorage: 0 entries loaded
D: 612 [IN]UDP::Init bind&listen port=5540
D: 616 [IN]UDP::Init bound to port=5540
D: 619 [IN]BLEBase::Init - setting/overriding transport
D: 624 [IN]TransportMgr initialized
D: 632 [DL]Using Thread extended MAC for hostname.
I: 638 [ZCL]Using ZAP configuration...
D: 643 [DL]Boot reason: 1
I: 645 [ZCL]Restoring Plug OnOff state for endpoint 1: OFF
I: 650 [ZCL]Restoring Plug OnOff state for endpoint 2: OFF
abort()
E: r0/a1: 0x00000004 r1/a2: 0x000c8e25 r2/a3: 0x00000000
E: r3/a4: 0x00000004 r12/ip: 0x0000000e r14/lr: 0x00026449
E: xpsr: 0x21000000
E: Faulting instruction address (r15/pc): 0x00026458
E: >>> ZEPHYR FATAL ERROR 4: Kernel panic on CPU 0
E: Current thread: 0x20005410 (CHIP)
E: Halting system

If I delete endpoint 2 in ZAP, regenerate, and rebuild, the device runs normally again. I tried a pristine build, regenerating the ZAP files, and increasing the stack and heap, and the panic still happens with endpoint 2.

What I found so far:

• The endpoint_config.h that gets generated has FIXED_ENDPOINT_COUNT set correctly for the endpoints in the ZAP file.
• My On/Off callback in zcl_callbacks.cpp handles both endpoints but reads endpoint 1 for the physical output. I’m not sure whether this is the cause.
  
  I can share my full project and log if that helps. Thanks in advance.
  drive.google.com/.../view