[BUG] btmtk: MT7925 (0e8d:e025) firmware ASSERT in sys_log_interface_emi.c #1185 during A2DP streaming, regression since fw 20260605184935

[overfion]

Hi,

The MT7925 Bluetooth firmware on my laptop asserts several times per day
while streaming A2DP to a headset. btmtk collects a coredump, btusb
resets the USB device and the controller re-enumerates as a new hciN,
dropping the headset.

Hardware:  Lenovo ThinkPad P14s Gen 6 AMD (21QMS1HT00), BIOS R2XET42W (1.22) 2026-09-07
Chip:      MT7925, BT over USB 0e8d:e025 (WiFi on PCIe 14c3:7925, mt7925e)
BT fw:     BT_RAM_CODE_MT7925_1_1_hdr.bin, Build Time 20260813113236
           (t-neptune-main-mt7925-2249-MT7925_E1_ASIC_ROM_RAM_CE_2249_CCN16-20260813112803)
Kernels:   reproduced on Arch linux, linux-lts, linux-zen and CachyOS linux
           kernels, 7.0.12 through 7.2.9
Userspace: bluez 5.87, pipewire + wireplumber
Headset:   Logitech G435, A2DP sink, AAC codec
WiFi:      connected on 5 GHz (channel 48)

Firmware assert (identical in every dump I collected):

  <ASSERT> ../bluetooth/system/debug/sys_log_interface_emi.c #1185 - 0, 0x6454,
  0x1010707, 0xFF150001, BTSYS, id=0x0 idle, isr=0x943CA8, irq=0x3,
  lr=0x960AC8, asr_t=103074398
  ;etype:ASSERT, sp=0x2215A30, lp=0x960AC8
  ;exp_main: jump from cos_assert

A btmon capture shows no HCI commands from the host in the 316 seconds
before the assert, only A2DP ACL data (dlen ~530-555, every ~21 ms) and
Number of Completed Packets events. The assert fires in ISR context in
the firmware's log/EMI path, not in response to a host command.

Kernel side:

  Bluetooth: hci0: Mediatek coredump end
  usb 3-5.1: reset high-speed USB device number 5 using xhci_hcd
  Bluetooth: hci1: HW/SW Version: 0x00000000, Build Time: 20260813113236
  Bluetooth: hci1: Device setup in 1750899 usecs

Sometimes it asserts again seconds after recovery, followed by a
command timeout and another reset:

  Bluetooth: hci1: Mediatek coredump end
  Bluetooth: hci1: Opcode 0x2039 failed: -110
  usb 3-5.1: reset high-speed USB device number 5 using xhci_hcd

Regression: no failures on fw 20260414153243 (5 weeks, same headset and
usage). Failures started the day 20260605184935 was installed and
continue on 20260813113236.

Already tried, no effect: btusb.enable_autosuspend=0, mt7925e
disable_aspm=1, WiFi power save off.

I have 2 devcoredumps (~1 MB each) and the btmon capture (12 MB). I can
send them off-list, test firmware builds or patches, or collect more
traces.

Thanks,
fion