Help Needed: Kernel Panic on Acer Predator W6 When Disconnecting from 5G

Hello everyone,

I'm facing a recurring issue with my Acer Predator W6 experiencing kernel panics specifically when I disconnect from 5G. This issue persists across various builds:

  • Release 23.05.3 or Snapshot Release, Default Build or Custom Build
  • Affected Card is the MT7986 802.11ac/ax/n, 5 Ghz

Has anyone encountered a similar problem or can offer any insights on a possible fix? Your expertise would be greatly appreciated!

Thank you!

Crash Log:

2024-04-23T11:15:25+00:00 AP_MASTER hostapd: phy2-ap0: AP-STA-DISCONNECTED 04:33:c2:67:0a:de
2024-04-23T11:15:25+00:00 AP_MASTER hostapd: phy2-ap0: STA 04:33:c2:67:0a:de WPA: event 3 notification
2024-04-23T11:15:26+00:00 AP_MASTER hostapd: phy2-ap0: STA 04:33:c2:67:0a:de IEEE 802.1X: unauthorizing port
2024-04-23T11:15:26+00:00 AP_MASTER hostapd: phy2-ap0: STA 04:33:c2:67:0a:de IEEE 802.11: deauthenticated
2024-04-23T11:15:26+00:00 AP_MASTER hostapd: phy2-ap0: STA 04:33:c2:67:0a:de MLME: MLME-DEAUTHENTICATE.indication(04:33:c2:67:0a:de, 1)
2024-04-23T11:15:26+00:00 AP_MASTER hostapd: phy2-ap0: STA 04:33:c2:67:0a:de MLME: MLME-DELETEKEYS.request(04:33:c2:67:0a:de)
[  276.141410] Unable to handle kernel read from unreadable memory at virtual address 0000000000000024
[  276.150448] Mem abort info:
[  276.153239]   ESR = 0x0000000096000005
[  276.156972]   EC = 0x25: DABT (current EL), IL = 32 bits
[  276.162269]   SET = 0, FnV = 0
[  276.165308]   EA = 0, S1PTW = 0
[  276.168432]   FSC = 0x05: level 1 translation fault
[  276.173297] Data abort info:
[  276.176162]   ISV = 0, ISS = 0x00000005
[  276.179980]   CM = 0, WnR = 0
[  276.182937] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000045c8f000
[  276.189357] [0000000000000024] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000
[  276.198041] Internal error: Oops: 0000000096000005 [#1] SMP
[  276.203595] Modules linked in: nft_fib_inet nf_flow_table_inet nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject nft_redir nft_quota nft_objref nft_numgen nft_nat nft_masq nft_log nft_limit nft_hash nft_flow_offload nft_f
ib_ipv6 nft_fib_ipv4 nft_fib nft_ct nft_chain_nat nf_tables nf_nat nf_flow_table nf_conntrack mt7915e mt76_connac_lib mt76 mac80211 cfg80211 nfnetlink nf_reject_ipv6 nf_reject_ipv4 nf_log_syslog nf_defrag_ipv6 nf_defrag_ipv4 libcrc32
c compat crypto_safexcel sha512_arm64 sha1_ce sha1_generic seqiv md5 des_generic libdes authencesn authenc leds_gpio xhci_plat_hcd xhci_pci xhci_mtk_hcd xhci_hcd gpio_button_hotplug usbcore usb_common aquantia
[  276.262369] CPU: 3 PID: 1432 Comm: hostapd Not tainted 6.1.86 #0
[  276.268358] Hardware name: Acer Predator W6 (DT)
[  276.272957] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[  276.279897] pc : mt76_wcid_cleanup+0x84/0x21c [mt76]
[  276.284860] lr : mt76_wcid_cleanup+0x64/0x21c [mt76]
[  276.289812] sp : ffffffc009c73710
[  276.293110] x29: ffffffc009c73710 x28: ffffff8000b01780 x27: ffffffc009c73dc8
[  276.300226] x26: ffffff80000a4880 x25: ffffffc008c72d00 x24: 0000000000000001
[  276.307342] x23: ffffffc000ab3144 x22: 0000000000000000 x21: ffffff800581ace8
[  276.314458] x20: ffffffc009c73758 x19: ffffff8004a62000 x18: 0000000000000028
[  276.321574] x17: 0000000000000000 x16: 00000000000005c8 x15: 0000000000000250
[  276.328689] x14: ffffff800581ae50 x13: ffffff800581ae50 x12: 0000000000000000
[  276.335804] x11: 0000000000000040 x10: 0000000000000000 x9 : ffffff800581ae50
[  276.342920] x8 : 0000000000000000 x7 : 0800000000000000 x6 : 0000000000000000
[  276.342920] x8 : 0000000000000000 x7 : 0800000000000000 x6 : 0000000000000000
[  276.350035] x5 : ffffffc000afda30 x4 : 0000000000000000 x3 : 0000000000000001
[  276.357151] x2 : 0000000000000000 x1 : ffffff8000b01780 x0 : 0000000000000024
[  276.364267] Call trace:
[  276.366698]  mt76_wcid_cleanup+0x84/0x21c [mt76]
[  276.371304]  __mt76_sta_remove+0x70/0xbc [mt76]
[  276.375823]  mt76_sta_state+0x8c/0x2f4 [mt76]
[  276.380168]  mt7915_eeprom_get_power_delta+0x1424/0x23d0 [mt7915e]
[  276.386335]  drv_sta_state+0x250/0x2f4 [mac80211]
[  276.391055]  ieee80211_sta_eosp+0x598/0x674 [mac80211]
[  276.396193]  sta_set_sinfo+0xc24/0xd50 [mac80211]
[  276.400898]  sta_info_destroy_addr_bss+0x50/0x70 [mac80211]
[  276.406468]  ieee80211_color_change_finish+0x1ab8/0x1da0 [mac80211]
[  276.412732]  cfg80211_check_station_change+0x11c0/0x3370 [cfg80211]
[  276.418993]  genl_family_rcv_msg_doit+0xb4/0x110
[  276.423596]  genl_rcv_msg+0x104/0x220
[  276.427243]  netlink_rcv_skb+0x58/0x120
[  276.431062]  genl_rcv+0x34/0x4c
[  276.434189]  netlink_unicast+0x1e0/0x2d0
[  276.438094]  netlink_sendmsg+0x198/0x3c0
[  276.442000]  ____sys_sendmsg+0x1c0/0x260
[  276.445910]  ___sys_sendmsg+0x78/0xc0
[  276.449559]  __sys_sendmsg+0x44/0xa0
[  276.453120]  __arm64_sys_sendmsg+0x20/0x30
[  276.457202]  invoke_syscall.constprop.0+0x4c/0xe0
[  276.461891]  do_el0_svc+0x40/0xd0
[  276.465190]  el0_svc+0x14/0x4c
[  276.468231]  el0t_64_sync_handler+0x10c/0x120
[  276.472571]  el0t_64_sync+0x14c/0x150
[  276.476222] Code: d2800002 910092c0 52800023 f9800011 (885f7c01)
[  276.482295] ---[ end trace 0000000000000000 ]---
[  276.491393] Kernel panic - not syncing: Oops: Fatal exception in interrupt
[  276.498247] SMP: stopping secondary CPUs
[  276.502155] Kernel Offset: disabled
[  276.505627] CPU features: 0x00000,00000004,0000400b
[  276.510487] Memory Limit: none
[  276.517922] Rebooting in 3 seconds..

Regular Log (from the 2.4 Ghz Interface):

2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de IEEE 802.11: start SAE authentication (RX commit, status=126 (SAE_HASH_TO_ELEMENT))
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de IEEE 802.11: SAE authentication (RX confirm, status=0 (SUCCESS))
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de MLME: MLME-AUTHENTICATE.indication(04:33:c2:67:0a:de, unknown)
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de MLME: MLME-DELETEKEYS.request(04:33:c2:67:0a:de)
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de IEEE 802.11: association OK (aid 1)
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de IEEE 802.11: associated (aid 1)
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de MLME: MLME-ASSOCIATE.indication(04:33:c2:67:0a:de)
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de MLME: MLME-DELETEKEYS.request(04:33:c2:67:0a:de)
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de IEEE 802.11: binding station to interface 'phy0-ap0'
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de WPA: event 1 notification
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de WPA: start authentication
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de IEEE 802.1X: unauthorizing port
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de WPA: sending 1/4 msg of 4-Way Handshake
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: STA-OPMODE-SMPS-MODE-CHANGED 04:33:c2:67:0a:de off
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de WPA: received EAPOL-Key frame (2/4 Pairwise)
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de WPA: sending 3/4 msg of 4-Way Handshake
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de WPA: received EAPOL-Key frame (4/4 Pairwise)
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: AP-STA-CONNECTED 04:33:c2:67:0a:de auth_alg=sae
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de IEEE 802.1X: authorizing port
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de RADIUS: starting accounting session 6A9969AD0CCEFB6F
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de WPA: pairwise key handshake completed (RSN)
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: EAPOL-4WAY-HS-COMPLETED 04:33:c2:67:0a:de
2024-04-23T11:45:50+00:00 AP_MASTER hostapd: phy0-ap0: AP-STA-DISCONNECTED 04:33:c2:67:0a:de
2024-04-23T11:45:50+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de WPA: event 3 notification
2024-04-23T11:45:50+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de IEEE 802.1X: unauthorizing port
2024-04-23T11:45:50+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de IEEE 802.11: deauthenticated
2024-04-23T11:45:50+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de MLME: MLME-DEAUTHENTICATE.indication(04:33:c2:67:0a:de, 1)
2024-04-23T11:45:50+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de MLME: MLME-DELETEKEYS.request(04:33:c2:67:0a:de)

/etc/config/wireless:

2.4 Ghz (working)
config wifi-device 'radio0'
        option type 'mac80211'
        option path 'soc/11280000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
        option channel 'auto'
        option band '2g'
        option htmode 'HE40'
        option cell_density '0'
        option country 'CH'
        option log_level '0'
config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'hotspot'
        option encryption 'sae-mixed'
        option key 'password'

5 Ghz (crashing)
config wifi-device 'radio2'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi'
        option channel 'auto'
        option band '5g'
        option htmode 'HE160'
        option country 'CH'
        option cell_density '1'
        option log_level '0'
        option disabled '1'
config wifi-iface 'default_radio2'
        option device 'radio2'
        option network 'lan'
        option mode 'ap'
        option ssid 'hotspot'
        option encryption 'sae-mixed'
        option key 'password'
        option disabled '1'

hostapd config:

2.4 Ghz (working)
driver=nl80211
logger_syslog=127
logger_syslog_level=0
logger_stdout=127
logger_stdout_level=0
country_code=CH
ieee80211d=1
hw_mode=g
supported_rates=60 90 120 180 240 360 480 540
basic_rates=60 120 240
beacon_int=100
channel=acs_survey
#num_global_macaddr=1
ieee80211n=1
ht_coex=0
ht_capab=[HT40+][LDPC][SHORT-GI-20][SHORT-GI-40][TX-STBC][RX-STBC1][MAX-AMSDU-7935]
ieee80211ax=1
he_su_beamformer=1
he_su_beamformee=1
he_mu_beamformer=1
he_bss_color=128
he_spr_sr_control=3
he_default_pe_duration=4
he_rts_threshold=1023
he_mu_edca_qos_info_param_count=0
he_mu_edca_qos_info_q_ack=0
he_mu_edca_qos_info_queue_request=0
he_mu_edca_qos_info_txop_request=0
he_mu_edca_ac_be_aifsn=8
he_mu_edca_ac_be_aci=0
he_mu_edca_ac_be_ecwmin=9
he_mu_edca_ac_be_ecwmax=10
he_mu_edca_ac_be_timer=255
he_mu_edca_ac_bk_aifsn=15
he_mu_edca_ac_bk_aci=1
he_mu_edca_ac_bk_ecwmin=9
he_mu_edca_ac_bk_ecwmax=10
he_mu_edca_ac_bk_timer=255
he_mu_edca_ac_vi_ecwmin=5
he_mu_edca_ac_vi_ecwmax=7
he_mu_edca_ac_vi_aifsn=5
he_mu_edca_ac_vi_aci=2
he_mu_edca_ac_vi_timer=255
he_mu_edca_ac_vo_aifsn=5
he_mu_edca_ac_vo_aci=3
he_mu_edca_ac_vo_ecwmin=5
he_mu_edca_ac_vo_ecwmax=7
he_mu_edca_ac_vo_timer=255
interface=phy0-ap0
ctrl_interface=/var/run/hostapd
ap_isolate=1
bss_load_update_period=60
chan_util_avg_period=600
disassoc_low_ack=1
skip_inactivity_poll=0
preamble=1
wmm_enabled=1
ignore_broadcast_ssid=0
uapsd_advertisement_enabled=1
utf8_ssid=1
multi_ap=0
sae_require_mfp=1
sae_pwe=2
wpa_passphrase=password
wpa_psk_file=/var/run/hostapd-phy0-ap0.psk
auth_algs=1
wpa=2
wpa_pairwise=CCMP
ssid=ssid
bridge=br-lan
wds_bridge=
snoop_iface=br-lan
wpa_disable_eapol_key_retries=0
wpa_key_mgmt=WPA-PSK WPA-PSK-SHA256 SAE
okc=1
ieee80211w=1
group_mgmt_cipher=AES-128-CMAC
dynamic_vlan=0
vlan_naming=1
vlan_no_bridge=1
vlan_file=/var/run/hostapd-phy0-ap0.vlan
qos_map_set=0,0,2,16,1,1,255,255,18,22,24,38,40,40,44,46,48,56
bssid=c0:18:50:de:39:2b
#default_macaddr

5 Ghz (Crashing)
driver=nl80211
logger_syslog=127
logger_syslog_level=0
logger_stdout=127
logger_stdout_level=0
country_code=CH
ieee80211d=1
ieee80211h=1
hw_mode=a
supported_rates=60 90 120 180 240 360 480 540
basic_rates=60 120 240
beacon_int=100
channel=acs_survey
tx_queue_data2_burst=2.0
#num_global_macaddr=1
ieee80211n=1
ht_coex=0
ht_capab=[HT40+][LDPC][SHORT-GI-20][SHORT-GI-40][TX-STBC][RX-STBC1][MAX-AMSDU-7935]
ieee80211ac=1
vht_oper_chwidth=2
vht_oper_centr_freq_seg0_idx=acs_survey
vht_capab=[RXLDPC][SHORT-GI-80][SHORT-GI-160][TX-STBC-2BY1][SU-BEAMFORMER][SU-BEAMFORMEE][MU-BEAMFORMER][MU-BEAMFORMEE][RX-ANTENNA-PATTERN][TX-ANTENNA-PATTERN][RX-STBC-1][SOUNDING-DIMENSION-4][BF-ANT>
ieee80211ax=1
he_oper_chwidth=2
he_oper_centr_freq_seg0_idx=acs_survey
he_su_beamformer=1
he_su_beamformee=1
he_mu_beamformer=1
he_bss_color=128
he_spr_sr_control=3
he_default_pe_duration=4
he_rts_threshold=1023
he_mu_edca_qos_info_param_count=0
he_mu_edca_qos_info_q_ack=0
he_mu_edca_qos_info_queue_request=0
he_mu_edca_qos_info_txop_request=0
he_mu_edca_ac_be_aifsn=8
he_mu_edca_ac_be_aci=0
he_mu_edca_ac_be_ecwmin=9
he_mu_edca_ac_be_ecwmax=10
he_mu_edca_ac_be_timer=255
he_mu_edca_ac_bk_aifsn=15
he_mu_edca_ac_bk_aci=1
he_mu_edca_ac_bk_ecwmin=9
he_mu_edca_ac_bk_ecwmax=10
he_mu_edca_ac_bk_timer=255
he_mu_edca_ac_vi_ecwmin=5
he_mu_edca_ac_vi_ecwmax=7
he_mu_edca_ac_vi_aifsn=5
he_mu_edca_ac_vi_aci=2
he_mu_edca_ac_vi_timer=255
he_mu_edca_ac_vo_aifsn=5
he_mu_edca_ac_vo_aci=3
he_mu_edca_ac_vo_ecwmin=5
he_mu_edca_ac_vo_ecwmax=7
he_mu_edca_ac_vo_timer=255
interface=phy2-ap0
ctrl_interface=/var/run/hostapd
ap_isolate=1
bss_load_update_period=60
chan_util_avg_period=600
disassoc_low_ack=1
skip_inactivity_poll=0
preamble=1
wmm_enabled=1
ignore_broadcast_ssid=0
uapsd_advertisement_enabled=1
utf8_ssid=1
multi_ap=0
sae_require_mfp=1
sae_pwe=2
wpa_passphrase=password
wpa_psk_file=/var/run/hostapd-phy2-ap0.psk
auth_algs=1
wpa=2
wpa_pairwise=CCMP
ssid=ssid
bridge=br-lan
wds_bridge=
snoop_iface=br-lan
wpa_disable_eapol_key_retries=0
wpa_key_mgmt=WPA-PSK WPA-PSK-SHA256 SAE
okc=1
ieee80211w=1
group_mgmt_cipher=AES-128-CMAC
dynamic_vlan=0
vlan_naming=1
vlan_no_bridge=1
vlan_file=/var/run/hostapd-phy2-ap0.vlan
qos_map_set=0,0,2,16,1,1,255,255,18,22,24,38,40,40,44,46,48,56
bssid=c0:18:50:de:39:2a
#default_macaddr