We’re hitting `morse_pageset_write failed to write page: -32768` repeatedly on STA enable. This is identical to the symptom in [Scan demo error messages](https://community.morsemicro.com/t/scan-demo-error-messages/) (Sep 2025). On that thread the staff response asked for a logic analyzer capture — we don’t have one available, so posting here in case (a) someone has since identified a software cause, (b) it was fixed in a later release, or (c) there’s a known config we’re missing.
-–
### Hardware
- **Host:** XIAO ESP32-S3, ESP-IDF v5.1.1
- **HaLow module:** Seeed Wio-WM6108 via EXT01 B2B carrier
- **Chip:** MM6108, reports chip ID `0x306`
- **Module variant:** Quectel FGH100M-H (using `bcf_fgh100mhaamd.mbin`)
- **Tested across multiple HaLow boards — every one shows the identical failure**, so this isn’t a single-unit hardware fault.
### Software
- `mm-iot-esp32` v2.8.2, pure upstream from the official GitHub tag `2.8.2`
- morselib v2.8.2-esp32, FW 1.15.3 (`mm6108.mbin`, 368996 bytes — MD5 matches upstream byte-for-byte)
- Linking `libmorse_nocrypto.a` with the mbedtls shim from `mm_shims/crypto_mbedtls_mm.c`
- SPI mode, 40 MHz, manual CS (`spics_io_num = -1`)
- Pin map (per the EXT01 schematic):
| Signal | GPIO |
|—|—|
| `MM_RESET_N` | 1 |
| `MM_WAKE` | 2 |
| `MM_SPI_IRQ` | 3 |
| `MM_SPI_CS` | 4 |
| `MM_BUSY` | 5 |
| `MM_SPI_SCK` | 7 |
| `MM_SPI_MISO` | 8 |
| `MM_SPI_MOSI` | 9 |
- `CONFIG_MM_BCF_FGH100MHAAMD=y`
- `CONFIG_MBEDTLS_NIST_KW_C=y`
- `CONFIG_SPIRAM_MALLOC_ALWAYSINTERNAL=16384`
- Country code `“US”`, regulatory domain set via `mmwlan_set_channel_list()` before boot
- AP uses **SAE**, passphrase ~17 chars
### What works
```
HaLow DBG: step 4 — mmwlan_boot()
Actual SPI CLK 40000kHz
HaLow DBG: step 4a — disabling 802.11 power save
HaLow DBG: power save disabled OK
HaLow DBG: step 4b — mmipal_init(DHCP)
Morse LwIP interface initialised. MAC address 3c:22:7f:37:4e:fd
HaLow DBG: mmipal initialized with DHCP, link callback registered
HaLow: chip ID = 0x306, fw = 1.15.3, lib = 2.8.2-esp32
HaLow: SSID=‘’ len=15 pass_len=17 security=SAE
HaLow: connection attempt 1/3 (50 s timeout)
```
FW binary uploads successfully (369 KB transfer with no SPI errors), chip ID and version read back correctly, mmipal initializes the LwIP netif, the chip’s MAC address is read. Every synchronous host->chip transaction works.
### What fails
The instant `mmwlan_sta_enable()` triggers the internal scan task:
```
E 5074 morse_pageset_write failed to write page: -32768
E 5074 morse_pageset_tx could not write 1 pkts - rc=-32768 items=1 pages=1
E 5674 morse_pageset_write failed to write page: -32768
E 5674 morse_pageset_tx could not write 1 pkts - rc=-32768 items=1 pages=1
E 6274 Command 44:f2 timed out
E 6274 Failed to execute START HW_SCAN command
… repeats with Command 800c:102, then Command 19:112 …
E 16082 Command 19:112 timed out
E 16082 Health check failed (errno=-116)
… MMOSAL Assert → reset → boot loop
```
`spi_device_transmit()` returns `ESP_OK` on every transfer at the host side, so the SPI transactions complete at the hardware level — the chip is receiving data but refusing to acknowledge any pageset write.
### Already ruled out
- **PSRAM DMA buffers.** Overrode `mmosal_malloc_` to use `heap_caps_malloc(MALLOC_CAP_INTERNAL | MALLOC_CAP_DMA)`. Separately added bounce-buffering in `mmhal_wlan_spi_write_buf` to catch any non-DMA-capable address. No change.
- **Multi-transaction CS atomicity.** Wrapped `cs_assert`/`cs_deassert` with `spi_device_acquire_bus`/`release_bus`. No change.
- **SPI clock.** 40 MHz is required; dropping to 20 MHz breaks transport init (`mmwlan_boot()` returns `err=1`). 40 MHz is well within the 50 MHz max.
- **Power save timing.** `mmwlan_set_power_save_mode(MMWLAN_PS_DISABLED)` called immediately after `mmwlan_boot()` returns `MMWLAN_SUCCESS`. Calling it *before* boot corrupts internal state and breaks transport init.
- **BUSY pin.** `CONFIG_MM_BUSY=5` (separate from `MM_SPI_IRQ=3`) per the EXT01 schematic. Setting both to GPIO 3 causes an interrupt-storm WDT timeout during boot, confirming they must be on different pins. With pulldown enabled BUSY reads LOW (= not busy) at all observed times.
- **SDK modifications.** Reverted our `mm-iot-esp32-v282` tree to byte-identical upstream `2.8.2` and re-applied only a minimal shared-SPI-bus refactor (~4-line diff in `wlan_hal.c` so an SD card can coexist on `SPI2_HOST`). Failure unchanged.
- **Single-board hardware fault.** Multiple HaLow boards tested; all fail identically.
### Asks
1. Is `morse_pageset_write -32768` documented internally as a known failure mode for FGH100M-H + SAE on morselib 2.8.2? Has it been fixed in 2.9.x / 2.10.x?
2. Was a root cause ever identified privately on the Sep 2025 thread above?
3. Is there a required mmwlan API call between `mmwlan_boot()` and `mmwlan_sta_enable()` for FGH100M-H specifically — `mmwlan_set_subbands_enabled`, an explicit BCF override, anything else?
4. Any chip-side debug we can enable (verbose log level, debug morselib build, config flag) to see *why* the chip rejects the writes?
Happy to provide additional logs or config dumps. Thanks! Morse_pageset_write -32768 / Command 44:f2 timeout on STA enable — FGH100M-H + ESP32-S3 SPI, reproducible across multiple boards