[REGRESSION] iwlwifi 8265 firmware ADVANCED_SYSASSERT in PHY_CONTEXT_CMD on roam (v7.0.3..v7.0.5)

[Branislav Klocok <branislav.klocok@ofz.sk>]

[-- Attachment #1.1: Type: text/plain, Size: 2860 bytes --]

Hi,

I would like to report a regression in stable kernel 7.0.x affecting
iwlwifi on Intel Wireless-AC 8265. Bug filed at
https://bugzilla.kernel.org/show_bug.cgi?id=221512 (network-wireless-intel)
and openSUSE Bugzilla https://bugzilla.suse.com/show_bug.cgi?id=1264804.

#regzbot introduced: v7.0.3..v7.0.5
#regzbot link: https://bugzilla.kernel.org/show_bug.cgi?id=221512
#regzbot link: https://bugzilla.suse.com/show_bug.cgi?id=1264804

Summary: every controller-initiated roam between BSSIDs of the same
enterprise ESSID triggers a firmware microcode assertion
(`ADVANCED_SYSASSERT` / `NMI_INTERRUPT_LMAC_FATAL` / `FW error in SYNC
CMD PHY_CONTEXT_CMD`). Driver SW-resets and re-associates in about
4 s, but some triggers send the driver into a cascading restart loop
(observed 6 firmware errors in 23 s, twice in a single session).
Identical hardware, firmware blob (`8265-36.ucode` v36.c8e8e144.0),
network and userspace worked correctly on 7.0.3.

I personally booted only 7.0.3 (good) and 7.0.5 (bad); 7.0.4 was
installed but not run. The 7.0.5 stable changelog contains no
iwlwifi/mac80211/cfg80211 commits, so the regression most likely sits
in the 7.0.4 batch.

Crash backtrace fragment:

iwlwifi 0000:02:00.0: 0x000014FD | ADVANCED_SYSASSERT
iwlwifi 0000:02:00.0: 0x00000070 | NMI_INTERRUPT_LMAC_FATAL
iwlwifi 0000:02:00.0: FW error in SYNC CMD PHY_CONTEXT_CMD
CPU: 2 UID: 0 PID: 1527 Comm: wpa_supplicant
iwl_trans_pcie_send_hcmd+0x402/0x410 [iwlwifi]
iwl_trans_send_cmd+0x3e/0xa0 [iwlwifi]
? nl80211_authenticate+0x373/0x400 [cfg80211]
nl80211_authenticate+0x38d/0x400 [cfg80211]
iwlwifi 0000:02:00.0: PHY ctxt cmd error. ret=-5

Workarounds tested and rejected:
- `802-11-wireless.powersave=2` (CAM) — does not prevent the crash;
client still receives steering and firmware still asserts on
`PHY_CONTEXT_CMD`.
- `modprobe -r iwlmvm iwlwifi && modprobe iwlwifi` — temporary
recovery only; next roam reproduces the crash.

The only known mitigation is staying on 7.0.3 or avoiding networks
with controller-driven band/load steering.

I am happy to test patches against the affected hardware and network.
Full filtered kernel log (3329 lines, both cascading restart loops)
is attached to the bugzilla.kernel.org bug.

Hardware:
- Intel Wireless-AC 8265 [8086:24fd] rev 78, subsys [8086:0010]
- ThinkPad, openSUSE Tumbleweed (rolling) snapshot 20260509
- kernel-firmware-iwlwifi 20260331-1.1
- NetworkManager 1.54.3-3.4, wpa_supplicant 2.11-6.3

Thanks,
Branislav Klocok
*-- *
S pozdravom / Best regards
*Branislav Klocok *
*generálny riaditeľ / general director *


* OFZ, a.s.*
Mobil: 	*+421 908 703 366*
Tel: 	*+421 43 5804 488 *
e-mail: 	**branislav.klocok@ofz.sk* <mailto:branislav.klocok@ofz.sk> *
web: 	**www.ofz.company* <http://www.ofz.company> *


ofz logo


[-- Attachment #1.2.1: Type: text/html, Size: 6169 bytes --]

[-- Attachment #1.2.2: WdtYKUGW07EU0N07.png --]
[-- Type: image/png, Size: 4675 bytes --]

[-- Attachment #2: Kryptografický podpis S/MIME --]
[-- Type: application/pkcs7-signature, Size: 4669 bytes --]