Re: [REGRESSION] iwlwifi 8265 firmware ADVANCED_SYSASSERT in PHY_CONTEXT_CMD on roam (v7.0.3..v7.0.5)

Hi,

A few clarifications and additional data points after another working
day on 7.0.5 and after testing a recovery script — please take these
as a correction to the initial report:

1. The bug is INTERMITTENT on the roam path, not deterministic. My
initial phrasing ("every controller-initiated roam") was too strong.
Empirically across 16 observed roams: 14 crashed, 2 passed clean
(2026-05-13 11:19:23 and ~12:48). Crash probability ~87%, not 100%.

2. Some firmware crashes fire WITHOUT an immediately preceding
`disconnect from AP <a> for new auth to <b>` line in the kernel
journal: 2026-05-13 11:31:13, 12:04:28, 12:04:32, 12:18:18. These
may be background firmware events not surfaced via mac80211 mlme
tracing, or roam steering happening at a layer that mac80211 does
not log.

3. Manual `modprobe -r iwlmvm iwlwifi && modprobe iwlwifi` followed by
`nmcli connection up <SSID>` does recover the radio reliably in
~15 s when the cascading restart loop leaves Wi-Fi unusable. It
does NOT prevent future crashes (the next roam still asserts
firmware), but it's a working clean-up. Useful when the in-driver
SW reset loop fails to converge.

4. Open diagnostic question: whether the clean-roam cases differ in
any observable PHY parameter. The two clean events here both
landed on 2.4 GHz channel 9 (de:2c:6e:8f:59:ef and ce:2d:e0:be:4d:93)
but most crashing roams are also 2.4 GHz, so band/channel alone
isn't the discriminator. Auth state, BA/AMPDU state, or in-flight
command queue depth at the moment of binding are candidates.

These have also been posted as comments on the two Bugzilla trackers:
- https://bugzilla.kernel.org/show_bug.cgi?id=221512 (comment posted today)
- https://bugzilla.suse.com/show_bug.cgi?id=1264804 (comment posted today)

Still happy to test debug patches.

Thanks,
Branislav Klocok

*-- *
S pozdravom / Best regards
*Branislav Klocok *
*generálny riaditeľ / general director *


* OFZ, a.s.*
Mobil: 	*+421 908 703 366*
Tel: 	*+421 43 5804 488 *
e-mail: 	**[email protected]* <mailto:[email protected]> *
web: 	**www.ofz.company* <http://www.ofz.company> *


ofz logo

Dňa 13. 5. 2026 o 12:35 Branislav Klocok napísal(a):
> Hi,
>
> I would like to report a regression in stable kernel 7.0.x affecting
> iwlwifi on Intel Wireless-AC 8265. Bug filed at
> https://bugzilla.kernel.org/show_bug.cgi?id=221512 
> (network-wireless-intel)
> and openSUSE Bugzilla https://bugzilla.suse.com/show_bug.cgi?id=1264804.
>
> #regzbot introduced: v7.0.3..v7.0.5
> #regzbot link: https://bugzilla.kernel.org/show_bug.cgi?id=221512
> #regzbot link: https://bugzilla.suse.com/show_bug.cgi?id=1264804
>
> Summary: every controller-initiated roam between BSSIDs of the same
> enterprise ESSID triggers a firmware microcode assertion
> (`ADVANCED_SYSASSERT` / `NMI_INTERRUPT_LMAC_FATAL` / `FW error in SYNC
> CMD PHY_CONTEXT_CMD`). Driver SW-resets and re-associates in about
> 4 s, but some triggers send the driver into a cascading restart loop
> (observed 6 firmware errors in 23 s, twice in a single session).
> Identical hardware, firmware blob (`8265-36.ucode` v36.c8e8e144.0),
> network and userspace worked correctly on 7.0.3.
>
> I personally booted only 7.0.3 (good) and 7.0.5 (bad); 7.0.4 was
> installed but not run. The 7.0.5 stable changelog contains no
> iwlwifi/mac80211/cfg80211 commits, so the regression most likely sits
> in the 7.0.4 batch.
>
> Crash backtrace fragment:
>
> iwlwifi 0000:02:00.0: 0x000014FD | ADVANCED_SYSASSERT
> iwlwifi 0000:02:00.0: 0x00000070 | NMI_INTERRUPT_LMAC_FATAL
> iwlwifi 0000:02:00.0: FW error in SYNC CMD PHY_CONTEXT_CMD
> CPU: 2 UID: 0 PID: 1527 Comm: wpa_supplicant
> iwl_trans_pcie_send_hcmd+0x402/0x410 [iwlwifi]
> iwl_trans_send_cmd+0x3e/0xa0 [iwlwifi]
> ? nl80211_authenticate+0x373/0x400 [cfg80211]
> nl80211_authenticate+0x38d/0x400 [cfg80211]
> iwlwifi 0000:02:00.0: PHY ctxt cmd error. ret=-5
>
> Workarounds tested and rejected:
> - `802-11-wireless.powersave=2` (CAM) — does not prevent the crash;
> client still receives steering and firmware still asserts on
> `PHY_CONTEXT_CMD`.
> - `modprobe -r iwlmvm iwlwifi && modprobe iwlwifi` — temporary
> recovery only; next roam reproduces the crash.
>
> The only known mitigation is staying on 7.0.3 or avoiding networks
> with controller-driven band/load steering.
>
> I am happy to test patches against the affected hardware and network.
> Full filtered kernel log (3329 lines, both cascading restart loops)
> is attached to the bugzilla.kernel.org bug.
>
> Hardware:
> - Intel Wireless-AC 8265 [8086:24fd] rev 78, subsys [8086:0010]
> - ThinkPad, openSUSE Tumbleweed (rolling) snapshot 20260509
> - kernel-firmware-iwlwifi 20260331-1.1
> - NetworkManager 1.54.3-3.4, wpa_supplicant 2.11-6.3
>
> Thanks,
> Branislav Klocok
> *-- *
> S pozdravom / Best regards
> *Branislav Klocok *
> *generálny riaditeľ / general director *
>
>
> * OFZ, a.s.*
> Mobil: 	*+421 908 703 366*
> Tel: 	*+421 43 5804 488 *
> e-mail: 	**[email protected]* <mailto:[email protected]> *
> web: 	**www.ofz.company* <http://www.ofz.company> *
>
>
> ofz logo
>