Hard system lockup during Wi-Fi roam (mt7925e list_add corruption) — ~35h after BIOS 3.02 → 3.05 update

System

  • Framework Desktop, AMD Ryzen AI MAX+ 395 w/ Radeon 8060S
  • BIOS/firmware updated via fwupd/LVFS: 0.0.3.2 → 0.0.3.5, completed 2026-07-14 13:57:24 (High urgency update)
  • OS: NixOS, kernel 7.1.0-NixOS (#1-NixOS SMP PREEMPT_DYNAMIC, built 2026-06-14)
  • Wi-Fi: MediaTek MT7925 (RZ717), Wi-Fi 7, mt7925e driver

What happened

About a day and a half after updating to BIOS 3.05, the machine hard-locked overnight (2026-07-16, 01:06:17 local) while completely unattended. When I came back to it: chassis power LED and keyboard backlight were both on, fans presumably still spinning, but zero video output on any monitor, and it was fully unresponsive to keyboard/mouse. Had to hold the power button to force a reset.

I was able to confirm from the systemd journal of the previous boot that this was a genuine kernel-level lockup, not a sleep/power issue — the machine was mid-task (several background processes actively running, one of them making live SSH calls to a second machine over Thunderbolt networking) right up to the exact second logging stopped, with no orderly shutdown sequence. A second machine on the same LAN independently logged its link to this one dropping at the identical timestamp, confirming this box went totally unresponsive network-wide, instantaneously — not a partial GPU/display-only fault, and not a mains power cut (a real power loss would have taken the LEDs down too).

The trigger, right before the freeze — a routine same-SSID band-steering roam (2.4GHz AP → 5GHz AP on my own router, nothing unusual):

kernel: wlp192s0: disconnect from AP 68:a3:78:d3:41:f4 for new auth to 8c:97:ea:fe:fa:e0
kernel: wlp192s0: authenticate with 8c:97:ea:fe:fa:e0 (local address=ac:f2:3c:35:1e:d1)
kernel: wlp192s0: send auth to 8c:97:ea:fe:fa:e0 (try 1/3)
kernel:  slab kmalloc-rnd-08-8k start ffff89f338cca000 pointer offset 4176 size 8192
kernel: list_add corruption. prev->next should be next (ffff89e125138908), but was ffff89f338ccb050. (prev=ffff89f338ccb050).
kernel: ------------[ cut here ]------------
kernel: kernel BUG at lib/list_debug.c:32!

That kernel BUG line is the last thing the journal has — no register dump, no call trace, nothing after it. It looks like the list_add corruption check fired inside a locked context (list operations here are typically under rtnl_lock), and the BUG trap froze the kernel outright rather than completing a clean oops/panic — which matches the “on but dead” symptom exactly.

What I’ve ruled out:

  • Mains power loss — LEDs stayed lit, no UPS involved, doesn’t fit
  • A scheduled OS update job — it was scheduled for later and never got the chance to run
  • Any suspend/sleep action on my end — nothing suspend-related was in flight, just a routine display-off hotkey earlier in the evening (compositor-level monitor blanking only, no networking interaction, and it wasn’t even active at time of crash)

What I don’t know, and am asking here: is this a known issue with the MT7925/RZ717 (mt7925e) roaming path on Strix Halo boards? Did 3.05 touch anything WiFi-adjacent — PCIe ASPM/power states, USB4/TB, or power delivery timing that could make an existing upstream mt7925e race more likely to trigger? Has anyone else seen list_add corruption / hard lockups from this chipset since updating?

I’d like to avoid a repeat of “silently dead until someone finds it,” so in the meantime I’m adding a hardware watchdog so a future full lockup triggers an automatic reboot instead of requiring a manual power-cycle — but I’d rather fix the root cause than just paper over it. Happy to pull more logs (journalctl -k, dmesg, fwupdmgr get-details on the 3.05 release notes, etc.) if that helps triage.

1 Like

I’m just debugging a crash this morning that looks a lot like this. Nearly identical setup.

  • Framework Desktop, AMD RYZEN AI MAX+ 395 w/ Radeon 8060S
  • BIOS 0.0.3.4
  • OS: NixOS, 7.1.0 (#1-NixOS SMP PREEMPT_DYNAMIC, built 2026-06-14)
  • Wi-Fi: MediaTek MT7925 mt7925e (not sure on the other details)

As a bandaid, I did add boot.kernelParams = [ "panic=20" ]; to auto-reboot after a panic instead of hanging like that.


I grabbed from pstore sudo cat /var/lib/systemd/pstore/1784462391/001/dmesg.txt

<6>[165353.509654] wlp192s0: disconnect from AP 62:7f:54:d2:fd:f1 for new auth to c8:7f:54:c0:65:34
<6>[165353.625907] wlp192s0: authenticate with c8:7f:54:c0:65:34 (local address=c4:13:75:1a:a1:d9)
<6>[165353.637665] wlp192s0: send auth to c8:7f:54:c0:65:34 (try 1/3)
<4>[165353.643385]  slab kmalloc-rnd-09-8k start ffff899ada732000 pointer offset 4176 size 8192
<3>[165353.643392] list_add corruption. prev->next should be next (ffff8991a2c98908), but was ffff899ada733050. (prev=f
fff899ada733050).
Oops#1 Part3
<4>[165353.643402] ------------[ cut here ]------------
<2>[165353.643402] kernel BUG at lib/list_debug.c:32!
<4>[165353.643412] Oops: invalid opcode: 0000 [#1] SMP NOPTI
<4>[165353.643415] CPU: 0 UID: 0 PID: 1376 Comm: napi/phy0-0 Not tainted 7.1.0 #1-NixOS PREEMPT(lazy)
<4>[165353.643417] Hardware name: Framework Desktop (AMD Ryzen AI Max 300 Series)/FRANMFCP06, BIOS 03.04 11/19/2025
<4>[165353.643419] RIP: 0010:__list_add_valid_or_report+0x7e/0xb0
<4>[165353.643424] Code: 68 dd fd ff 90 0f 0b 48 39 16 74 20 48 89 f7 e8 28 0e 3f 00 48 8b 13 48 89 d9 48 89 ee 48 c7 c
7 58 76 90 b9 e8 43 dd fd ff 90 <0f> 0b 48 39 f7 74 05 48 39 d7 75 18 48 89 fe 48 89 e9 48 89 da 48
<4>[165353.643426] RSP: 0018:ffffd1bf42387c90 EFLAGS: 00010246
<4>[165353.643427] RAX: 0000000000000075 RBX: ffff899ada733050 RCX: 0000000000000027
<4>[165353.643428] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff89b01d81ea80
<4>[165353.643429] RBP: ffff8991a2c98908 R08: 0000000000000000 R09: 3fffffffffffdfff
<4>[165353.643429] R10: ffffffffba25d580 R11: ffffd1bf42387b40 R12: ffff8990a1960040
<4>[165353.643430] R13: 0000000000000000 R14: ffff8991a2c92120 R15: ffff8991a2c921a0
<4>[165353.643431] FS:  0000000000000000(0000) GS:ffff89b062ad6000(0000) knlGS:0000000000000000
<4>[165353.643431] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
<4>[165353.643432] CR2: 00007930811cbcd4 CR3: 000000016023c000 CR4: 0000000000f50ef0
<4>[165353.643433] PKRU: 55555554
<4>[165353.643433] Call Trace:
<4>[165353.643435]  <TASK>
<4>[165353.643440]  mt76_wcid_add_poll.cold+0xc/0x15 [mt76]
<4>[165353.643448]  mt7925_mac_add_txs.part.0+0x92/0xa0 [mt7925_common]
Oops#1 Part2
<4>[165353.643453]  mt7925_rx_check+0xa7/0xc0 [mt7925_common]
<4>[165353.643455]  mt76_dma_rx_poll+0x4a2/0x6d0 [mt76]
<4>[165353.643461]  mt792x_poll_rx+0x52/0xe0 [mt792x_lib]
<4>[165353.643466]  __napi_poll+0x30/0x1f0
<4>[165353.643470]  napi_threaded_poll_loop+0x214/0x260
<4>[165353.643471]  ? __pfx_napi_threaded_poll+0x10/0x10
<4>[165353.643472]  napi_threaded_poll+0xdf/0x120
<4>[165353.643473]  kthread+0xe2/0x110
<4>[165353.643477]  ? __pfx_kthread+0x10/0x10
<4>[165353.643478]  ret_from_fork+0x251/0x330
<4>[165353.643481]  ? __pfx_kthread+0x10/0x10
<4>[165353.643482]  ret_from_fork_asm+0x1a/0x30
<4>[165353.643485]  </TASK>

I think this is happening with the roam like you said. Again band-aid, but I’m gonna try pinning my connection to prevent roaming for now and see if it helps.