<![CDATA[Fatal crash on sta.scan() in UIFlow2 v2.4.4 on Tab5 - firmware bug]]>Hey everyone,

Yesterday I got my M5Stack Tab5 and started building a wardriving app in UIFlow2 MicroPython. During development I discovered that calling sta.scan() causes a fatal Guru Meditation Error every single time, crashing and rebooting the device.

After extensive testing I can confirm:

  • The crash is 100% reproducible - every scan attempt crashes
  • The same crash address (MEPC: 0x4ff13582) appears every single time
  • It happens regardless of code complexity, UI framework, scan interval or WiFi credentials
  • It cannot be caught by Python exception handling - it crashes below the MicroPython VM
  • Register analysis points to a null pointer dereference in the esp-hosted SDIO transport layer after an ETIMEDOUT on the ESP32-C6 coprocessor

I've filed a detailed bug report on GitHub including a minimal reproducer, crash dump analysis and probable root cause:

👉 https://github.com/m5stack/uiflow-micropython/issues/94

Has anyone else hit this on their Tab5? Any confirmations would help strengthen the case for a fix!

]]>https://community.m5stack.com/topic/8214/fatal-crash-on-sta.scan-in-uiflow2-v2.4.4-on-tab5-firmware-bugRSS for NodeTue, 12 May 2026 15:18:17 GMTSun, 10 May 2026 06:27:14 GMT60<![CDATA[Reply to Fatal crash on sta.scan() in UIFlow2 v2.4.4 on Tab5 - firmware bug on Tue, 12 May 2026 06:02:44 GMT]]>Additional finding: Secondary firmware bug — boot sequence crash on cold boot (MEPC: 0x00000006)
While investigating the sta.scan() crash, I discovered a second distinct firmware bug affecting the Tab5 in UIFlow2 v2.4.4.
Description:
On every cold boot, the device crashes during UIFlow2's initialization sequence before any user code runs. The device automatically reboots and boots successfully on the second attempt.
Crash signature:
Guru Meditation Error: Core 1 panic'ed (Instruction access fault). Exception was unhandled.

MEPC : 0x00000006
MCAUSE : 0x00000001
MTVAL : 0x00000006
Key observation:
The stack contains 0x7474696c (ASCII: "litt") pointing to a crash inside UIFlow2's LittlevGL/LVGL initialization sequence — not in user code.
Reproducibility:

100% reproducible on cold boot
Device always self-recovers on automatic reboot
Completely independent of user code — happens before any user application starts

This is a separate bug from issue #94 (sta.scan() at MEPC: 0x4ff13582). Both bugs share the same root environment (UIFlow2 v2.4.4 on Tab5) but occur at different stages and involve different subsystems.

]]>https://community.m5stack.com/post/30966https://community.m5stack.com/post/30966Tue, 12 May 2026 06:02:44 GMT