CC2642R: Calling gapBondMgrReadBondRec() causes Hwi exception at next disconnection

Hi Clement,

I think I have been able to locate the problem. In gapBondMgrReadBondRec() it calls osal_snv_read to read out the characteristic configuration to charCfg, the size of this variable should be sizeof(gapBondCharCfg_t) * gapBond_maxCharCfg:

    // Load the characteristic configuration
    VOID osal_snv_read(GATT_CFG_NV_ID(idx), sizeof(gapBondCharCfg_t) * gapBond_maxCharCfg, charCfg);

However in the demo code from BLE5-Stack User's Guide, the input variable charCfg for gapBondMgrReadBondRec() is just a variable of struct gapBondCharCfg_t:

static gapBondCharCfg_t charCfg;

uint8_t readStatus = FAILURE;
readStatus = gapBondMgrReadBondRec(pPeerAddrType,
                                   peerDeviceAddr,
                                   &pSavedBondRec,
                                   &pLocalLtk,
                                   &pPeerLtk,
                                   pPeerIRK,
                                   pPeerSRK,
                                   pPeerSignCount,
                                   &charCfg);

This mismatched variable size leads to the variable next to charCfg be overwritten unintentionally, in my case paramUpdateList, and ends up with the bus fault when paramUpdateList is read in SimplePeripheral_clearPendingParamUpdate.

I have a simple fix by changing charCfg to an array of 4 before calling gapBondMgrReadBondRec(), where 4 equals the static variable gapBond_maxCharCfg in gapbondmgr.c. This may not be elegant but it fixed the hardfault.

static gapBondCharCfg_t charCfg[4]; // 4 = gapBond_maxCharCfg in gapbondmgr.c

uint8_t readStatus = FAILURE;
readStatus = gapBondMgrReadBondRec(pPeerAddrType,
                                   peerDeviceAddr,
                                   &pSavedBondRec,
                                   &pLocalLtk,
                                   &pPeerLtk,
                                   pPeerIRK,
                                   pPeerSRK,
                                   pPeerSignCount,
                                   //&charCfg);
                                   charCfg);

In gapbondmgr.c, similar implementation can also be found by allocate memory of sizeof (gapBondCharCfg_t) * gapBond_maxCharCfg for the pointer charCfg:

    // Space to read a char cfg record from NV
    gapBondCharCfg_t *charCfg = (gapBondCharCfg_t *)MAP_osal_mem_alloc( sizeof (gapBondCharCfg_t) * gapBond_maxCharCfg );

Maybe can we consider to fix the demo code in the chapter of Extract Bonding Information in future SDK release?

Best regards,

Shuyang