Dear Maintainer,

Kernel panic on resume from suspend (s2idle), inside the ath11k driver
for the Qualcomm QCNFA765 (WCN6855 hw2.1) WiFi card. The Debian Panic
Report page decoded the EFI pstore record and asked me to file this.

Hardware:
  Lenovo ThinkPad 21FECTO1WW, BIOS N3VET65W (1.65) 03/31/2026
  03:00.0 Network controller [0280]: Qualcomm QCNFA765 [17cb:1103] (rev 01)
  ath11k: wcn6855 hw2.1, fw_version 0x11088c35, fw_build_id
  WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41
  firmware-atheros 20260916-1~bpo13+1
  64 GB RAM, 64 GB swap

What led up to it:
  The machine had been up ~3.9 days (uptime 335267 s) through many
  suspend/resume cycles. I suspended it (s2idle) at 00:23 and resumed at
  ~11:21. The panic happened during that resume, ~20 s after wake.

Sequence from the pstore dmesg (full log attached):

  1. On resume, ath11k restarts its firmware (ath11k_core_restart ->
     ath11k_core_qmi_firmware_ready -> ath11k_dp_alloc).
  2. ath11k_dp_alloc does a kmalloc_large of order 8 (1 MiB contiguous,
     GFP_NOIO). It fails: the Normal zone had ~655 MB free but zero
     free blocks of 1024 kB or larger, i.e. fragmentation after long
     uptime. "ath11k_pci 0000:03:00.0: failed to init DP: -12".
  3. "firmware crashed: MHI_CB_EE_RDDM", then
     "failed to wait wlan mode request (mode 4): -110",
     "failed to reconfigure driver on crash recovery",
     "timeout while waiting for restart complete",
     "failed to resume core: -110",
     "PM: dpm_run_callback(): pci_pm_resume returns -110".
  4. Despite the PCI resume having failed, the async wiphy resume still
     runs: wiphy_resume -> ieee80211_reconfig -> drv_start ->
     ath11k_mac_op_start -> ath11k_wmi_pdev_set_param ->
     ath11k_wmi_cmd_send -> ath11k_htc_send -> ath11k_ce_send ->
     ath11k_hal_srng_access_begin, which reads through a ring pointer
     that was torn down (or never re-allocated) in step 2:

     BUG: unable to handle page fault for address: ffffccc04095d08c
     #PF: supervisor read access in kernel mode
     RIP: 0010:ath11k_hal_srng_access_begin+0x12/0x40 [ath11k]
     Kernel panic - not syncing: Fatal exception in interrupt

What I expected:
  A failed WiFi firmware restart on resume should leave me without
  WiFi, not take down the whole machine. The driver should refuse to
  start (or mac80211 should skip drv_start) when the DP/CE rings were
  not (re)allocated.

Notes:
  * The kernel is tainted O by the out-of-tree nvidia modules (595
    series, open kernel modules). The whole trace is in ath11k,
    mac80211 and the PM core, and the nvidia modules are not involved
    in the resume path shown. I can try to reproduce with nvidia
    blacklisted if that helps.
  * Possibly related upstream work (not verified against 7.2.9):
    - "wifi: ath11k: clear initialized flag for deinit-ed srng lists"
      (S. Senozhatsky, 2025-06), which describes page faults on resume
      from a stale srng ->initialized flag after a failed recovery:
https://lkml.iu.edu/hypermail/linux/kernel/2506.1/06721.html
    - 2026 ath-current series guarding copy-engine access against a
      cleared SRNG during crash recovery:
https://ratatoskr.run/linux-wireless/2026/08/17372778/t
  * This is the first time it panicked; the machine suspends/resumes
    several times a day on this kernel. The order-8 allocation failing
    is presumably what makes it rare.

Attached: panic-trace.txt, the Oops + panic records from
/var/lib/systemd/pstore (audit/lockdown noise removed).