ASSERTION FAIL [!conn_tx_is_pending] @ WEST_TOPDIR/zephyr/subsys/bluetooth/host/conn.c:1514

[sjanc]

Describe the bug

Occasionally when executing BT qualification tests we notice following assertion

[00:00:59.610,000] �[0m<dbg> bttester_bap_unicast: stream_recv_cb: Incoming audio on stream 0x825df2c len 0 flags 0x04 seq_num 1590 and ts 0�[0m
[00:00:59.630,000] �[0m<dbg> bttester: cmd_handler: cmd service 0x1b opcode 0x0b index 0x00�[0m
[00:00:59.630,000] �[0m<dbg> bttester: tester_rsp_with_index: service 0x1b opcode 0x0b index 0x00 status 0x02�[0m
[00:00:59.630,000] �[0m<dbg> bttester_bap_unicast: stream_recv_cb: Incoming audio on stream 0x825df2c len 0 flags 0x04 seq_num 1591 and ts 0�[0m
[00:00:59.630,000] �[0m<dbg> bttester_bap_unicast: stream_recv_cb: Incoming audio on stream 0x825df2c len 0 flags 0x04 seq_num 1592 and ts 0�[0m
[00:00:59.650,000] �[0m<dbg> bttester_bap_unicast: stream_recv_cb: Incoming audio on stream 0x825df2c len 0 flags 0x04 seq_num 1593 and ts 0�[0m
[00:00:59.650,000] �[0m<dbg> bttester_bap_unicast: stream_recv_cb: Incoming audio on stream 0x825df2c len 0 flags 0x04 seq_num 1594 and ts 0�[0m
[00:00:59.670,000] �[0m<dbg> bttester: cmd_handler: cmd service 0x01 opcode 0x05 index 0x00�[0m
ASSERTION FAIL [!conn_tx_is_pending] @ WEST_TOPDIR/zephyr/subsys/bluetooth/host/conn.c:1514
	tx_complete_work is pending when conn is deallocated
@ WEST_TOPDIR/zephyr/lib/os/assert.c:43
[00:00:59.670,000] �[1;31m<err> os: >>> ZEPHYR FATAL ERROR 4: Kernel panic on CPU 0�[0m
[00:00:59.670,000] �[1;31m<err> os: Current thread: 0x8258da0 (unknown)�[0m
[00:00:59.670,000] �[1;31m<err> os: Halting system�[0m

this is happening randomly (but not often) in tests, however I suspect that that all occurrences are when bt_disable() is being called when there is existing ISO connection. While this is not a common usecase it happens in qualification tests when test is being prematurely terminated due to non-passing verdict.

zephyr hash: b25a218

Regression

• This is a regression.

Steps to reproduce

it happens randomly when LE Audio qualification tests are executed
in particular TMAP/CG/VRC/BV-* tests

Relevant log output

Impact

Annoyance – Minor irritation; no significant impact on usability or functionality.

Environment

No response

Additional Context

No response

[koffes]

Both @ardo-nordic and me tried to run some of these and could not reproduce. Can you give us any more information?

[sjanc]

this issue seems to be related to powering off IUT at the end of the test in autoPTS native_sim setup (we do this to make sure controller is reset before zephyr process is terminated).

This is how I reproduce this
./autoptsclient_bot.py -c TMAP/CG/VRC/BV-01-C --btmon --retry=20 --stress_test

Note that since this is in post-test part of cleanup, depending on timing test might already be marked as PASS.
So after above test run I simply grep logs for this (in logs folder simple grep -R conn_tx_is_pending) should do.

Also note that this is not very common issue (3 occurrences over whole autopts run) but seems to be more reproducible with those TMAP/CG/VRC tests