# Sway crash when HDMI is plugged into the landscape image

Board: second board, keyboard case, installed landscape profile
(`.#kernelMainlineDrmShellLandscapeBootFiles`), 2026-10-14.

## Operator report

Operator, 2026-10-14: "hdmi didn't work idk why i plugged it up … nothing
happened", then "i had to unplug the hdmi, the board showed a white screen and
when i unplugged it rebooted" / "it might not have been reboot might've been
shell crashing".

## What the journal shows (evidence class: board-read)

`journalctl` on the board, cable plugged at 02:58:41 CDT (trimmed):

```
02:58:41 sway[1052]: [wlr] [backend/drm/backend.c:139] Received hotplug event for /dev/dri/card0
02:58:41 sway[1052]: [wlr] [backend/drm/drm.c:1778] Scanning DRM connector 52 on /dev/dri/card0
02:58:41 sway[1052]: [wlr] [backend/drm/drm.c:1869] 'DSI-1' disconnected
02:58:41 sway[1052]: [sway/card_shell.c:631] K230_CARD_SHELL mirror-release id=5
02:58:41 sway[1052]: [sway/desktop/transaction.c:821] Transaction 0x2fa2b867d0 committing with 1 instructions
02:58:41 sway[1052]: [sway/desktop/transaction.c:717] Applying transaction 0x2fa2b867d0
02:58:41 kernel: sway[1052]: unhandled signal 11 code 0x1 at 0x0000000000000068 in libwlroots-0.20.so[7fcd0,36be735000+135000]
02:58:41 kernel: epc : 00000036be7b4cd0 ra : 0000002fa2836c7e … a0 : 0000000000000000
02:58:41 systemd-coredump[1226]: Process 1052 (sway) of user 1000 terminated abnormally with signal 11/SEGV, processing...
02:59:38 systemd[1]: shell.service: The kernel OOM killer killed some processes in this unit.
```

The kernel did not reboot. Sway crashed. systemd-coredump then read the
~600 MB core of Sway's shared memory, which ran the board out of memory, and
the OOM killer took the rest of the session. The session restarted at
03:00:03, which looked like a reboot from the glass.

Symbolized from the core (host, against the deployed store paths): `epc` is
`wlr_scene_output_set_position+0xa` in wlroots (load base `0x36be735000`,
offset `0x7fcd0`), dereferencing a NULL `scene_output` (`a0 = 0`,
`badaddr 0x68`). `ra` is in Sway's `transaction_progress`, reached through
`arrange_root`. Sway's base came from `gp = 0x2fa28a14f8`.

Sequence: wlroots tore down `DSI-1`. Sway's output teardown cleared that
output's `scene_output` but had not yet removed it from `root->outputs`. Sway
then called `card_shell_output_disable`, which left the card overview through
`restore()`. `restore()` committed a transaction, `arrange_root()` walked
`root->outputs`, and passed the half-destroyed output's NULL `scene_output` to
`wlr_scene_output_set_position()`.

Two questions are still open, and HDMI task 8.7 depends on them. Why did the
kernel's HPD worker report `DSI-1` disconnected? And did it ever report
`HDMI-A-1` connected? Only connector 52 (`DSI-1`) was scanned before the crash.

## Fix

`nix/card-shell/adapter.c`: `handle_output_destroy` sets `output_teardown`
around `cs_leave`, and `restore()` skips `transaction_commit_dirty()` while it
is set. Sway commits its own transaction once it has moved the output's
workspaces.

## Forced disconnect on the fixed build (evidence class: injected, sysfs)

Deployed system `/nix/store/i7r10d4x…` (bundle `bundle-teardown`). The overview
was opened with `swaymsg card_shell enter`, then
`echo off > /sys/class/drm/card0-DSI-1/status`, 08:57 CDT:

```
08:57:01 sway[1069]: [wlr] [backend/drm/drm.c:1869] 'DSI-1' disconnected
08:57:01 sway[1069]: [sway/card_shell.c:1928] K230_CARD_SHELL restored focus=5 message=0
08:57:01 sway[1069]: [sway/tree/output.c:290] Disabling output 'DSI-1'
08:57:01 sway[1069]: [sway/tree/output.c:307] Destroying output 'DSI-1'
08:57:01 sway[1069]: [wlr] [backend/drm/drm.c:984] connector DSI-1: Turning off
08:57:02 sway[1069]: [sway/config/output.c:1072] Commit of 0 outputs succeeded
08:57:06 sway[1069]: [wlr] [backend/drm/drm.c:1861] 'DSI-1' connected
08:57:06 sway[1069]: [sway/desktop/output.c:570] New output 0x36c967ff10: DSI-1 (non-desktop: 0)
```

Sway kept PID 1069 the whole time, and the journal has no `unhandled signal`.
`echo detect` brought the panel back: `swaymsg -t get_outputs` showed `DSI-1`
active with transform 270. A native `grim` capture afterwards was 1232×568 and
showed the terminal card that had focus in the overview (`focus=5`), restored
in front.

Limits: the forced status drives the same teardown path (output destroyed while
the overview is active), but this is not a cable plug. The unfixed build was
not run through the forced test. HDMI output on the landscape image had not
been observed at this point; see the cable test below.

## Cable plug and unplug on the fixed build (physical: operator + native capture)

Same deployed system, 09:38–09:40 CDT, HP 27wm monitor. Sway kept PID 1069
throughout.

Plug, 09:38:19–21 (board journal):

```
09:38:19 [wlr] [backend/drm/drm.c:1869] 'DSI-1' disconnected
09:38:19 [sway/tree/output.c:307] Destroying output 'DSI-1'
09:38:20 [wlr] [backend/drm/drm.c:1778] Scanning DRM connector 54 on /dev/dri/card0
09:38:20 [wlr] [backend/drm/drm.c:1861] 'HDMI-A-1' connected
09:38:21 kernel: input: K230 Virtual Touchpad (HDMI mode) as /devices/virtual/input/input3
09:38:21 [sway/config/output.c:1080] Finalizing config for HDMI-A-1
```

The kernel's hotplug handling reported HDMI about a second after the panel
dropped. `swaymsg -t get_outputs` showed `HDMI-A-1` at 1280x800 @ 59.910 Hz,
transform 90: the existing HDMI arrangement, unchanged by the landscape panel
transform. `hdmi-plugged-grim.png` (800×1280) is the native capture: the
terminal that had focus, upright in portrait. libinput logged its usual
rate-limited "Touch jump" and "lagging behind" messages for the relay while the
operator used it.

Unplug, 09:40:02: `DSI-1` reconnected and Sway first tried to commit both
outputs. That failed because no CRTC or dumb buffer was free for HDMI. Sway
then processed `'HDMI-A-1' disconnected`, removed the relay touchpad, and the
single-output commit for `DSI-1` succeeded. The panel driver logged
`RDDID (0x04) failed: -22` and `RDDPM (0x0A) failed: -110` during the panel's
re-enable, and the panel still came up. `DSI-1` was then active at 568x1232,
transform 270. `panel-after-unplug-grim.png` (1232×568) is the native capture.

Operator, 2026-10-14, after plugging in, using the relay and unplugging:
"yeah it's good to go".