ESP32 task corruption when playing A2DP

Post Reply
sb_dabs
Posts: 2
Joined: Mon Oct 13, 2025 12:02 pm

ESP32 task corruption when playing A2DP

Postby sb_dabs » Tue Oct 21, 2025 1:48 pm

Hi there,

We're seeing a crash / task corruption problem when playing audio over A2DP for a while (anywhere between 2-8 hours). We're running quite some tasks, and we've been seeing different tasks be corrupted across different test runs, but almost always with the same error pattern:

Code: Select all

===============================================================
==================== ESP32 CORE DUMP START ====================
The ROM ELF file won't load automatically since it was not found for the provided chip type.

Crashed task handle: 0x3ffec710, name: 'btController', GDB name: 'process 1073661712'

================== CURRENT THREAD REGISTERS ===================
exccause       0x0 (IllegalInstructionCause)
excvaddr       0x0
epc1           0x0
epc2           0x0
epc3           0x0
epc4           0x0
epc5           0x0
epc6           0x0
epc7           0x0
eps2           0x0
eps3           0x0
eps4           0x0
eps5           0x0
eps6           0x0
eps7           0x0
pc             0x20000000          0x20000000
lbeg           0x0                 0
lend           0x0                 0
lcount         0x0                 0
sar            0x0                 0
ps             0x30                48
threadptr      <unavailable>
br             <unavailable>
scompare1      <unavailable>
acclo          <unavailable>
acchi          <unavailable>
m0             <unavailable>
m1             <unavailable>
m2             <unavailable>
m3             <unavailable>
expstate       <unavailable>
f64r_lo        <unavailable>
f64r_hi        <unavailable>
f64s           <unavailable>
fcr            <unavailable>
fsr            <unavailable>
a0             0x20000070          536871024
a1             0x0                 0
a2             0x0                 0
a3             0x0                 0
a4             0x0                 0
a5             0x0                 0
a6             0x0                 0
a7             0x0                 0
a8             0x0                 0
a9             0x0                 0
a10            0x0                 0
a11            0x0                 0
a12            0x0                 0
a13            0x0                 0
a14            0x0                 0
a15            0x0                 0

==================== CURRENT THREAD STACK =====================
#0  0x20000000 in ?? ()
The current crashed task is corrupted.
Task #0 info: flags, tcb, stack (1, 3ffec710, 20000000).

======================== THREADS INFO =========================
  Id   Target Id          Frame 
* 1    process 1073661712 0x20000000 in ?? ()
  2    process 1073465700 0x4008c176 in esp_crosscore_int_send (core_id=0, reason_mask=1) at /COMPONENT_ESP_SYSTEM_DIR/crosscore_int.c:121
  3    process 1073468012 0x40093b45 in esp_cpu_wait_for_intr () at /COMPONENT_ESP_HW_SUPPORT_DIR/cpu.c:64
  4    process 1073468400 0x40093b45 in esp_cpu_wait_for_intr () at /COMPONENT_ESP_HW_SUPPORT_DIR/cpu.c:64
  5    process 1073547984 0x4008c176 in esp_crosscore_int_send (core_id=1, reason_mask=1) at /COMPONENT_ESP_SYSTEM_DIR/crosscore_int.c:121
  6    process 1073543084 0x4008c176 in esp_crosscore_int_send (core_id=0, reason_mask=1) at /COMPONENT_ESP_SYSTEM_DIR/crosscore_int.c:121
  7    process 1073565904 0x4008c176 in esp_crosscore_int_send (core_id=0, reason_mask=1) at /COMPONENT_ESP_SYSTEM_DIR/crosscore_int.c:121
  8    process 1073571508 0x4000bff0 in ?? ()
  9    process 1073537424 0x4000bff0 in ?? ()
  10   process 1073551712 0x00000017 in ?? ()
  11   process 1073575708 0x4000bff0 in ?? ()
  12   process 1073515560 0x4000bff0 in ?? ()
  13   process 1073545508 0x4000bff0 in ?? ()
  14   process 1073609880 0x4000bff0 in ?? ()
  15   process 1073610268 0x4000bff0 in ?? ()
  16   process 1073637428 0x4000bff0 in ?? ()
  17   process 1073454348 0x4000bff0 in ?? ()
  18   process 1073459092 0x4000bff0 in ?? ()
  19   process 1073444144 0x4000bff0 in ?? ()
  20   process 1073479788 0x4000bff0 in ?? ()
  21   process 1073601468 0x4000bff0 in ?? ()
  22   process 1073562960 0x4000bff0 in ?? ()
  23   process 1073533952 0x4000bff0 in ?? ()
  24   process 1073468788 0x4000bff0 in ?? ()
  25   process 1073685896 0x4000bff0 in ?? ()
  26   process 1073693452 0x4000bff0 in ?? ()
  27   process 1073680964 0x4000bff0 in ?? ()


       TCB             NAME PRIO C/B  STACK USED/FREE
---------- ---------------- -------- ----------------
0x3ffec710     btController    23/23         560/3524
0x3ffbc964             main      1/1         640/4464
0x3ffbd26c            IDLE0      0/0         480/1368
0x3ffbd3f0            IDLE1      0/0         480/1356
0x3ffd0ad0    audio_service      5/5         592/2464
0x3ffcf7ac     encoder_task    10/10         560/1476
0x3ffd50d0          ui_leds      8/8         544/1488
0x3ffd66b4      dsp_monitor      3/3         608/2460
0x3ffce190   LogBackendTask      1/1         688/3392
0x3ffd1960       BtA2DPTask    10/10         544/3536
0x3ffd771c     uart_rx_task    18/18         672/1364
0x3ffc8c28  i2s_output_task    21/21         672/1368
0x3ffd0124        input_hal    17/17         512/1532
0x3ffdfc98     skaa_rx_task      7/7         544/2524
0x3ffdfe1c     skaa_tx_task      7/7         640/1396
0x3ffe6834     console_repl      2/2        1280/2800
0x3ffb9d0c             ipc1    24/24         512/1532
0x3ffbaf94        esp_timer    22/22         528/3552
0x3ffb7530             ipc0    24/24         512/1524
0x3ffc006c           app_wq    15/15         528/6628
0x3ffddbbc          sys_evt    20/20         592/3000
0x3ffd4550      volume_task      5/5         544/2000
0x3ffcd400    log_processor    10/10         736/2320
0x3ffbd574          Tmr Svc    22/22         576/2488
0x3fff2588             hciT    22/22         560/1996
0x3fff430c         BTU_TASK    20/20         560/4296
0x3fff1244         BTC_TASK    19/19         560/3012

==================== THREAD 1 (TCB: 0x3ffec710, name: 'btController') =====================
#0  0x20000000 in ?? ()
The task '1' is corrupted.
Task #0 info: flags, tcb, stack (1, 3ffec710, 20000000).

==================== THREAD 2 (TCB: 0x3ffbc964, name: 'main') =====================
#0  0x4008c176 in esp_crosscore_int_send (core_id=0, reason_mask=1) at /COMPONENT_ESP_SYSTEM_DIR/crosscore_int.c:121
#1  0x4008c19b in esp_crosscore_int_send_yield (core_id=0) at /COMPONENT_ESP_SYSTEM_DIR/crosscore_int.c:125
#2  0x4009a7f8 in vTaskDelay (xTicksToDelay=1) at /COMPONENT_XTENSA_DIR/include/xt_utils.h:41
#3  0x401bc855 in delay_ms ()
#4  0x400d3df4 in app_main () at ./src/bsp/sherpa_lite/main.c:73
#5  0x4021745f in main_task (args=0x0) at /COMPONENT_FREERTOS_DIR/app_startup.c:208
#6  0x40099523 in vPortTaskWrapper (pxCode=0x40217410 <main_task>, pvParameters=0x0) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:139

==================== THREAD 3 (TCB: 0x3ffbd26c, name: 'IDLE0') =====================
#0  0x40093b45 in esp_cpu_wait_for_intr () at /COMPONENT_ESP_HW_SUPPORT_DIR/cpu.c:64
#1  0x402168c9 in esp_vApplicationIdleHook () at /COMPONENT_ESP_SYSTEM_DIR/freertos_hooks.c:58
#2  0x4009a433 in prvIdleTask (pvParameters=<optimized out>) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/tasks.c:4350
#3  0x40099523 in vPortTaskWrapper (pxCode=0x4009a390 <prvIdleTask>, pvParameters=0x0) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:139

==================== THREAD 4 (TCB: 0x3ffbd3f0, name: 'IDLE1') =====================
#0  0x40093b45 in esp_cpu_wait_for_intr () at /COMPONENT_ESP_HW_SUPPORT_DIR/cpu.c:64
#1  0x402168c9 in esp_vApplicationIdleHook () at /COMPONENT_ESP_SYSTEM_DIR/freertos_hooks.c:58
#2  0x4009a433 in prvIdleTask (pvParameters=<optimized out>) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/tasks.c:4350
#3  0x40099523 in vPortTaskWrapper (pxCode=0x4009a390 <prvIdleTask>, pvParameters=0x0) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:139

==================== THREAD 5 (TCB: 0x3ffd0ad0, name: 'audio_service') =====================
#0  0x4008c176 in esp_crosscore_int_send (core_id=1, reason_mask=1) at /COMPONENT_ESP_SYSTEM_DIR/crosscore_int.c:121
#1  0x4008c19b in esp_crosscore_int_send_yield (core_id=1) at /COMPONENT_ESP_SYSTEM_DIR/crosscore_int.c:125
#2  0x4009a7f8 in vTaskDelay (xTicksToDelay=1) at /COMPONENT_XTENSA_DIR/include/xt_utils.h:41
#3  0x401bc855 in delay_ms ()
#4  0x400e2fc4 in audio_service_task (arg=0x0) at ./src/app/services/audio/audio.c:144
#5  0x40099523 in vPortTaskWrapper (pxCode=0x400e2f34 <audio_service_task>, pvParameters=0x0) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:139

==================== THREAD 6 (TCB: 0x3ffcf7ac, name: 'encoder_task') =====================
#0  0x4008c176 in esp_crosscore_int_send (core_id=0, reason_mask=1) at /COMPONENT_ESP_SYSTEM_DIR/crosscore_int.c:121
#1  0x4008c19b in esp_crosscore_int_send_yield (core_id=0) at /COMPONENT_ESP_SYSTEM_DIR/crosscore_int.c:125
#2  0x4009a770 in xTaskDelayUntil (pxPreviousWakeTime=<optimized out>, xTimeIncrement=<optimized out>) at /COMPONENT_XTENSA_DIR/include/xt_utils.h:41
#3  0x400e2590 in encoder_task (arg=0x0) at ./src/bsp/sherpa_lite/encoder/encoder.c:61
#4  0x40099523 in vPortTaskWrapper (pxCode=0x400e24b4 <encoder_task>, pvParameters=0x0) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:139

==================== THREAD 7 (TCB: 0x3ffd50d0, name: 'ui_leds') =====================
#0  0x4008c176 in esp_crosscore_int_send (core_id=0, reason_mask=1) at /COMPONENT_ESP_SYSTEM_DIR/crosscore_int.c:121
#1  0x4008c19b in esp_crosscore_int_send_yield (core_id=0) at /COMPONENT_ESP_SYSTEM_DIR/crosscore_int.c:125
#2  0x4009a770 in xTaskDelayUntil (pxPreviousWakeTime=<optimized out>, xTimeIncrement=<optimized out>) at /COMPONENT_XTENSA_DIR/include/xt_utils.h:41
#3  0x400ef2a9 in ui_leds_task (arg=0x0) at ./src/app/ui/ui.c:57
#4  0x40099523 in vPortTaskWrapper (pxCode=0x400ef270 <ui_leds_task>, pvParameters=0x0) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:139

==================== THREAD 8 (TCB: 0x3ffd66b4, name: 'dsp_monitor') =====================
#0  0x4000bff0 in ?? ()
#1  0x40099889 in vPortClearInterruptMaskFromISR (prev_level=<optimized out>) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/include/freertos/portmacro.h:560
#2  vPortExitCritical (mux=0x3ffd747c <xTempQueueStorage+84>) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:514
#3  0x40098add in xQueueReceive (xQueue=0x3ffd7428 <xTempQueueStorage>, pvBuffer=0x3ffd7350 <xStack+2860>, xTicksToWait=<optimized out>) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/queue.c:1632
#4  0x40102770 in dsp_monitor_thread (pvParameters=0x0) at ./src/bsp/sherpa_lite/dsp/dsp.c:136
#5  0x40099523 in vPortTaskWrapper (pxCode=0x401024ec <dsp_monitor_thread>, pvParameters=0x0) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:139

==================== THREAD 9 (TCB: 0x3ffce190, name: 'LogBackendTask') =====================
#0  0x4000bff0 in ?? ()
#1  0x40099889 in vPortClearInterruptMaskFromISR (prev_level=<optimized out>) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/include/freertos/portmacro.h:560
#2  vPortExitCritical (mux=0x3f805944) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:514
#3  0x4009747c in prvReceiveGeneric (pxRingbuffer=0x3f8058dc, pvItem1=0x3ffcf1a8 <xStack+3752>, pvItem2=0x0, xItemSize1=0x3ffcf22c <xStack+3884>, xItemSize2=0x0, xMaxSize=0, xTicksToWait=<optimized out>, xTicksToWait@entry=200) at /COMPONENT_ESP_RINGBUF_DIR/ringbuf.c:885
#4  0x4009770e in xRingbufferReceive (xRingbuffer=0x3f8058dc, pxItemSize=0x3ffcf22c <xStack+3884>, xTicksToWait=200) at /COMPONENT_ESP_RINGBUF_DIR/ringbuf.c:1111
#5  0x400d8626 in log_backend_fs_thread (arg=0x0) at ./src/app/services/log_backend_fs/log_backend_fs.c:439
#6  0x40099523 in vPortTaskWrapper (pxCode=0x400d83b8 <log_backend_fs_thread>, pvParameters=0x0) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:139

==================== THREAD 10 (TCB: 0x3ffd1960, name: 'BtA2DPTask') =====================
#0  0x00000017 in ?? ()
Backtrace stopped: Cannot access memory at address 0x17

==================== THREAD 11 (TCB: 0x3ffd771c, name: 'uart_rx_task') =====================
#0  0x4000bff0 in ?? ()
#1  0x40099889 in vPortClearInterruptMaskFromISR (prev_level=<optimized out>) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/include/freertos/portmacro.h:560
#2  vPortExitCritical (mux=0x3ffe24f0) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:514
#3  0x4009747c in prvReceiveGeneric (pxRingbuffer=0x3ffe2488, pvItem1=0x3ffd7f48 <xStack+1724>, pvItem2=0x0, xItemSize1=0x3ffd7f88 <xStack+1788>, xItemSize2=0x0, xMaxSize=1, xTicksToWait=<optimized out>, xTicksToWait@entry=1000) at /COMPONENT_ESP_RINGBUF_DIR/ringbuf.c:885
#4  0x400977eb in xRingbufferReceiveUpTo (xRingbuffer=0x3ffe2488, pxItemSize=0x3ffd7f88 <xStack+1788>, xTicksToWait=1000, xMaxSize=1) at /COMPONENT_ESP_RINGBUF_DIR/ringbuf.c:1182
#5  0x401ca0d1 in uart_read_bytes (uart_num=<optimized out>, buf=0x3ffd7fb4 <xStack+1832>, length=1, ticks_to_wait=1000) at /COMPONENT_ESP_DRIVER_UART_DIR/src/uart.c:1635
#6  0x40104d91 in rx_task (arg=0x0) at ./src/bsp/sherpa_lite/uart/esp32_uart.c:33
#7  0x40099523 in vPortTaskWrapper (pxCode=0x40104d74 <rx_task>, pvParameters=0x0) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:139

==================== THREAD 12 (TCB: 0x3ffc8c28, name: 'i2s_output_task') =====================
#0  0x4000bff0 in ?? ()
#1  0x40099889 in vPortClearInterruptMaskFromISR (prev_level=<optimized out>) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/include/freertos/portmacro.h:560
#2  vPortExitCritical (mux=0x3ffecdb8) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:514
#3  0x40098add in xQueueReceive (xQueue=0x3ffecd64, pvBuffer=0x3ffecce8, xTicksToWait=<optimized out>) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/queue.c:1632
#4  0x401ef33d in i2s_channel_write (handle=0x3ffeccc0, src=<optimized out>, size=980, bytes_written=0x3ffc94cc <s_i2s_output_task_stack+1844>, timeout_ms=<optimized out>) at /COMPONENT_ESP_DRIVER_I2S_DIR/i2s_common.c:1321
#5  0x4010454a in i2s_output_task (arg=0x0) at ./src/bsp/sherpa_lite/i2s/i2s.c:169
#6  0x40099523 in vPortTaskWrapper (pxCode=0x4010446c <i2s_output_task>, pvParameters=0x0) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:139

==================== THREAD 13 (TCB: 0x3ffd0124, name: 'input_hal') =====================
#0  0x4000bff0 in ?? ()
#1  0x40099889 in vPortClearInterruptMaskFromISR (prev_level=<optimized out>) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/include/freertos/portmacro.h:560
#2  vPortExitCritical (mux=0x3ffde4e4) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:514
#3  0x40098bee in xQueueSemaphoreTake (xQueue=0x3ffde490, xTicksToWait=<optimized out>) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/queue.c:1853
#4  0x400e2c74 in input_hal_thread (arg=0x0) at ./src/bsp/sherpa_lite/gpio/input_hal.c:70
#5  0x40099523 in vPortTaskWrapper (pxCode=0x400e2c58 <input_hal_thread>, pvParameters=0x0) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:139

==================== THREAD 14 (TCB: 0x3ffdfc98, name: 'skaa_rx_task') =====================
#0  0x4000bff0 in ?? ()
#1  0x40099889 in vPortClearInterruptMaskFromISR (prev_level=<optimized out>) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/include/freertos/portmacro.h:560
#2  vPortExitCritical (mux=0x3ffded80) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:514
#3  0x40098add in xQueueReceive (xQueue=0x3ffded2c, pvBuffer=0x3ffdfb44, xTicksToWait=<optimized out>) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/queue.c:1632
#4  0x400e5561 in skaa_rx_task (arg=0x0) at ./src/bsp/sherpa_lite/skaa/skaa_sm.c:282
#5  0x40099523 in vPortTaskWrapper (pxCode=0x400e5540 <skaa_rx_task>, pvParameters=0x0) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:139

==================== THREAD 15 (TCB: 0x3ffdfe1c, name: 'skaa_tx_task') =====================
#0  0x4000bff0 in ?? ()
#1  0x40099889 in vPortClearInterruptMaskFromISR (prev_level=<optimized out>) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/include/freertos/portmacro.h:560
#2  vPortExitCritical (mux=0x3ffdec0c) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:514
#3  0x40098add in xQueueReceive (xQueue=0x3ffdebb8, pvBuffer=0x3ffe1fb4, xTicksToWait=<optimized out>) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/queue.c:1632
#4  0x400e57c8 in skaa_tx_task (arg=0x0) at ./src/bsp/sherpa_lite/skaa/skaa_sm.c:410
#5  0x40099523 in vPortTaskWrapper (pxCode=0x400e57ac <skaa_tx_task>, pvParameters=0x0) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:139

==================== THREAD 16 (TCB: 0x3ffe6834, name: 'console_repl') =====================
#0  0x4000bff0 in ?? ()
#1  0x40099889 in vPortClearInterruptMaskFromISR (prev_level=<optimized out>) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/include/freertos/portmacro.h:560
#2  vPortExitCritical (mux=0x3ffe5270) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:514
#3  0x4009747c in prvReceiveGeneric (pxRingbuffer=0x3ffe5208, pvItem1=0x3ffe6388, pvItem2=0x0, xItemSize1=0x3ffe63c8, xItemSize2=0x0, xMaxSize=1, xTicksToWait=<optimized out>, xTicksToWait@entry=4294967295) at /COMPONENT_ESP_RINGBUF_DIR/ringbuf.c:885
#4  0x400977eb in xRingbufferReceiveUpTo (xRingbuffer=0x3ffe5208, pxItemSize=0x3ffe63c8, xTicksToWait=4294967295, xMaxSize=1) at /COMPONENT_ESP_RINGBUF_DIR/ringbuf.c:1182
#5  0x401ca0d1 in uart_read_bytes (uart_num=<optimized out>, buf=0x3ffe63fb, length=1, ticks_to_wait=4294967295) at /COMPONENT_ESP_DRIVER_UART_DIR/src/uart.c:1635
#6  0x401cb0cc in uart_rx_char_via_driver (fd=0) at /COMPONENT_ESP_DRIVER_UART_DIR/src/uart_vfs.c:219
#7  0x401cb3dc in uart_read_char (fd=0) at /COMPONENT_ESP_DRIVER_UART_DIR/src/uart_vfs.c:263
#8  uart_read (fd=0, data=0x3ffe65c4, size=1) at /COMPONENT_ESP_DRIVER_UART_DIR/src/uart_vfs.c:283
#9  0x401cbcb9 in esp_vfs_read (r=0x3ffe68ac, fd=<optimized out>, dst=0x3ffe65c4, size=1) at /COMPONENT_VFS_DIR/vfs.c:1008
#10 0x4000bdbe in ?? ()
#11 0x400017ed in ?? ()
#12 0x401ecc14 in console_read (fd=<optimized out>, dst=0x3ffe65c4, size=1) at /COMPONENT_ESP_VFS_CONSOLE_DIR/vfs_console.c:119
#13 0x401cbcb9 in esp_vfs_read (r=0x3ffe68ac, fd=<optimized out>, dst=0x3ffe65c4, size=1) at /COMPONENT_VFS_DIR/vfs.c:1008
#14 0x4000bdbe in ?? ()
#15 0x400017ed in ?? ()
#16 0x40110fbc in linenoiseDumb (buf=0x3ffed1dc <error: Cannot access memory at address 0x3ffed1dc>, buflen=1024, prompt=<optimized out>) at /COMPONENT_CONSOLE_DIR/linenoise/linenoise.c:1171
#17 linenoise (prompt=<optimized out>) at /COMPONENT_CONSOLE_DIR/linenoise/linenoise.c:1227
#18 0x4010f51b in esp_console_repl_task (args=0x3ffe2ff4) at /COMPONENT_CONSOLE_DIR/esp_console_common.c:206
#19 0x40099523 in vPortTaskWrapper (pxCode=0x4010f42c <esp_console_repl_task>, pvParameters=0x3ffe2ff4) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:139

==================== THREAD 17 (TCB: 0x3ffb9d0c, name: 'ipc1') =====================
#0  0x4000bff0 in ?? ()
#1  0x40099889 in vPortClearInterruptMaskFromISR (prev_level=<optimized out>) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/include/freertos/portmacro.h:560
#2  vPortExitCritical (mux=0x3ffbf29c <xKernelLock>) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:514
#3  0x4009c13d in ulTaskGenericNotifyTake (uxIndexToWait=<optimized out>, xClearCountOnExit=1, xTicksToWait=4294967295) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/tasks.c:5768
#4  0x4008c256 in ipc_task (arg=0x1) at /COMPONENT_ESP_SYSTEM_DIR/esp_ipc.c:62
#5  0x40099523 in vPortTaskWrapper (pxCode=0x4008c208 <ipc_task>, pvParameters=0x1) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:139

==================== THREAD 18 (TCB: 0x3ffbaf94, name: 'esp_timer') =====================
#0  0x4000bff0 in ?? ()
#1  0x40099889 in vPortClearInterruptMaskFromISR (prev_level=<optimized out>) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/include/freertos/portmacro.h:560
#2  vPortExitCritical (mux=0x3ffbf29c <xKernelLock>) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:514
#3  0x4009c13d in ulTaskGenericNotifyTake (uxIndexToWait=<optimized out>, xClearCountOnExit=1, xTicksToWait=4294967295) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/tasks.c:5768
#4  0x401c31cc in timer_task (arg=<optimized out>) at /COMPONENT_ESP_TIMER_DIR/src/esp_timer.c:459
#5  0x40099523 in vPortTaskWrapper (pxCode=0x401c31a4 <timer_task>, pvParameters=0x0) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:139

==================== THREAD 19 (TCB: 0x3ffb7530, name: 'ipc0') =====================
#0  0x4000bff0 in ?? ()
#1  0x40099889 in vPortClearInterruptMaskFromISR (prev_level=<optimized out>) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/include/freertos/portmacro.h:560
#2  vPortExitCritical (mux=0x3ffbf29c <xKernelLock>) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:514
#3  0x4009c13d in ulTaskGenericNotifyTake (uxIndexToWait=<optimized out>, xClearCountOnExit=1, xTicksToWait=4294967295) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/tasks.c:5768
#4  0x4008c256 in ipc_task (arg=0x0) at /COMPONENT_ESP_SYSTEM_DIR/esp_ipc.c:62
#5  0x40099523 in vPortTaskWrapper (pxCode=0x4008c208 <ipc_task>, pvParameters=0x0) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:139

==================== THREAD 20 (TCB: 0x3ffc006c, name: 'app_wq') =====================
#0  0x4000bff0 in ?? ()
#1  0x40099889 in vPortClearInterruptMaskFromISR (prev_level=<optimized out>) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/include/freertos/portmacro.h:560
#2  vPortExitCritical (mux=0x3ffbff60 <s_work_queue_struct+84>) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:514
#3  0x40098add in xQueueReceive (xQueue=0x3ffbff0c <s_work_queue_struct>, pvBuffer=0x3ffc1d00 <s_worker_task_stack+6948>, xTicksToWait=<optimized out>) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/queue.c:1632
#4  0x400d9b35 in app_work_queue_thread (arg=0x0) at ./src/app/services/app_work_queue/app_work_queue.c:45
#5  0x40099523 in vPortTaskWrapper (pxCode=0x400d9b1c <app_work_queue_thread>, pvParameters=0x0) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:139

==================== THREAD 21 (TCB: 0x3ffddbbc, name: 'sys_evt') =====================
#0  0x4000bff0 in ?? ()
#1  0x40099889 in vPortClearInterruptMaskFromISR (prev_level=<optimized out>) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/include/freertos/portmacro.h:560
#2  vPortExitCritical (mux=0x3ffdca9c) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:514
#3  0x40098add in xQueueReceive (xQueue=0x3ffdca48, pvBuffer=0x3ffdda4c, xTicksToWait=<optimized out>) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/queue.c:1632
#4  0x401cfac8 in esp_event_loop_run (event_loop=<optimized out>, ticks_to_run=4294967295) at /COMPONENT_ESP_EVENT_DIR/esp_event.c:644
#5  0x401cfb00 in esp_event_loop_run_task (args=0x3ffdca14) at /COMPONENT_ESP_EVENT_DIR/esp_event.c:106
#6  0x40099523 in vPortTaskWrapper (pxCode=0x401cfae8 <esp_event_loop_run_task>, pvParameters=0x3ffdca14) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:139

==================== THREAD 22 (TCB: 0x3ffd4550, name: 'volume_task') =====================
#0  0x4000bff0 in ?? ()
#1  0x40099889 in vPortClearInterruptMaskFromISR (prev_level=<optimized out>) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/include/freertos/portmacro.h:560
#2  vPortExitCritical (mux=0x3ffe6ae4) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:514
#3  0x40098add in xQueueReceive (xQueue=0x3ffe6a90, pvBuffer=0x3ffd4fe2 <xStack+2338>, xTicksToWait=<optimized out>) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/queue.c:1632
#4  0x400ee34d in volume_task (arg=0x0) at ./src/app/services/volume/volume.c:187
#5  0x40099523 in vPortTaskWrapper (pxCode=0x400ee2d0 <volume_task>, pvParameters=0x0) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:139

==================== THREAD 23 (TCB: 0x3ffcd400, name: 'log_processor') =====================
#0  0x4000bff0 in ?? ()
#1  0x40099889 in vPortClearInterruptMaskFromISR (prev_level=<optimized out>) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/include/freertos/portmacro.h:560
#2  vPortExitCritical (mux=0x3ffe0654) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:514
#3  0x4009747c in prvReceiveGeneric (pxRingbuffer=0x3ffe05ec, pvItem1=0x3ffcdfe8 <xStack+2680>, pvItem2=0x0, xItemSize1=0x3ffce098 <xStack+2856>, xItemSize2=0x0, xMaxSize=0, xTicksToWait=<optimized out>, xTicksToWait@entry=4294967295) at /COMPONENT_ESP_RINGBUF_DIR/ringbuf.c:885
#4  0x4009770e in xRingbufferReceive (xRingbuffer=0x3ffe05ec, pxItemSize=0x3ffce098 <xStack+2856>, xTicksToWait=4294967295) at /COMPONENT_ESP_RINGBUF_DIR/ringbuf.c:1111
#5  0x400d5f68 in log_processor_task (pvParameters=0x0) at ./src/app/services/logging/log_processor.c:42
#6  0x40099523 in vPortTaskWrapper (pxCode=0x400d5f30 <log_processor_task>, pvParameters=0x0) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:139

==================== THREAD 24 (TCB: 0x3ffbd574, name: 'Tmr Svc') =====================
#0  0x4000bff0 in ?? ()
#1  0x40099889 in vPortClearInterruptMaskFromISR (prev_level=<optimized out>) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/include/freertos/portmacro.h:560
#2  vPortExitCritical (mux=0x3ffbf3c0 <reason_spinlock>) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:514
#3  0x4008c154 in esp_crosscore_int_send (core_id=0, reason_mask=1) at /COMPONENT_ESP_SYSTEM_DIR/crosscore_int.c:118
#4  0x4008c19b in esp_crosscore_int_send_yield (core_id=0) at /COMPONENT_ESP_SYSTEM_DIR/crosscore_int.c:125
#5  0x4009911d in prvProcessTimerOrBlockTask (xNextExpireTime=<optimized out>, xListWasEmpty=<optimized out>) at /COMPONENT_XTENSA_DIR/include/xt_utils.h:41
#6  prvTimerTask (pvParameters=<optimized out>) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/timers.c:685
#7  0x40099523 in vPortTaskWrapper (pxCode=0x4009906c <prvTimerTask>, pvParameters=0x0) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:139

==================== THREAD 25 (TCB: 0x3fff2588, name: 'hciT') =====================
#0  0x4000bff0 in ?? ()
#1  0x40099889 in vPortClearInterruptMaskFromISR (prev_level=<optimized out>) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/include/freertos/portmacro.h:560
#2  vPortExitCritical (mux=0x3fff1a14) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:514
#3  0x40098bee in xQueueSemaphoreTake (xQueue=0x3fff19c0, xTicksToWait=<optimized out>) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/queue.c:1853
#4  0x401551e4 in osi_sem_take (sem=0x3f809b98, timeout=4294967295) at /COMPONENT_BT_DIR/common/osi/semaphore.c:60
#5  0x40154b69 in osi_thread_run (arg=<optimized out>) at /COMPONENT_BT_DIR/common/osi/thread.c:156
#6  0x40099523 in vPortTaskWrapper (pxCode=0x40154b44 <osi_thread_run>, pvParameters=0x3fff0ef0) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:139

==================== THREAD 26 (TCB: 0x3fff430c, name: 'BTU_TASK') =====================
#0  0x4000bff0 in ?? ()
#1  0x40099889 in vPortClearInterruptMaskFromISR (prev_level=<optimized out>) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/include/freertos/portmacro.h:560
#2  vPortExitCritical (mux=0x3fff2e18) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:514
#3  0x40098bee in xQueueSemaphoreTake (xQueue=0x3fff2dc4, xTicksToWait=<optimized out>) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/queue.c:1853
#4  0x401551e4 in osi_sem_take (sem=0x3f809fa4, timeout=4294967295) at /COMPONENT_BT_DIR/common/osi/semaphore.c:60
#5  0x40154b69 in osi_thread_run (arg=<optimized out>) at /COMPONENT_BT_DIR/common/osi/thread.c:156
#6  0x40099523 in vPortTaskWrapper (pxCode=0x40154b44 <osi_thread_run>, pvParameters=0x3fff0ef0) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:139

==================== THREAD 27 (TCB: 0x3fff1244, name: 'BTC_TASK') =====================
#0  0x4000bff0 in ?? ()
#1  0x40099889 in vPortClearInterruptMaskFromISR (prev_level=<optimized out>) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/include/freertos/portmacro.h:560
#2  vPortExitCritical (mux=0x3ffed1ac) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:514
#3  0x40098bee in xQueueSemaphoreTake (xQueue=0x3ffed158, xTicksToWait=<optimized out>) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/queue.c:1853
#4  0x401551e4 in osi_sem_take (sem=0x3f807d10, timeout=4294967295) at /COMPONENT_BT_DIR/common/osi/semaphore.c:60
#5  0x40154b69 in osi_thread_run (arg=<optimized out>) at /COMPONENT_BT_DIR/common/osi/thread.c:156
#6  0x40099523 in vPortTaskWrapper (pxCode=0x40154b44 <osi_thread_run>, pvParameters=0x3ffbc460) at /COMPONENT_FREERTOS_DIR/FreeRTOS-Kernel/portable/xtensa/port.c:139


======================= ALL MEMORY REGIONS ========================
Name   Address   Size   Attrs
.rtc.text 0x400c0000 0x0 RW  
.rtc.dummy 0x3ff80000 0x0 RW  
.rtc.force_fast 0x3ff80000 0x0 RW  
.rtc_noinit 0x50000000 0x0 RW  
.rtc.force_slow 0x50000000 0xb0 RWXA
.rtc_fast_reserved 0x3ff82000 0x0 RW  
.iram0.vectors 0x40080000 0x404 R XA
.iram0.text 0x40080404 0x23d77 R XA
.dram0.data 0x3ffbdb60 0xf768 RW A
.dram0.data 0x3ffbdb60 0xf768 RW A
.ext_ram_noinit 0x3f800000 0x0 RW  
.flash.appdesc 0x3f400020 0x100 R  A
.flash.rodata 0x3f400120 0x34864 RW A
.flash.text 0x400d0020 0x149e57 R XA
.iram0.data 0x400a417c 0x0 RW  
.iram0.bss 0x400a417c 0x0 RW  
.dram0.heap_start 0x3ffda5e8 0x0 RW  
.coredump.tasks.data 0x3ffec710 0x170 RW 
.coredump.tasks.data 0x20000000 0x70 RW 
.coredump.tasks.data 0x3ffbc964 0x170 RW 
.coredump.tasks.data 0x3ffbc5d0 0x280 RW 
.coredump.tasks.data 0x3ffbd26c 0x170 RW 
.coredump.tasks.data 0x3ffbd040 0x1e0 RW 
.coredump.tasks.data 0x3ffbd3f0 0x170 RW 
.coredump.tasks.data 0x3ffdae20 0x1e0 RW 
.coredump.tasks.data 0x3ffd0ad0 0x170 RW 
.coredump.tasks.data 0x3ffd15e0 0x250 RW 
.coredump.tasks.data 0x3ffcf7ac 0x170 RW 
.coredump.tasks.data 0x3ffcfee0 0x230 RW 
.coredump.tasks.data 0x3ffd50d0 0x170 RW 
.coredump.tasks.data 0x3ffd5810 0x220 RW 
.coredump.tasks.data 0x3ffd66b4 0x170 RW 
.coredump.tasks.data 0x3ffd71c0 0x260 RW 
.coredump.tasks.data 0x3ffce190 0x170 RW 
.coredump.tasks.data 0x3ffcf040 0x2b0 RW 
.coredump.tasks.data 0x3ffd1960 0x170 RW 
.coredump.tasks.data 0x3ffd28a0 0x220 RW 
.coredump.tasks.data 0x3ffd771c 0x170 RW 
.coredump.tasks.data 0x3ffd7de0 0x2a0 RW 
.coredump.tasks.data 0x3ffc92f0 0x2a0 RW 
.coredump.tasks.data 0x3ffd0124 0x170 RW 
.coredump.tasks.data 0x3ffd0890 0x200 RW 
.coredump.tasks.data 0x3ffdfc98 0x170 RW 
.coredump.tasks.data 0x3ffdf9f0 0x220 RW 
.coredump.tasks.data 0x3ffdfe1c 0x170 RW 
.coredump.tasks.data 0x3ffe1e20 0x280 RW 
.coredump.tasks.data 0x3ffe6834 0x170 RW 
.coredump.tasks.data 0x3ffe6220 0x500 RW 
.coredump.tasks.data 0x3ffb9d0c 0x170 RW 
.coredump.tasks.data 0x3ffb7cb0 0x200 RW 
.coredump.tasks.data 0x3ffbaf94 0x170 RW 
.coredump.tasks.data 0x3ffbac70 0x210 RW 
.coredump.tasks.data 0x3ffb7530 0x170 RW 
.coredump.tasks.data 0x3ffb7220 0x200 RW 
.coredump.tasks.data 0x3ffc1bc0 0x210 RW 
.coredump.tasks.data 0x3ffddbbc 0x170 RW 
.coredump.tasks.data 0x3ffdd8f0 0x250 RW 
.coredump.tasks.data 0x3ffd4550 0x170 RW 
.coredump.tasks.data 0x3ffd4e90 0x220 RW 
.coredump.tasks.data 0x3ffcd400 0x170 RW 
.coredump.tasks.data 0x3ffcde80 0x2e0 RW 
.coredump.tasks.data 0x3ffbd574 0x170 RW 
.coredump.tasks.data 0x3ffdba10 0x240 RW 
.coredump.tasks.data 0x3fff2588 0x170 RW 
.coredump.tasks.data 0x3fff22d0 0x230 RW 
.coredump.tasks.data 0x3fff430c 0x170 RW 
.coredump.tasks.data 0x3fff3fd0 0x230 RW 
.coredump.tasks.data 0x3fff1244 0x170 RW 
.coredump.tasks.data 0x3fff0e70 0x230 RW 

===================== ESP32 CORE DUMP END =====================
===============================================================
Done!
Chip is ESP32-D0WD-V3 (revision v3.1), we're on ESP IDF v5.5.1.

We're a bit at a loss for where to start looking. We've got most the following sdkconfig options (and a lot more, just a snippet of safety features) enabled:

Code: Select all

CONFIG_HEAP_POISONING_COMPREHENSIVE=y
CONFIG_COMPILER_STACK_CHECK_MODE_ALL=y
CONFIG_COMPILER_STACK_CHECK=y
...
CONFIG_BT_ALLOCATION_FROM_SPIRAM_FIRST=y
We're using both PSRAM and flash writes every once in a while, so cache disables and concurrency waits do happen, but without direct impact at normal runtime.

Attached is a number of the coredumps that we've gotten over trying to debug the issue.
Interestingly, one of the crashes seemed to instead be in the r_rwbtdm_isr_wrapper.

Any pointers to where to start looking or related experiences are appreciated!
Attachments
dump3-20251017-092400.txt
(32.91 KiB) Downloaded 42 times
dump2_20251020_105318.txt
(31.1 KiB) Downloaded 53 times
dump1_20251020_095413.txt
(31.15 KiB) Downloaded 35 times
Top
esp-jc
Espressif staff
Espressif staff
Posts: 7
Joined: Tue Jun 14, 2022 6:20 am

Re: ESP32 task corruption when playing A2DP

Postby esp-jc » Wed Oct 29, 2025 9:48 am

The crash that occurred in `r_rwbtdm_isr_wrapper` is a Bluetooth hardware error. Specifically, the number of `1`’s in the AFH channel map written by software does not match the value of `nb_good_chan` also written by software. By examining the ESP32 Bluetooth library, we found there might be a mismatch between the channel map and the channel number. We will verify this issue as soon as possible, and if it is confirmed, we will provide a fix promptly.

As for the other crashes, most are of type "IllegalInstructionCause", meaning an illegal instruction error. The "excvaddr" field is shown as `0`, which suggests that the software attempted to access a null function pointer.
Top
sb_dabs
Posts: 2
Joined: Mon Oct 13, 2025 12:02 pm

Re: ESP32 task corruption when playing A2DP

Postby sb_dabs » Thu Oct 30, 2025 2:02 pm

Ah OK, that's somewhat comforting to hear. If we're based on baseline ESP IDF v5.5.1, are there other Bluetooth controller fixes that we should be aware of that could be of interest here, keeping in mind A2DP streaming and potentially GATTS connections?

We found one potential source of null pointer dereferencing for some events related to Bluetooth handling, so unless we're seeing any new crashes where the coredump indicates btController, I think this should be solved.

Since then, we've seen some coredumps related to stack smash protections however, and the different tasks seems corrupted as well.

I've attached another 2 coredumps highlighting this.

Appreciate the help!
Attachments
coredump5-20251029-1433.txt
(33.73 KiB) Downloaded 31 times
coredump4-20251030-0843.txt
(856.82 KiB) Downloaded 53 times
Last edited by sb_dabs on Thu Oct 30, 2025 3:27 pm, edited 1 time in total.
Top
esp-jc
Espressif staff
Espressif staff
Posts: 7
Joined: Tue Jun 14, 2022 6:20 am

Re: ESP32 task corruption when playing A2DP

Postby esp-jc » Mon Nov 10, 2025 2:25 am

We have fixed an issue in the internal Bluetooth library that could cause a crash related to `r_rwbtdm_isr_wrapper with 32768`. Below is the updated Bluetooth library. Please follow the steps to switch your project to use the new library:

1. Replace `components/bt/controller/lib_esp32/esp32/libbtdm_app.a` with the new library provided in the attachment.
2. Add the following lines to `components/esp_rom/esp32/ld/esp32.rom.ld`:

Code: Select all

PROVIDE ( ld_acl_afh_apply = 0x40030e94 );
PROVIDE ( ld_acl_afh_switch_on_cbk = 0x40030fa8 );
PROVIDE ( ld_acl_afh_switch_off_cbk = 0x400310c4 );

The provided library includes debug information. If the `r_rwbtdm_isr_wrapper with 32768` crash occurs again, please share the complete log on ESP32. Thank you.
Top
esp-jc
Espressif staff
Espressif staff
Posts: 7
Joined: Tue Jun 14, 2022 6:20 am

Re: ESP32 task corruption when playing A2DP

Postby esp-jc » Mon Nov 10, 2025 2:29 am

We have fixed an issue in the internal Bluetooth library that could cause a crash related to r_rwbtdm_isr_wrapper with 32768. Below is the updated Bluetooth library. Please follow the steps below to switch your project to use the new library:

Replace components/bt/controller/lib_esp32/esp32/libbtdm_app.a with the new library provided in the attachment.

Add the following lines to components/esp_rom/esp32/ld/esp32.rom.ld:

Code: Select all

PROVIDE ( ld_acl_afh_apply = 0x40030e94 );
PROVIDE ( ld_acl_afh_switch_on_cbk = 0x40030fa8 );
PROVIDE ( ld_acl_afh_switch_off_cbk = 0x400310c4 );

The provided library includes debug information. If the r_rwbtdm_isr_wrapper with 32768 crash occurs again, please share the complete ESP32-side log. Thank you.
Attachments
libbtdm_app.zip
(271.69 KiB) Downloaded 33 times
Top
sb_dabs
Posts: 2
Joined: Mon Oct 13, 2025 12:02 pm

Re: ESP32 task corruption when playing A2DP

Postby sb_dabs » Mon Nov 17, 2025 10:11 am

Appreciate the fix, we haven't seen the issue since applying the patch, but it was also not easy to reproduce in the first place.

The other coredumps we still agree is not related to the channel mapping problem.
Currently, we've switched to a unicore approach and have stopped seeing the problems, while our multicore builds still have the problem (we're running parallel tests to narrow this), but it'll have to be a separate thread / solution than this.

Thanks for the assistance, and we'll consider this particular problem closed for now.
Top
Post Reply

Return to “ESP-IDF”

Who is online

Users browsing this forum: Bing [Bot], ChatGPT-User, Google [Bot] and 4 guests