Wifi connection crashes when connection is reestablished

The report points to the brcmfmac SDIO wireless-driver path and includes kernel logs showing a firmware halt after Wi-Fi reconnect. Start by tracing that driver path and reproducing the channel-change recovery scenario on the stated Raspberry Pi setup. Done means the connection recovers without the firmware-trap and repeated timeout errors shown here.

I'm on Linux raspberrypi 4.19.69-v7+ #1256 and after running few hours without problems I got the following entries in my syslog. Interesting stuff begins at 00:46:53 where brcmfmac starts to fail and never returns. The problem occurs when wifi signal is lost and should be reestablished. In my case triggered by a channel change of my router (AVM Fritz Box).

The wlan0 carrier gets lost, is reaquired and then brcmfmac starts to mess up.

No hostapd installed, just simple wifi connection to my router.

Sep 23 00:00:22 raspberrypi rsyslogd:  [origin software="rsyslogd" swVersion="8.1901.0" x-pid="321" x-info="https://www.rsyslog.com"] rsyslogd w$
Sep 23 00:00:22 raspberrypi systemd[1]: logrotate.service: Succeeded.
Sep 23 00:00:22 raspberrypi systemd[1]: Started Rotate log files.
Sep 23 00:00:23 raspberrypi systemd[1]: man-db.service: Succeeded.
Sep 23 00:00:23 raspberrypi systemd[1]: Started Daily man-db regeneration.
Sep 23 00:17:01 raspberrypi CRON[15085]: (root) CMD (   cd / && run-parts --report /etc/cron.hourly)
Sep 23 00:45:50 raspberrypi dhcpcd[475]: wlan0: carrier lost
Sep 23 00:45:50 raspberrypi dhcpcd[475]: wlan0: deleting address 2003:e0:7f1f:8500:35d3:4c67:a30b:2ce8/64
Sep 23 00:45:50 raspberrypi dhcpcd[475]: wlan0: deleting route to 2003:e0:7f1f:8500::/64
Sep 23 00:45:50 raspberrypi dhcpcd[475]: wlan0: deleting default route via fe80::3a10:d5ff:fe60:4a2a
Sep 23 00:45:50 raspberrypi avahi-daemon[297]: Withdrawing address record for 2003:e0:7f1f:8500:35d3:4c67:a30b:2ce8 on wlan0.
Sep 23 00:45:50 raspberrypi avahi-daemon[297]: Leaving mDNS multicast group on interface wlan0.IPv6 with address 2003:e0:7f1f:8500:35d3:4c67:a30$
Sep 23 00:45:50 raspberrypi avahi-daemon[297]: Joining mDNS multicast group on interface wlan0.IPv6 with address fe80::ef45:8c3a:42af:1e8d.
Sep 23 00:45:50 raspberrypi avahi-daemon[297]: Registering new address record for fe80::ef45:8c3a:42af:1e8d on wlan0.*.
Sep 23 00:45:50 raspberrypi avahi-daemon[297]: Withdrawing address record for 192.168.178.163 on wlan0.
Sep 23 00:45:50 raspberrypi avahi-daemon[297]: Leaving mDNS multicast group on interface wlan0.IPv4 with address 192.168.178.163.
Sep 23 00:45:50 raspberrypi avahi-daemon[297]: Interface wlan0.IPv4 no longer relevant for mDNS.
Sep 23 00:45:50 raspberrypi dhcpcd[475]: wlan0: deleting route to 192.168.178.0/24
Sep 23 00:45:50 raspberrypi dhcpcd[475]: wlan0: deleting default route via 192.168.178.1
Sep 23 00:45:55 raspberrypi dhcpcd[475]: wlan0: carrier acquired
Sep 23 00:45:55 raspberrypi dhcpcd[475]: wlan0: IAID eb:3e:1a:e0
Sep 23 00:45:55 raspberrypi dhcpcd[475]: wlan0: rebinding lease of 192.168.178.163
Sep 23 00:45:55 raspberrypi dhcpcd[475]: wlan0: probing address 192.168.178.163/24
Sep 23 00:45:56 raspberrypi dhcpcd[475]: wlan0: soliciting an IPv6 router
Sep 23 00:45:56 raspberrypi dhcpcd[475]: wlan0: Router Advertisement from fe80::3a10:d5ff:fe60:4a2a
Sep 23 00:45:56 raspberrypi dhcpcd[475]: wlan0: adding address 2003:e0:7f1f:8500:35d3:4c67:a30b:2ce8/64
Sep 23 00:45:56 raspberrypi dhcpcd[475]: wlan0: adding route to 2003:e0:7f1f:8500::/64
Sep 23 00:45:56 raspberrypi avahi-daemon[297]: Leaving mDNS multicast group on interface wlan0.IPv6 with address fe80::ef45:8c3a:42af:1e8d.
Sep 23 00:45:56 raspberrypi dhcpcd[475]: wlan0: adding default route via fe80::3a10:d5ff:fe60:4a2a
Sep 23 00:45:56 raspberrypi avahi-daemon[297]: Joining mDNS multicast group on interface wlan0.IPv6 with address 2003:e0:7f1f:8500:35d3:4c67:a30$
Sep 23 00:45:56 raspberrypi avahi-daemon[297]: Registering new address record for 2003:e0:7f1f:8500:35d3:4c67:a30b:2ce8 on wlan0.*.
Sep 23 00:45:56 raspberrypi dhcpcd[475]: wlan0: soliciting a DHCPv6 lease
Sep 23 00:45:56 raspberrypi avahi-daemon[297]: Withdrawing address record for fe80::ef45:8c3a:42af:1e8d on wlan0.
Sep 23 00:45:57 raspberrypi dhcpcd[475]: wlan0: DHCPv6 REPLY: in stateless mode
Sep 23 00:45:58 raspberrypi dhcpcd[475]: wlan0: DHCPv6 REPLY: in stateless mode
Sep 23 00:46:00 raspberrypi dhcpcd[475]: wlan0: DHCPv6 REPLY: in stateless mode
Sep 23 00:46:01 raspberrypi dhcpcd[475]: wlan0: leased 192.168.178.163 for 864000 seconds
Sep 23 00:46:01 raspberrypi avahi-daemon[297]: Joining mDNS multicast group on interface wlan0.IPv4 with address 192.168.178.163.
Sep 23 00:46:01 raspberrypi avahi-daemon[297]: New relevant interface wlan0.IPv4 for mDNS.
Sep 23 00:46:01 raspberrypi dhcpcd[475]: wlan0: adding route to 192.168.178.0/24
Sep 23 00:46:01 raspberrypi dhcpcd[475]: wlan0: adding default route via 192.168.178.1
Sep 23 00:46:01 raspberrypi avahi-daemon[297]: Registering new address record for 192.168.178.163 on wlan0.IPv4.
Sep 23 00:46:04 raspberrypi dhcpcd[475]: wlan0: DHCPv6 REPLY: in stateless mode
Sep 23 00:46:11 raspberrypi dhcpcd[475]: wlan0: DHCPv6 REPLY: in stateless mode
Sep 23 00:46:53 raspberrypi kernel: [190079.012984] brcmfmac: brcmf_sdio_hostmail: mailbox indicates firmware halted
Sep 23 00:47:00 raspberrypi kernel: [190086.579355] brcmfmac: brcmf_sdio_bus_rxctl: resumed on timeout
Sep 23 00:47:00 raspberrypi kernel: [190086.579566] brcmfmac: brcmf_sdio_checkdied: firmware trap in dongle
Sep 23 00:47:00 raspberrypi kernel: [190086.579575] brcmfmac: brcmf_cfg80211_get_channel: chanspec failed (-110)
Sep 23 00:47:17 raspberrypi kernel: [190103.139510] brcmfmac: brcmf_sdio_bus_rxctl: resumed on timeout
Sep 23 00:47:17 raspberrypi kernel: [190103.139998] brcmfmac: brcmf_sdio_checkdied: firmware trap in dongle
Sep 23 00:47:17 raspberrypi kernel: [190103.140014] brcmfmac: brcmf_cfg80211_get_channel: chanspec failed (-110)
Sep 23 00:47:19 raspberrypi kernel: [190105.699521] brcmfmac: brcmf_sdio_bus_rxctl: resumed on timeout
Sep 23 00:47:19 raspberrypi kernel: [190105.699962] brcmfmac: brcmf_sdio_checkdied: firmware trap in dongle
Sep 23 00:47:19 raspberrypi kernel: [190105.699979] brcmfmac: brcmf_cfg80211_get_tx_power: error (-110)
Sep 23 00:47:22 raspberrypi kernel: [190108.259470] brcmfmac: brcmf_sdio_bus_rxctl: resumed on timeout
Sep 23 00:47:22 raspberrypi kernel: [190108.259690] brcmfmac: brcmf_sdio_checkdied: firmware trap in dongle
Sep 23 00:49:47 raspberrypi dhcpcd[475]: wlan0: fe80::3a10:d5ff:fe60:4a2a is unreachable, expiring it
...
Sep 23 00:50:04 raspberrypi kernel: [190270.020426] brcmfmac: brcmf_proto_bcdc_query_dcmd: brcmf_proto_bcdc_msg failed w/status -110
Sep 23 00:50:04 raspberrypi kernel: [190270.020459] brcmfmac: brcmf_cfg80211_get_channel: chanspec failed (-110)
Sep 23 00:50:06 raspberrypi kernel: [190272.580445] brcmfmac: brcmf_proto_bcdc_query_dcmd: brcmf_proto_bcdc_msg failed w/status -110
Sep 23 00:50:06 raspberrypi kernel: [190272.580462] brcmfmac: brcmf_cfg80211_get_tx_power: error (-110)