Got NRF_FAULT_ID_SD_ASSERT on S130 while doing sd_ble_gatts_hvx

[codezork]

When I repeatedly (>290 times) send the same notification to the connected host via sd_ble_gatts_hvx, I get a sd_assertion:

Fault identifier:  0x1
Program counter:   0x104FA
Fault information: 0x0
Fault identifier:  0x1
Program counter:   0x14D98
Fault information: 0x0

The payload is 10 bytes long, using S130 with SDK 12.1 on the PCA10028. sd_ble_tx_packet_count_get always returns 7 and the event BLE_EVT_TX_COMPLETE comes after every notification. I am trying to notify repeatedly a sensor reading to a connected host. The assertion sometimes comes after less readings or more. Can anybody give me a hint on that?

Here is the EmBlitz project: notifytest.zip

Here the Android host project: bluenodes.apk

The oscillogram showing disable_irq/enable_irq activities:

[codezork]

Yes I check errors and everything works fine until the assert. After these faults, the sd_ble_gatts_hvk starts to complain too:

Fault identifier:  0x4001
Program counter:   0x0
Fault information: 0x20007E2C
Line Number: 178
File Name:   Src\rbc_mesh\src\mesh_gatt.c
Error Code:  0x4

This is the line where I check the return code:

err_code = sd_ble_gatts_hvx(m_active_conn_handle, &hvx_params);
APP_ERROR_CHECK(err_code);