Morphius: kernel NULL pointer dereference

Hello, my ThinkPad C13 Yoga Gen 1 Chromebook (Morphius) has an issue where it randomly gets a kernel NULL pointer deference during boot. A rough estimate is that this happens in about 3 out of 4 boot attempts. When this happens, this can result in anything from the touchpad and touchscreen not working to being dropped in an emergency shell. I have verified that this issue reproduces in the latest mainline kernel (6.9.0-rc2).

Here are the full log output of one of those cases: https://guacamolie.nl/tesei8ohJ1keegah4boh.txt

The NULL pointer exception part is as follows:

[   13.717875] kernel: BUG: kernel NULL pointer dereference, address: 0000000000000000
[   13.718883] kernel: #PF: supervisor read access in kernel mode
[   13.719670] kernel: #PF: error_code(0x0000) - not-present page
[   13.720422] kernel: PGD 0 P4D 0 
[   13.721126] kernel: Oops: 0000 [#1] PREEMPT SMP NOPTI
[   13.721797] kernel: CPU: 3 PID: 586 Comm: kworker/u32:4 Not tainted 6.9.0-rc2-1-mainline #1 4c361158dea5838a7441c4025165296045a48154
[   13.722474] kernel: Hardware name: Google Morphius/Morphius, BIOS MrChromebox-4.22.2-1-g2a93624aebf 01/22/2024
[   13.723146] kernel: Workqueue: events_unbound flush_to_ldisc
[   13.723835] kernel: RIP: 0010:ttyport_receive_buf+0x52/0xe0
[   13.724579] kernel: Code: 45 31 e4 a8 02 75 10 5b 4c 89 e0 5d 41 5c 41 5d 41 5e e9 b1 74 52 00 48 8b bd 00 03 00 00 48 85 ff 74 e4 48 8b 87 00 03 00 00 <48> 8b 00 48 85 c0 74 d5 48 89 da e8 0e 6e 52 00 49 89 c5 48 39 c3
[   13.725325] kernel: videodev: Linux video capture interface: v2.00
[   13.725334] kernel: RSP: 0018:ffffb6dd42c23e00 EFLAGS: 00010286
[   13.726909] kernel: RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000001
[   13.727698] kernel: RDX: 0000000000000000 RSI: ffff8a3c86a4bc20 RDI: ffff8a3cc4472800
[   13.728460] kernel: RBP: ffff8a3cc4473400 R08: ffff8a3c86a4bc20 R09: ffff8a3c86bc2440
[   13.729217] kernel: R10: 000000000000000f R11: fefefefefefefeff R12: 0000000000000000
[   13.730008] kernel: R13: ffff8a3c80d4c898 R14: ffff8a3c80d4c8c0 R15: 0000000000000000
[   13.730838] kernel: FS:  0000000000000000(0000) GS:ffff8a3dabb80000(0000) knlGS:0000000000000000
[   13.731683] kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   13.732512] kernel: CR2: 0000000000000000 CR3: 0000000101f3a000 CR4: 00000000003506f0
[   13.733445] kernel: Call Trace:
[   13.734377] kernel:  <TASK>
[   13.735279] kernel:  ? __die+0x23/0x70
[   13.736315] kernel:  ? page_fault_oops+0x173/0x580
[   13.737462] kernel:  ? exc_page_fault+0x7e/0x180
[   13.738649] kernel:  ? asm_exc_page_fault+0x26/0x30
[   13.739740] kernel:  ? ttyport_receive_buf+0x52/0xe0
[   13.740750] kernel:  flush_to_ldisc+0x9b/0x180
[   13.741697] kernel:  process_one_work+0x193/0x3c0
[   13.742689] kernel:  worker_thread+0x3a9/0x4f0
[   13.743677] kernel:  ? __pfx_worker_thread+0x10/0x10
[   13.744646] kernel:  kthread+0xd2/0x100
[   13.745638] kernel:  ? __pfx_kthread+0x10/0x10
[   13.746547] kernel:  ret_from_fork+0x34/0x50
[   13.747466] kernel:  ? __pfx_kthread+0x10/0x10
[   13.748397] kernel:  ret_from_fork_asm+0x1a/0x30
[   13.749277] kernel:  </TASK>
[   13.750166] kernel: Modules linked in: drm_display_helper(+) typec snd_pcm_dmaengine snd_acp_config snd_hwdep roles ecdh_generic videodev cros_usbpd_notify snd_soc_acpi cros_ec_uart cros_kbd_led_backlight cec chromeos_tbmc sp5100_tco snd_pcm videobuf2_common i2c_cros_ec_tunnel vfat rapl fat mc psmouse pcspkr snd_timer acpi_cpufreq crc16 cros_ec_lpcs snd_pci_acp3x amd_sfh video k10temp i2c_piix4 rfkill snd wmi cros_ec i2c_hid_acpi soundcore elan_i2c i2c_hid tpm_tis_i2c_cr50 coreboot_table 8250_dw mac_hid pkcs8_key_parser crypto_user fuse loop nfnetlink zram ip_tables x_tables dm_crypt cbc encrypted_keys trusted asn1_encoder tee dm_mod crct10dif_pclmul crc32_pclmul polyval_clmulni polyval_generic gf128mul ghash_clmulni_intel sha512_ssse3 serio_raw sha256_ssse3 sdhci_pci atkbd sha1_ssse3 aesni_intel libps2 cqhci vivaldi_fmap nvme crypto_simd sdhci cryptd nvme_core xhci_pci mmc_core ccp i8042 xhci_pci_renesas nvme_auth serio gpio_keys btrfs blake2b_generic libcrc32c crc32c_generic crc32c_intel xor raid6_pq
[   13.755537] kernel: CR2: 0000000000000000
[   13.756650] kernel: ---[ end trace 0000000000000000 ]---
[   13.757717] kernel: RIP: 0010:ttyport_receive_buf+0x52/0xe0
[   13.758779] kernel: Code: 45 31 e4 a8 02 75 10 5b 4c 89 e0 5d 41 5c 41 5d 41 5e e9 b1 74 52 00 48 8b bd 00 03 00 00 48 85 ff 74 e4 48 8b 87 00 03 00 00 <48> 8b 00 48 85 c0 74 d5 48 89 da e8 0e 6e 52 00 49 89 c5 48 39 c3
[   13.759807] kernel: RSP: 0018:ffffb6dd42c23e00 EFLAGS: 00010286
[   13.760906] kernel: RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000001
[   13.762046] kernel: RDX: 0000000000000000 RSI: ffff8a3c86a4bc20 RDI: ffff8a3cc4472800
[   13.763221] kernel: RBP: ffff8a3cc4473400 R08: ffff8a3c86a4bc20 R09: ffff8a3c86bc2440
[   13.764397] kernel: R10: 000000000000000f R11: fefefefefefefeff R12: 0000000000000000
[   13.765673] kernel: R13: ffff8a3c80d4c898 R14: ffff8a3c80d4c8c0 R15: 0000000000000000
[   13.766836] kernel: FS:  0000000000000000(0000) GS:ffff8a3dabb80000(0000) knlGS:0000000000000000
[   13.768066] kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   13.768070] kernel: CR2: 0000000000000000 CR3: 0000000101f3a000 CR4: 00000000003506f0
[   13.768073] kernel: note: kworker/u32:4[586] exited with irqs disabled

Let me you if you have any questions or things you would like me to try.