Got NRF_FAULT_ID_SD_ASSERT on S130 while doing sd_ble_gatts_hvx

[codezork]

When I repeatedly (>290 times) send the same notification to the connected host via sd_ble_gatts_hvx, I get a sd_assertion:

Fault identifier:  0x1
Program counter:   0x104FA
Fault information: 0x0
Fault identifier:  0x1
Program counter:   0x14D98
Fault information: 0x0

The payload is 10 bytes long, using S130 with SDK 12.1 on the PCA10028. sd_ble_tx_packet_count_get always returns 7 and the event BLE_EVT_TX_COMPLETE comes after every notification. I am trying to notify repeatedly a sensor reading to a connected host. The assertion sometimes comes after less readings or more. Can anybody give me a hint on that?

Here is the EmBlitz project: notifytest.zip

Here the Android host project: bluenodes.apk

The oscillogram showing disable_irq/enable_irq activities:

[codezork]

Yes you are right with OpenMesh. For the test the mesh only consists of 1 node. A host is connected for testing purposes, I dump adc measurements every second to the host using a notification. The mesh doesn't play a role while doing this. The sd assert comes via the app_error_fault_handler and not via sd_assert_handler which I expected. The app_error_fault_handler doesn't go into the error_loop, so other errors may occur. The value is sent via

 err_code = rbc_mesh_value_set(characteristic, tx_buffer, length);
...
mesh_gatt_evt_push(mesh_gatt_evt_t* p_gatt_evt)
{
...
sd_ble_gatts_hvx(m_active_conn_handle, &hvx_params);
}

The assert comes at undefined times of sent packages. 290 times was a good sequence, it also occurs much earlier.