Dear Maintainer,

While trying to load the driver on trixie on kernel 6.12.12 there is a
kernel crash. Extract of kernel log is below. Full log is attached.


févr. 27 10:28:33 debian kernel: ------------[ cut here ]------------
févr. 27 10:28:33 debian kernel: Unpatched return thunk in use. This
should not happen!
févr. 27 10:28:33 debian kernel: WARNING: CPU: 1 PID: 471 at
arch/x86/kernel/cpu/bugs.c:3063 __warn_thunk+0x2a/0x40
févr. 27 10:28:33 debian kernel: Modules linked in: wl(POE+) nouveau(+)
coretemp kvm_intel kvm applesmc mxm_wmi sha512_ssse3 drm_gpuvm
sha256_ssse3 sha1_ssse3 drm_exec btusb gpu_sched snd_hda_codec_realtek
btrtl drm_display_helper snd_hda_codec_generic uvcvideo btintel
snd_hda_scodec_component snd_hda_intel videobuf2_vmalloc cec btbcm uvc
snd_intel_dspcfg btmtk snd_intel_sdw_acpi videobuf2_memops rc_core
snd_hda_codec drm_ttm_helper videobuf2_v4l2 bluetooth snd_hda_core
videodev ttm cfg80211 snd_hwdep snd_pcm videobuf2_common drm_kms_helper
snd_timer mc snd i2c_algo_bit acpi_cpufreq pcspkr rfkill soundcore
apple_mfi_fastcharge nv_tco apple_bl sg video wmi evdev binfmt_misc
ufsd(POE) jnl(OE) firewire_sbp2 msr parport_pc ppdev drm lp parport
efi_pstore configfs nfnetlink efivarfs ip_tables x_tables autofs4 ext4
crc16 mbcache jbd2 crc32c_generic uas usb_storage hid_apple hid_appleir
hid_generic usbhid hid sd_mod ohci_pci ehci_pci ahci ohci_hcd libahci
ehci_hcd libata firewire_ohci firewire_core usbcore crc_itu_t scsi_mod
forcedeth usb_common
févr. 27 10:28:33 debian kernel:  scsi_common i2c_nforce2 button
févr. 27 10:28:33 debian kernel: CPU: 1 UID: 0 PID: 471 Comm:
(udev-worker) Tainted: P           OE      6.12.12-amd64 #1  Debian
6.12.12-1
févr. 27 10:28:33 debian kernel: Tainted: [P]=PROPRIETARY_MODULE,
[O]=OOT_MODULE, [E]=UNSIGNED_MODULE
févr. 27 10:28:33 debian kernel: Hardware name: Apple Inc.
iMac9,1/Mac-F2218FC8, BIOS     IM91.88Z.008D.B08.0904271717 04/27/09
févr. 27 10:28:33 debian kernel: RIP: 0010:__warn_thunk+0x2a/0x40
févr. 27 10:28:33 debian kernel: Code: 66 0f 1f 00 0f 1f 44 00 00 80 3d
98 a9 dc 01 00 74 05 c3 cc cc cc cc 48 c7 c7 78 c4 33 a2 c6 05 83 a9 dc
01 01 e8 d6 2f 06 00 <0f> 0b c3 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00
00 0f 1f 44 00 00
févr. 27 10:28:33 debian kernel: RSP: 0018:ffffb00fc07e3960 EFLAGS: 00010282
févr. 27 10:28:33 debian kernel: RAX: 0000000000000000 RBX:
0000000000000000 RCX: 0000000000000027
févr. 27 10:28:33 debian kernel: RDX: ffffa021f8121788 RSI:
0000000000000001 RDI: ffffa021f8121780
févr. 27 10:28:33 debian kernel: RBP: ffffb00fc07e39b0 R08:
0000000000000000 R09: ffffb00fc07e37e0
févr. 27 10:28:33 debian kernel: R10: ffffffffa2ab4348 R11:
0000000000000003 R12: ffffffffc1b32bc1
févr. 27 10:28:33 debian kernel: R13: ffffb00fc07e39f8 R14:
ffffa020ca70db40 R15: ffffa020c07f9368
févr. 27 10:28:33 debian kernel: FS:  00007f5d9ee5c980(0000)
GS:ffffa021f8100000(0000) knlGS:0000000000000000
févr. 27 10:28:33 debian kernel: CS:  0010 DS: 0000 ES: 0000 CR0:
0000000080050033
févr. 27 10:28:33 debian kernel: CR2: 00007f3806bf3000 CR3:
000000012138e000 CR4: 00000000000426f0
févr. 27 10:28:33 debian kernel: Call Trace:
févr. 27 10:28:33 debian kernel:  <TASK>
févr. 27 10:28:33 debian kernel:  ? __warn_thunk+0x2a/0x40
févr. 27 10:28:33 debian kernel:  ? __warn.cold+0x93/0xf6
févr. 27 10:28:33 debian kernel:  ? __warn_thunk+0x2a/0x40
févr. 27 10:28:33 debian kernel:  ? report_bug+0xff/0x140
févr. 27 10:28:33 debian kernel:  ? handle_bug+0x58/0x90
févr. 27 10:28:33 debian kernel:  ? exc_invalid_op+0x17/0x70
févr. 27 10:28:33 debian kernel:  ? asm_exc_invalid_op+0x1a/0x20
févr. 27 10:28:33 debian kernel:  ? __warn_thunk+0x2a/0x40
févr. 27 10:28:33 debian kernel:  warn_thunk_thunk+0x1a/0x30
févr. 27 10:28:33 debian kernel:  getvar+0x20/0x70 [wl]
févr. 27 10:28:33 debian kernel:  ?
____versions+0x4feffee661e8/0x4feffee661e8 [wl]
févr. 27 10:28:33 debian kernel:  wl_module_init+0x17/0xa0 [wl]
févr. 27 10:28:33 debian kernel:  ? do_one_initcall+0x5b/0x310
févr. 27 10:28:33 debian kernel:  ? do_init_module+0x60/0x230
févr. 27 10:28:33 debian kernel:  ? init_module_from_file+0x89/0xe0
févr. 27 10:28:33 debian kernel:  ? idempotent_init_module+0x11e/0x310
févr. 27 10:28:33 debian kernel:  ? __x64_sys_finit_module+0x5e/0xb0
févr. 27 10:28:33 debian kernel:  ? do_syscall_64+0x82/0x190
févr. 27 10:28:33 debian kernel:  ? atime_needs_update+0x9c/0x110
févr. 27 10:28:33 debian kernel:  ? touch_atime+0x1e/0x120
févr. 27 10:28:33 debian kernel:  ? filemap_read+0x340/0x370
févr. 27 10:28:33 debian kernel:  ? vfs_read+0x15e/0x370
févr. 27 10:28:33 debian kernel:  ? vfs_read+0x15e/0x370
févr. 27 10:28:33 debian kernel:  ? __rseq_handle_notify_resume+0xa2/0x4a0
févr. 27 10:28:33 debian kernel:  ? restore_fpregs_from_fpstate+0x3c/0xa0
févr. 27 10:28:33 debian kernel:  ? switch_fpu_return+0x4e/0xd0
févr. 27 10:28:33 debian kernel:  ? syscall_exit_to_user_mode+0x172/0x210
févr. 27 10:28:33 debian kernel:  ? do_syscall_64+0x8e/0x190
févr. 27 10:28:33 debian kernel:  ? syscall_exit_to_user_mode+0x4d/0x210
févr. 27 10:28:33 debian kernel:  ? do_syscall_64+0x8e/0x190
févr. 27 10:28:33 debian kernel:  ? do_syscall_64+0x8e/0x190
févr. 27 10:28:33 debian kernel:  ? exc_page_fault+0x7e/0x180
févr. 27 10:28:33 debian kernel:  ? entry_SYSCALL_64_after_hwframe+0x76/0x7e
févr. 27 10:28:33 debian kernel:  </TASK>
févr. 27 10:28:33 debian kernel: ---[ end trace 0000000000000000 ]---



févr. 27 10:28:40 debian kernel: ------------[ cut here ]------------
févr. 27 10:28:40 debian kernel: memcpy: detected field-spanning write
(size 346) of single field "dst" at
/var/lib/dkms/broadcom-sta/6.30.223.271/build/src/wl/sys/wl_cfg80211_hybrid.c:3086
(size 0)
févr. 27 10:28:40 debian kernel: WARNING: CPU: 0 PID: 755 at
/var/lib/dkms/broadcom-sta/6.30.223.271/build/src/wl/sys/wl_cfg80211_hybrid.c:3086
wl_inform_single_bss+0x392/0x4f0 [wl]
févr. 27 10:28:40 debian kernel: Modules linked in: nft_fib_inet
nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4
nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack
nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables libcrc32c qrtr rfcomm
bnep lm90 wl(POE) nouveau coretemp kvm_intel kvm applesmc mxm_wmi
sha512_ssse3 drm_gpuvm sha256_ssse3 sha1_ssse3 drm_exec btusb gpu_sched
snd_hda_codec_realtek btrtl drm_display_helper snd_hda_codec_generic
uvcvideo btintel snd_hda_scodec_component snd_hda_intel
videobuf2_vmalloc cec btbcm uvc snd_intel_dspcfg btmtk
snd_intel_sdw_acpi videobuf2_memops rc_core snd_hda_codec drm_ttm_helper
videobuf2_v4l2 bluetooth snd_hda_core videodev ttm cfg80211 snd_hwdep
snd_pcm videobuf2_common drm_kms_helper snd_timer mc snd i2c_algo_bit
acpi_cpufreq pcspkr rfkill soundcore apple_mfi_fastcharge nv_tco
apple_bl sg video wmi evdev binfmt_misc ufsd(POE) jnl(OE) firewire_sbp2
msr parport_pc ppdev drm lp parport efi_pstore configfs nfnetlink
efivarfs ip_tables x_tables autofs4 ext4 crc16 mbcache
févr. 27 10:28:40 debian kernel:  jbd2 crc32c_generic uas usb_storage
hid_apple hid_appleir hid_generic usbhid hid sd_mod ohci_pci ehci_pci
ahci ohci_hcd libahci ehci_hcd libata firewire_ohci firewire_core
usbcore crc_itu_t scsi_mod forcedeth usb_common scsi_common i2c_nforce2
button
févr. 27 10:28:40 debian kernel: CPU: 0 UID: 0 PID: 755 Comm:
wl_event_handle Tainted: P        W  OE      6.12.12-amd64 #1  Debian
6.12.12-1
févr. 27 10:28:40 debian kernel: Tainted: [P]=PROPRIETARY_MODULE,
[W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
févr. 27 10:28:40 debian kernel: Hardware name: Apple Inc.
iMac9,1/Mac-F2218FC8, BIOS     IM91.88Z.008D.B08.0904271717 04/27/09
févr. 27 10:28:40 debian kernel: RIP:
0010:wl_inform_single_bss+0x392/0x4f0 [wl]
févr. 27 10:28:40 debian kernel: Code: 0f 85 dd fd ff ff 31 c9 4c 89 e6
48 c7 c2 80 42 b3 c1 48 c7 c7 d8 41 b3 c1 48 89 44 24 10 c6 05 b8 a6 15
00 01 e8 6e e6 82 df <0f> 0b 48 8b 44 24 10 e9 ad fd ff ff 8b 0e 41 89
8f 1a 04 00 00 42
févr. 27 10:28:40 debian kernel: RSP: 0000:ffffb00fc0573dc8 EFLAGS: 00010282
févr. 27 10:28:40 debian kernel: RAX: 0000000000000000 RBX:
ffffa020de25000c RCX: 0000000000000027
févr. 27 10:28:40 debian kernel: RDX: ffffa021f8021788 RSI:
0000000000000001 RDI: ffffa021f8021780
févr. 27 10:28:40 debian kernel: RBP: ffffa020c601f000 R08:
0000000000000000 R09: ffffb00fc0573c48
févr. 27 10:28:40 debian kernel: R10: ffffffffa2ab4348 R11:
0000000000000003 R12: 000000000000015a
févr. 27 10:28:40 debian kernel: R13: ffffa020de250014 R14:
0000000000000050 R15: ffffa020e037c900
févr. 27 10:28:40 debian kernel: FS:  0000000000000000(0000)
GS:ffffa021f8000000(0000) knlGS:0000000000000000
févr. 27 10:28:40 debian kernel: CS:  0010 DS: 0000 ES: 0000 CR0:
0000000080050033
févr. 27 10:28:40 debian kernel: CR2: 00007f0962948000 CR3:
00000001038bc000 CR4: 00000000000426f0
févr. 27 10:28:40 debian kernel: Call Trace:
févr. 27 10:28:40 debian kernel:  <TASK>
févr. 27 10:28:40 debian kernel:  ? wl_inform_single_bss+0x392/0x4f0 [wl]
févr. 27 10:28:40 debian kernel:  ? __warn.cold+0x93/0xf6
févr. 27 10:28:40 debian kernel:  ? wl_inform_single_bss+0x392/0x4f0 [wl]
févr. 27 10:28:40 debian kernel:  ? report_bug+0xff/0x140
févr. 27 10:28:40 debian kernel:  ? console_unlock+0x9d/0x140
févr. 27 10:28:40 debian kernel:  ? handle_bug+0x58/0x90
févr. 27 10:28:40 debian kernel:  ? exc_invalid_op+0x17/0x70
févr. 27 10:28:40 debian kernel:  ? asm_exc_invalid_op+0x1a/0x20
févr. 27 10:28:40 debian kernel:  ? wl_inform_single_bss+0x392/0x4f0 [wl]
févr. 27 10:28:40 debian kernel:  ? wl_inform_single_bss+0x392/0x4f0 [wl]
févr. 27 10:28:40 debian kernel:  ? warn_thunk_thunk+0x1a/0x30
févr. 27 10:28:40 debian kernel:  ? wl_notify_scan_status+0x1bd/0x260 [wl]
févr. 27 10:28:40 debian kernel:  ? wl_event_handler+0x7a/0x170 [wl]
févr. 27 10:28:40 debian kernel:  ? wl_cfg80211_add_key+0x3f0/0x3f0 [wl]
févr. 27 10:28:40 debian kernel:  ? kthread+0xd2/0x100
févr. 27 10:28:40 debian kernel:  ? __pfx_kthread+0x10/0x10
févr. 27 10:28:40 debian kernel:  ? ret_from_fork+0x34/0x50
févr. 27 10:28:40 debian kernel:  ? __pfx_kthread+0x10/0x10
févr. 27 10:28:40 debian kernel:  ? ret_from_fork_asm+0x1a/0x30
févr. 27 10:28:40 debian kernel:  </TASK>
févr. 27 10:28:40 debian kernel: ---[ end trace 0000000000000000 ]---


Regards

Adding build log.

Hello,

This is still a problem on testing/trixie today with
- linux 6.12.21-1
- broadcom-sta 6.30.223.271-26

Even on a system that doesn't have such a device, simply doing "modprobe wl"
leads to the crash. Log is attached.

I tried on 2 different real hardware and both fail. It also fails on a virtual
machine (with virtualbox) with the exact same error.

I'm increasing severity to grave. If that's not appropriate, please change
it back.

Regards
Fab

Maybe it's not as grave as I thought since it appears to be a warning only.

I could be a consequence of this commit which appeard in kernel 6.9
https://github.com/torvalds/linux/commit/
4461438a8405e800f90e0e40409e5f3d07eed381

There are also complaints at other locations about this issue:

https://github.com/LibreELEC/LibreELEC.tv/issues/8941#issuecomment-2227644204

Regards
Fab

After a recent trial on my hardware, it appears that despite the
warning, the module works properly. (kernel 6.12.27)

I also added the "ibt=off" kernel parameter in my case since it's an old
CPU, but I don't think this is actually mandatory for proper functioning.

ibt=off was suggested by the kernel message.

Regards
Fab

On Sat, 20 Sep 2025 18:42:16 -0700 Roger Shimizu <rosh@debian.org> wrote:
 > Version: 6.30.223.271-28~exp1
 >

The warning is still in the log with version 6.30.223.271-28~exp1 (which
is said to fix the issue).

Hardware works properly despite the warning.

Sep 21 08:16:07 debian kernel: wl: This driver includes a binary blob
incompatible with IBT protection, available since Intel Core Tiger Lake
(11th gen, 2020). If your CPU is older you can ignore the 'Unpatched
return thunk in use' warnings caused by this driver. You can disable IBT
by adding `ibt=off` to your kernel boot options.
Sep 21 08:16:07 debian kernel: ------------[ cut here ]------------
Sep 21 08:16:07 debian kernel: Unpatched return thunk in use. This
should not happen!
Sep 21 08:16:07 debian kernel: WARNING: CPU: 1 PID: 406 at
arch/x86/kernel/cpu/bugs.c:3356 __warn_thunk+0x2a/0x40
Sep 21 08:16:07 debian kernel: Modules linked in: wl(POE+) nouveau(+)
cmac algif_hash algif_skcipher af_alg rfcomm bnep uinput
snd_hda_codec_realtek snd_hda_codec_generic kvm_intel btusb
snd_hda_scodec_component snd_hda_intel btrtl mxm_wmi btintel
snd_intel_dspcfg drm_gpuvm snd_intel_sdw_acpi binfmt_misc drm_exec
uvcvideo btbcm btmtk gpu_sched drm_display_helper snd_hda_codec kvm
videobuf2_vmalloc cec cfg80211 uvc bluetooth snd_hda_core
videobuf2_memops rc_core videobuf2_v4l2 drm_ttm_helper snd_hwdep ttm
applesmc videodev snd_pcm irqbypass drm_kms_helper sha512_ssse3
sha256_ssse3 videobuf2_common sha1_ssse3 snd_timer i2c_algo_bit pcspkr
acpi_cpufreq rfkill nls_ascii nls_cp437 mc snd vfat fat soundcore
apple_bl video wmi evdev button apple_mfi_fastcharge sg ufsd(POE)
jnl(OE) coretemp msr dm_mod parport_pc ppdev lp drm parport configfs
efi_pstore nfnetlink ip_tables x_tables autofs4 ext4 crc16 mbcache jbd2
crc32c_generic hid_apple hid_appleir hid_generic usbhid hid sd_mod
ata_generic ahci libahci ohci_pci libata ehci_pci ehci_hcd ohci_hcd
Sep 21 08:16:07 debian kernel:  scsi_mod firewire_ohci usbcore forcedeth
firewire_core scsi_common crc_itu_t usb_common nv_tco i2c_nforce2
Sep 21 08:16:07 debian kernel: CPU: 1 UID: 0 PID: 406 Comm:
(udev-worker) Tainted: P           OE      6.12.43+deb13-amd64 #1
Debian 6.12.43-1
Sep 21 08:16:07 debian kernel: Tainted: [P]=PROPRIETARY_MODULE,
[O]=OOT_MODULE, [E]=UNSIGNED_MODULE
Sep 21 08:16:07 debian kernel: Hardware name: Apple Inc.
iMac9,1/Mac-F2218FC8, BIOS     IM91.88Z.008D.B08.0904271717 04/27/09
Sep 21 08:16:07 debian kernel: RIP: 0010:__warn_thunk+0x2a/0x40
Sep 21 08:16:07 debian kernel: Code: 66 0f 1f 00 0f 1f 44 00 00 80 3d 58
9c dc 01 00 74 05 c3 cc cc cc cc 48 c7 c7 80 13 d4 ac c6 05 43 9c dc 01
01 e8 a6 3e 06 00 <0f> 0b c3 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00
0f 1f 44 00 00
Sep 21 08:16:07 debian kernel: RSP: 0000:ffffbc8a406d3be0 EFLAGS: 00010286
Sep 21 08:16:07 debian kernel: RAX: 0000000000000000 RBX:
0000000000000000 RCX: 0000000000000027
Sep 21 08:16:07 debian kernel: RDX: ffff9afb38121788 RSI:
0000000000000001 RDI: ffff9afb38121780
Sep 21 08:16:07 debian kernel: RBP: ffffbc8a406d3c30 R08:
0000000000000000 R09: ffffbc8a406d3a60
Sep 21 08:16:07 debian kernel: R10: ffffffffad4b43a8 R11:
0000000000000003 R12: ffffffffc1e7ebc1
Sep 21 08:16:07 debian kernel: R13: ffffbc8a406d3c78 R14:
ffff9afa042756c0 R15: ffff9afa0bd1a118
Sep 21 08:16:07 debian kernel: FS:  00007ff847647980(0000)
GS:ffff9afb38100000(0000) knlGS:0000000000000000
Sep 21 08:16:07 debian kernel: CS:  0010 DS: 0000 ES: 0000 CR0:
0000000080050033
Sep 21 08:16:07 debian kernel: CR2: 00007f4cb80910a8 CR3:
0000000122d0c000 CR4: 00000000000426f0
Sep 21 08:16:07 debian kernel: Call Trace:
Sep 21 08:16:07 debian kernel:  <TASK>
Sep 21 08:16:07 debian kernel:  warn_thunk_thunk+0x1a/0x30
Sep 21 08:16:07 debian kernel:  getvar+0x20/0x70 [wl]
Sep 21 08:16:07 debian kernel:  ? orc_header+0x1628/0x1628 [wl]
Sep 21 08:16:07 debian kernel:  wl_module_init+0x23/0xb0 [wl]
Sep 21 08:16:07 debian kernel:  ? do_one_initcall+0x5b/0x310
Sep 21 08:16:07 debian kernel:  ? do_init_module+0x60/0x230
Sep 21 08:16:07 debian kernel:  ? init_module_from_file+0x89/0xe0
Sep 21 08:16:07 debian kernel:  ? idempotent_init_module+0x11e/0x310
Sep 21 08:16:07 debian kernel:  ? __x64_sys_finit_module+0x5e/0xb0
Sep 21 08:16:07 debian kernel:  ? do_syscall_64+0x82/0x190
Sep 21 08:16:07 debian kernel:  ? do_syscall_64+0x8e/0x190
Sep 21 08:16:07 debian kernel:  ? restore_fpregs_from_fpstate+0x3c/0xa0
Sep 21 08:16:07 debian kernel:  ? switch_fpu_return+0x4e/0xd0
Sep 21 08:16:07 debian kernel:  ? syscall_exit_to_user_mode+0x172/0x210
Sep 21 08:16:07 debian kernel:  ? do_syscall_64+0x8e/0x190
Sep 21 08:16:07 debian kernel:  ? entry_SYSCALL_64_after_hwframe+0x76/0x7e
Sep 21 08:16:07 debian kernel:  </TASK>
Sep 21 08:16:07 debian kernel: ---[ end trace 0000000000000000 ]---


Le 21/09/2025 à 03:45, Debian Bug Tracking System a écrit :