Returning from a Zephyr fatal-policy handler does not resume the faulting instruction. In the normal multithreaded path, it leads to aborting the current thread. That can contain a fault only if the rest of the system still has a valid state. A reason code alone cannot prove that mutexes, shared data, peripheral operations or kernel…
Loading an ELF extension successfully establishes neither function-type compatibility nor permission to free its code while callbacks still reference it. Treat Zephyr LLEXT integration as two contracts: a versioned binary interface at load time, and a quiescence protocol before final unload. A resolved symbol address is only useful when both contracts hold. This guide pins…
A hierarchical state machine is correct only when its actions match the transition boundary. Moving between sibling states should not tear down their shared parent’s resource; leaving that parent should. In Zephyr SMF, verify the action sequence directly rather than checking only the final state pointer. A machine can arrive at the right state after…
Choose a zbus observer by what must survive between publication and consumption. A listener executes during dispatch. A subscriber receives a channel reference and later reads that channel’s current value. A message subscriber retains published message data for later consumption. These are different delivery contracts; increasing a subscriber’s notification queue does not turn channel references…
A FreeRTOS trace hook runs at its kernel call site, not in a separate logging task. It can execute while kernel data is mid-update, inside a critical section or during a context switch. Capture a small bounded record there and defer formatting and transport. Before interpreting the record, document precisely which transition has already occurred…
An atomic expression can compile into a library call. Before using GCC atomic builtins in an interrupt handler, verify the exact operation, object width, alignment and target options in the production build. Then inspect the emitted code and any helper it invokes. “Atomic” describes a concurrency guarantee; it does not by itself establish interrupt suitability…
FreeRTOS heap_5.c can allocate from several noncontiguous memory regions, but it cannot determine whether those addresses belong to the heap. Define valid, nonoverlapping regions in increasing address order, terminate the list correctly and initialize them before any dynamic kernel allocation. A successful allocator initialization is not proof that the linker, startup code and peripheral memory…
A worker’s final “done” semaphore is not proof that Zephyr has finished terminating the worker. The worker can signal, be preempted, and still have instructions or kernel exit processing ahead of it. Use a successful k_thread_join() as the kernel termination boundary before reusing its thread control storage or making completion-dependent reclamation decisions. Treat every nonzero…
Zephyr timer status is a consumable expiration count. Reading it clears it. If a worker, diagnostic command and expiry callback all read the same timer’s status, they divide or erase each other’s evidence. Assign one status consumer, then decide how that consumer converts a count into application work. A value greater than one is useful…
k_msgq_purge() is more than a queue-length operation. In upstream Zephyr 3.7.0 it discards buffered messages and releases blocked senders with -ENOMSG. Those send attempts have failed; they are not automatically reinserted into the newly empty queue. A producer that ignores the return value can report delivery of a message that was never accepted. This guide…