[1.] One line summary:

Kernel Oops in hidinput_hid_event during rapid typing on Apple Aluminum Bluetooth Keyboard

[2.] Full description of the problem/report:

System experiences a kernel NULL pointer dereference (Oops) when typing 

rapidly on an Apple Aluminum Bluetooth Keyboard (Aluminium Wireless Keyboard,

model A1314). The crash occurs in hidinput_hid_event+0x321 and causes complete 

system lockup requiring hard reboot.

The keyboard is connected via Bluetooth through a Broadcom BCM20702A0 dongle 

(USB ID 0a5c:21e8). The hid-apple driver is properly loaded and bound to the

keyboard. The crash is reproducible during fast typing, particularly when

multiple keys are pressed in quick succession.

Steps to reproduce:

1. Pair Apple Aluminum Keyboard with system via Bluetooth Broadcom dongle

2. Verify hid-apple driver is bound (confirmed via /sys/bus/hid/devices/*/driver)

3. Type quickly and continuously on the keyboard

4. Within 30-60 seconds of rapid typing, kernel crashes with Oops

5. Bluetooth subsystem becomes unresponsive, requires hard power cycle

Note: The crash occurs even when the generic HID driver is forced; the 

issue persists with both hid-generic and hid-apple.

[3.] Keywords:

HID, apple, keyboard, bluetooth, Oops, NULL pointer, hidinput_hid_event

[4.] Kernel version:

7.1.0-rc2-custom #1 SMP PREEMPT_DYNAMIC Tue May 5 09:34:05 CEST 2026

[5.] Most recent kernel version which did NOT have the bug:

Unknown — this is a custom kernel based on 7.1.0-rc2. The issue may be present 

in mainline as well.

[6.] Output of Oops message with symbolic information resolved:

[7.] Small shell script or example program which triggers the problem:

No script needed — rapid typing on the keyboard for 30-60 seconds triggers 

the crash. No special application required.

[8.] Environment

[8.1.] Software:

Distribution: Void Linux

Kernel: 7.1.0-rc2-custom (self-built)

Driver: hid-apple (bound to keyboard), btusb (Bluetooth)

[8.2.] Processor information:processor

cpu: 0

vendor_id : GenuineIntel

cpu family : 6

model : 61

model name : Intel(R) Core(TM) i3-5005U CPU @ 2.00GHz

stepping : 4

microcode : 0x24

cpu MHz : 1696.096

cache size : 3072 KB

physical id : 0

siblings : 4

core id : 0

cpu cores : 2

apicid : 0

initial apicid : 0

fpu : yes

fpu_exception : yes

cpuid level : 20

wp : yes

flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf pni pclmulqdq dtes64 monitor ds_cpl vmx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb tpr_shadow flexpriority ept vpid ept_ad fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid rdseed adx smap intel_pt xsaveopt dtherm arat pln pts vnmi

vmx flags : vnmi preemption_timer invvpid ept_x_only ept_ad ept_1gb flexpriority tsc_offset vtpr mtf vapic ept vpid unrestricted_guest ple ept_violation_ve

bugs : cpu_meltdown spectre_v1 spectre_v2 spec_store_bypass l1tf mds swapgs itlb_multihit srbds spectre_v2_user old_microcode vmscape

bogomips : 3990.76

clflush size : 64

cache_alignment : 64

address sizes : 39 bits physical, 48 bits virtual

power management:

CPU: 

Hardware: BESSTAR (HK) LIMITED U500-H/VB9, BIOS 0.010 04/07/2020

[8.3.] Module information:

hid-apple, hid-generic, btusb, bluetooth, hid

[8.4.] USB information:

Bus 002 Device 002: ID 0a5c:21e8 Broadcom Corp. BCM20702A0 Bluetooth 4.0

Bus 002 Device 005: ID 8087:0a2a Intel Corp. Bluetooth wireless interface (disabled) the bug occurs when this controler is used as well.

[8.5.] Bluetooth controller information:

Controller 5C:F3:70:A2:F8:56 (public) — Broadcom dongle

Keyboard MAC: 10:94:BB:AE:04:64

[9.] Other notes:

Additional observations:

- The crash occurs more frequently during RAPID typing. Normal-speed typing (30-40 WPM) 

  does not seem to trigger the crash as much.

- The mouse (Bluetooth Mouse 4.0) does not cause crashes even during rapid 

  movement.

- The internal Intel Bluetooth adapter is disabled via udev rule; only the 

  Broadcom dongle is active.

- The hid-apple driver is confirmed to be bound to the keyboard:

  /sys/bus/hid/devices/0005:004C:026C.0007/driver -> ../../../../../bus/hid/drivers/apple

Potential related issues:

- This Oops appears similar to historical HID bugs where feature reports 

  without hidinput pointers cause NULL dereferences[citation:1]

- The crash address ffffffffffffffe4 suggests an offset from NULL (0 - 0x1c)

Workarounds attempted (none fully successful):

1. Switching between hid-apple and hid-generic drivers

2. Disabling KernelExperimental = true in /etc/bluetooth/main.conf

3. Using different Bluetooth adapter (Broadcom vs internal Intel)

[X.] Other notes:

I am willing to test patches and provide additional debugging information.

The crash is fairly reproducible on demand within 10-20 minutes of testing.

Regards,

Michel Barthelemy

Attached: Full .config and useful data dumps