I'm still investigating this fully, but I think the equeue_unqueue function corrupts the linked list administration of the event queue if cancel is called on a event that is a sibling of the main linked list.
equeue_unqueue seems to assume &e->next == e->next->ref, which is no longer true on a sibling, as I think e->next is basicly invalid on a sibling (as e->next is also not updated if an entry is inserted after the parent of the sibling)
Not sure what a proper fix is yet. (Note, found this issue as part of mbed-os)
I'm still investigating this fully, but I think the equeue_unqueue function corrupts the linked list administration of the event queue if cancel is called on a event that is a sibling of the main linked list.
equeue_unqueue seems to assume
&e->next == e->next->ref, which is no longer true on a sibling, as I think e->next is basicly invalid on a sibling (as e->next is also not updated if an entry is inserted after the parent of the sibling)Not sure what a proper fix is yet. (Note, found this issue as part of mbed-os)