Problem

do_upgrade() looks up the vendor and model items of the board-info object, then calls cJSON_GetStringValue() on binfo — the object itself — instead of on the item it just found:

cJSON *c_vendor = cJSON_GetObjectItem(binfo, "vendor");
if (c_vendor) {
    char *bstr = cJSON_GetStringValue(binfo);   // <- binfo, not c_vendor
    if (bstr)
        strcpy(board, bstr);
}
cJSON *c_model = cJSON_GetObjectItem(binfo, "model");
if (c_model) {
    char *bstr = cJSON_GetStringValue(binfo);   // <- same
    strcpy(board_id, bstr);                     // <- and unguarded
    ...
}

detect_board() returns an object, and cJSON_GetStringValue() returns NULL for anything that isn't a string, so bstr is NULL in both branches. Consequences:

• the vendor branch is NULL-guarded, so it silently does nothing;
• the model branch is not, so it runs strcpy(board_id, NULL).

ipctool upgrade therefore segfaults on any board whose detector supplies a model key — currently Ruision, Anjoy and Hankvision (src/boards/*.c). On boards without one it survives, but board_id stays empty, so the hardware U-Boot variable set from it further down is never written.

Fix

Read from c_vendor/c_model, guard both against NULL, and bound the copies with snprintf — these strings come from board detection (sysinfo files, directory names) and were being strcpy/strcat'ed into fixed 1024-byte buffers unchecked.

Behaviour is otherwise preserved, including board_id carrying the model alone.

Note for the maintainer

board is assembled here and then never read again. I left that as-is rather than quietly change what the composed string is supposed to mean — happy to drop it, or to switch hardware to the full "vendor model" string, if either was the original intent.

Testing

Compile-tested. I haven't run ipctool upgrade on a Ruision/Anjoy/Hankvision board — if someone can reproduce the crash on stock master and confirm it's gone here, that would close the loop.