STM32H735-DK LWIP pbuf assertion issues

i2pi · ‎2025-06-09

I've been struggling with a variety of issues with FreeRTOS/LWIP/DHCP/MDNS, before I've even got to implement my application code (which will be a UDP app). I've read all of the documents that have been linked in the forums, I've gone through the official ST example code (a lot of which conflicts with what the documents say...) and I'm at my wits end. I've seen issues constantly being raised in the forums, all to do with memory management. These issues date back many years and while things might be solved for one person at one point in time, there is no telling if a solution from 2019 or 2021 applies in 2025. In this issue I'm trying to show the simplest example of a failure and am looking for guidance to not only fix the issue, but understand it and avoid it in future situation.

So, here we go:

I have the STM32H735-DK and am working with CubeIDE and CubeMX. I have started with the official stm32hotspot example. I have made the following changes:

Updated lwip.c to change the default IP address's to match my network. This allowed me to confirm that the device responds to pings with 0% packet loss.
Enabled semihosting, as per this guide
I opened the .ioc file in CubeMX 6.14.1 - I chose the Continue option and downloaded stm32_fw_h7_v1100.zip - which, for some reason takes hours...
I then enabled MEMP_ and MEM_SANITY_CHECK and set MEMP_ and MEM_OVERFLOW_CHECK to 2
As soon as the code runs I get the following messages on my serial console, and the program crashes in the HardFault handler:

Assertion "pbuf_free: p->ref > 0" failed at line 753 in ../Middlewares/Third_Party/LwIP/src/core/pbuf.c
Assertion "pc->custom_free_function != NULL" failed at line 767 in ../Middlewares/Third_Party/LwIP/src/core/pbuf.c

The hardfault stack trace is:

Thread #1 (Suspended : Signal : SIGTRAP:Trace/breakpoint trap)	
	HardFault_Handler() at stm32h7xx_it.c:91 0x800165c	
	<signal handler called>() at 0xfffffffd	
	0x0	
	pbuf_free() at pbuf.c:768 0x8007e7a	
	pbuf_free() at pbuf.c:725 0x8007e7a	
	ethernet_input() at ethernet.c:205 0x800e446	
	tcpip_thread_handle_msg() at tcpip.c:174 0x8006aba	
	tcpip_thread() at tcpip.c:148 0x8006aba	
	0x8006508

This is the most basic example. All I have added is serial monitoring and enabled the sanity checks. The code crashes quickly after the ethernet cable is attached.

I have attached a ZIP with my code.

i2pi · ‎2025-06-09

In an attempt to make the test case as small as possible, I've set:

MEM_OVERFLOW_CHECK to 0
Disabled MEM_SANITY_CHECK
Disabled MEMP_SANITY_CHECK

And even with MEMP_OVERFLOW_CHECK at 1 (not 2), the program still crashes the same way. I can get the program to continue running by forcing it not to dereference the NULL pointer (as below), but this feels like an unsatisfactory fix.

pbuf.c:765

 if ((p->flags & PBUF_FLAG_IS_CUSTOM) != 0) {
  struct pbuf_custom *pc = (struct pbuf_custom *)p;
  LWIP_ASSERT("pc->custom_free_function != NULL", pc->custom_free_function != NULL);
  # ADD THE if() TO AVOID CALLING A NULL FUNCTION POINTER :(
  if (pc->custom_free_function) pc->custom_free_function(p);
 } else

i2pi · ‎2025-06-09

lo and behold, disabling D Cache "fixes" the issue. This is a pretty unsatisfactory fix. My performance suffers and ping times have doubled.

See a post from the most gracious @pirhana where they outline the problems with ST's code: https://community.st.com/t5/stm32cubemx-mcus/lwip-v6-5-0-stmh32h735-disco-https-github-com-stm32-hotspot/m-p/91721