Hi all,
We are testing an indoor navigation app using Nearby Interaction / FiRa DL-TDOA on iPhone. In this sysdiagnose, the anchor is successfully discovered and ranging starts, but the UWB firmware crashes almost immediately.
Device / OS:
iPhone: 15
iOS: 27
Key timeline (redacted): text
18:09:22.969 nearbyd #dltdoa-ble-oob,Started BLE OOB scanning for FiRa DL-TDOA service 18:09:22.970 bluetoothd Received 'start active Unspecified scan' request, UUIDs [ 0xFFF3 0xFFF4 ] on 1M PHY 18:09:24.122 nearbyd #ses-loc,Scanned OOB: Mac addr: [0x<private>], uwb session id: [0x<private>], details: <private> 18:09:24.122 nearbyd #ses-loc,_buildOOBConfigFromOOBMessage for anchor mac_address: [0x<private>], payload <private> 18:09:24.508 nearbyd #ses-loc,Selected anchor 0x<private> (round-robin oldest in 2min window) 18:09:24.516 nearbyd Built FiRa localization packet V2: { ... } 18:09:24.516 nearbyd Built clientStartService packet: { ... } 18:09:24.520 nearbyd [RoseScheduler] RangingDidStart
18:09:24.664 nearbyd Error state - FatalChipError. Start error handling. 18:09:24.664 nearbyd #roseprovider,Got RoseState Event: FirmwareCrash 18:09:24.665 nearbyd [RoseServiceProvider] RoseInfrastructureEvent::Error 18:09:24.667 nearbyd #ses-container,#interrupt Interrupt session <private> with reason: <private> 18:09:24.741 nearbyd fwStateChangeReceived: FW is in FirmwareCrashed 18:09:24.742 nearbyd crashReceived 18:09:24.742 nearbyd Firmware logs are disabled 18:09:24.742 nearbyd Crash log saving is disabled 18:09:24.742 nearbyd Core dump saving is disabled
18:09:25.926 nearbyd PRRose: Resetting chip. Previous counter: <private> 18:09:27.681 nearbyd fwStateChangeReceived: FW is in FirmwareRunning 18:09:31.333 nearbyd #roseprovider,Got RoseState Event: Ready
UWB versions from the log: text
RoseUpdater Version: RoseUpdater-133~26833 host interface version 0x223 (2.35) hardware version 0x6 UWB_AP version 0x8d UWB_DSP version 0x47 modem init version 0x563cfdf1 board ID 0x8
Important: this is not the earlier BLE OOB fragmentation issue. In this log, OOB scanning, OOB parsing, anchor selection, and ranging start all succeed. The failure occurs right after RangingDidStart, with FatalChipError / FirmwareCrash.
We also see this secondary error, but it does not seem to be the main cause: text
nearbyd SpatialPlaceLookup ticket submission failed. Too many parameters: 1 max allowed: 0
Questions:
Has anyone seen FatalChipError / FirmwareCrash immediately after DL-TDOA ranging starts?
Could specific FiRa localization packet V2 parameters (channel, preamble, sfd_id, slot/round/block config, static_sts_iv, etc.) trigger this firmware crash?
Are there any known iOS / nearbyd / UWB firmware issues or workarounds for this?
Any help would be appreciated.