It is reproducible by triggering a firmware crash while there is an active connection — userspace immediately attempts a scan via nl80211 while the firmware is still powering on through MHI. I iwill also fix the radio[0] issue here for v2. Thanks Best regards José Ignacio