TBS 6209SE (tbsecp3 + cxd2878) kernel GPF / hang on ISDB-T tune under Unraid kernel 6.18.38

[ryanpaul1]

Summary

Using a TBS 6209SE (Octa DVB-T/T2/C/C2/ISDB-T/C/ATSC PCIe tuner) on Unraid, kernel 6.18.38-Unraid, with the official tbsos (TBS-OpenSource) driver package built specifically for this kernel version (via the unraid-dvb-driver plugin, release 6.18.38-Unraid).

Attempting to tune ISDB-T muxes (Philippines DTT frequencies, e.g. 479.143 MHz / 497.143 MHz) via TVHeadend 4.3 causes a kernel general protection fault inside cxd2878_set_frontend, which crashes the frontend kernel thread (kdvb-ad-X-fe-0). After the crash, the tuner adapter becomes unusable until a full host reboot. On subsequent boots, even basic frontend enumeration (before any tuning is attempted) hangs indefinitely in dvb_frontend_do_ioctl, blocking TVHeadend's startup entirely (its embedded web server never becomes reachable).

Environment

• Card: TBS 6209SE (Octa DVB-T/T2/C/C2/ISDB-T/C/ATSC), confirmed via lspci: 05:00.0 Multimedia controller: TBS Technologies DVB Tuner PCIe Card
• Driver package: TBS-OpenSource (tbsos), installed via Unraid's dvb-driver plugin, package built for kernel 6.18.38-Unraid (matches running kernel exactly)
• OS: Unraid, kernel 6.18.38-Unraid
• Application: TVHeadend 4.3-2794~g5ce3ff63c (linuxserver/tvheadend Docker image), device nodes passed through via --device=/dev/dvb:/dev/dvb
• 8 adapters detected and functional at enumeration in dmesg on cold boot (adapter0-adapter7, each showing Detect CXD2878/CXD6802(SiP) chip)

Steps to reproduce

1. Fresh Unraid boot with TBS 6209SE installed, tbsos driver loaded cleanly (confirmed via dmesg, all 8 adapters + /dev/dvb/adapter0-7 present)
2. In TVHeadend, create an ISDB-T network (no predefined Philippines mux list available, so muxes added manually)
3. Add 2 muxes: 497.143 MHz and 479.143 MHz (bandwidth left on AUTO)
4. Link an ISDB-T frontend instance to the network via the adapter's Networks dropdown, save
5. TVHeadend immediately begins a scan/tune attempt on both muxes
6. Kernel GPF occurs within seconds

Crash trace (first occurrence, during active tune)

RIP: 0010:cxd2878_set_frontend+0x830/0x1180 [cxd2878]
Call Trace:
 <TASK>
 cxd2878_tune+0x27/0x910 [cxd2878]
 dvb_frontend_thread+0x241/0x430 [dvb_core]
 kthread+0x1ce/0x1e0
 ret_from_fork+0x24/0x170
 ret_from_fork_asm+0x1a/0x30
</TASK>
note: kdvb-ad-0-fe-0[426226] exited with irqs disabled

Immediately preceded in dmesg by:

i2c i2c-3: cxd2878: SLtoAIT_BandSetting error !

Second occurrence (after host reboot, different adapter, same signature)

cxd2878_set_frontend+0x830/0x1180 [cxd2878]
cxd2878_tune+0x27/0x910 [cxd2878]
dvb_frontend_thread+0x241/0x430 [dvb_core]
note: kdvb-ad-5-fe-0[14710] exited with irqs disabled

Again preceded by cxd2878: SLtoAIT_BandSetting error !

Attempted mitigations (did not resolve)

1. Set Bandwidth explicitly to 6MHz for ISDB-T (per TBS's own documented fix for this exact error at https://www.tbsiptv.com/help_center/troubleshooting/dvb_receiving.html) — could not verify this actually applied before the driver hung again on next boot (see below), so not fully ruled out, but the underlying SLtoAIT_BandSetting error signature is exactly what that KB article describes, and yet the crash reproduced. Bandwidth may need to be set differently, or the KB fix may be incomplete for this specific kernel/driver build.
2. Disabling initscan/idlescan on the ISDB-T frontend config (TVHeadend input/linuxdvb/adapters/* JSON) to prevent auto-resume of the crashing scan on container/app restart — did not prevent the issue; on next start, TVHeadend's process hung indefinitely in dvb_frontend_do_ioctl (visible via ps -eLo pid,tid,stat,wchan,comm), even with the frontend's initscan/idlescan both false.
3. Disabling the ISDB-T frontend entirely (enabled: false in its config) — still hung in the same dvb_frontend_do_ioctl wait state on next TVHeadend startup, suggesting basic frontend probing/enumeration itself (not just active tuning) can trigger the hang.
4. Full host reboot — resets kernel state and driver loads cleanly again, but the crash is 100% reproducible again once ISDB-T tuning is attempted.

Question / request

Is this a known issue with the cxd2878 demodulator driver on ISDB-T mode specifically (as opposed to DVB-T/T2/C, which this card also supports)? Is there a recommended parameter/module option (similar to enable_msi=0 for the i2c-write issue documented in TBS's KB) that avoids the SLtoAIT_BandSetting GPF for ISDB-T tuning? Happy to provide additional dmesg output, TVHeadend logs, or test further configurations if useful for diagnosis.

Referenced related issue for the same card model (different symptom, DVB-C, no crash): #394