`iwlist scan` crashes iwlwifi with a "Microcode SW error detected. Restarting 0x0." message

[costing]

Ubuntu 22.04.3 on a Lenovo ThinkPad X1 Carbon Gen 11
Kernel: 6.5 (official), 6.6 and 6.7 (mainline)

Running `iwlist scan` as root produces an error message like:
wlp0s20f3 Interface doesn't support scanning : Input/output error

while the crash can be seen in the dmesg output below. The network card is:

00:14.3 Network controller [0280]: Intel Corporation Device [8086:51f1] (rev 01)
        Subsystem: Intel Corporation Device [8086:0090]
        Flags: bus master, fast devsel, latency 0, IRQ 16, IOMMU group 10
        Memory at 603d1d4000 (64-bit, non-prefetchable) [size=16K]
        Capabilities: [c8] Power Management version 3
        Capabilities: [d0] MSI: Enable- Count=1/1 Maskable- 64bit+
        Capabilities: [40] Express Root Complex Integrated Endpoint, MSI 00
        Capabilities: [80] MSI-X: Enable+ Count=16 Masked-
        Capabilities: [100] Latency Tolerance Reporting
        Capabilities: [164] Vendor Specific Information: ID=0010 Rev=0 Len=014 <?>
        Kernel driver in use: iwlwifi
        Kernel modules: iwlwifi

dmesg output:

[ 23.883032] iwlwifi 0000:00:14.3: Microcode SW error detected. Restarting 0x0.
[ 23.883184] iwlwifi 0000:00:14.3: Start IWL Error Log Dump:
[ 23.883189] iwlwifi 0000:00:14.3: Transport status: 0x0000004B, valid: 6
[ 23.883195] iwlwifi 0000:00:14.3: Loaded firmware version: 83.e8f84e98.0 so-a0-gf-a0-83.ucode
[ 23.883200] iwlwifi 0000:00:14.3: 0x00000071 | NMI_INTERRUPT_UMAC_FATAL
[ 23.883205] iwlwifi 0000:00:14.3: 0x000002F0 | trm_hw_status0
[ 23.883209] iwlwifi 0000:00:14.3: 0x00000000 | trm_hw_status1
[ 23.883212] iwlwifi 0000:00:14.3: 0x004DB338 | branchlink2
[ 23.883215] iwlwifi 0000:00:14.3: 0x004DA866 | interruptlink1
[ 23.883219] iwlwifi 0000:00:14.3: 0x004DA866 | interruptlink2
[ 23.883221] iwlwifi 0000:00:14.3: 0x000157E2 | data1
[ 23.883225] iwlwifi 0000:00:14.3: 0x00000010 | data2
[ 23.883228] iwlwifi 0000:00:14.3: 0x00000000 | data3
[ 23.883231] iwlwifi 0000:00:14.3: 0x1F409941 | beacon time
[ 23.883234] iwlwifi 0000:00:14.3: 0x7ACBC6C4 | tsf low
[ 23.883237] iwlwifi 0000:00:14.3: 0x0000034B | tsf hi
[ 23.883240] iwlwifi 0000:00:14.3: 0x00000000 | time gp1
[ 23.883243] iwlwifi 0000:00:14.3: 0x0112D254 | time gp2
[ 23.883247] iwlwifi 0000:00:14.3: 0x00000001 | uCode revision type
[ 23.883250] iwlwifi 0000:00:14.3: 0x00000053 | uCode version major
[ 23.883253] iwlwifi 0000:00:14.3: 0xE8F84E98 | uCode version minor
[ 23.883256] iwlwifi 0000:00:14.3: 0x00000370 | hw version
[ 23.883259] iwlwifi 0000:00:14.3: 0x00480002 | board version
[ 23.883262] iwlwifi 0000:00:14.3: 0x8076FF00 | hcmd
[ 23.883265] iwlwifi 0000:00:14.3: 0x00020000 | isr0
[ 23.883268] iwlwifi 0000:00:14.3: 0x00000000 | isr1
[ 23.883270] iwlwifi 0000:00:14.3: 0x48F04002 | isr2
[ 23.883274] iwlwifi 0000:00:14.3: 0x00C3008C | isr3
[ 23.883276] iwlwifi 0000:00:14.3: 0x00000000 | isr4
[ 23.883279] iwlwifi 0000:00:14.3: 0x0518001C | last cmd Id
[ 23.883282] iwlwifi 0000:00:14.3: 0x000157E2 | wait_event
[ 23.883285] iwlwifi 0000:00:14.3: 0x00000000 | l2p_control
[ 23.883288] iwlwifi 0000:00:14.3: 0x00000000 | l2p_duration
[ 23.883291] iwlwifi 0000:00:14.3: 0x00000000 | l2p_mhvalid
[ 23.883294] iwlwifi 0000:00:14.3: 0x00000000 | l2p_addr_match
[ 23.883297] iwlwifi 0000:00:14.3: 0x00000018 | lmpm_pmg_sel
[ 23.883300] iwlwifi 0000:00:14.3: 0x00000000 | timestamp
[ 23.883303] iwlwifi 0000:00:14.3: 0x0000F0B4 | flow_handler
[ 23.883386] iwlwifi 0000:00:14.3: Start IWL Error Log Dump:
[ 23.883389] iwlwifi 0000:00:14.3: Transport status: 0x0000004B, valid: 7
[ 23.883393] iwlwifi 0000:00:14.3: 0x20103609 | ADVANCED_SYSASSERT
[ 23.883397] iwlwifi 0000:00:14.3: 0x00000000 | umac branchlink1
[ 23.883400] iwlwifi 0000:00:14.3: 0x80471ABC | umac branchlink2
[ 23.883403] iwlwifi 0000:00:14.3: 0xC0081892 | umac interruptlink1
[ 23.883406] iwlwifi 0000:00:14.3: 0x00000000 | umac interruptlink2
[ 23.883409] iwlwifi 0000:00:14.3: 0x00000027 | umac data1
[ 23.883412] iwlwifi 0000:00:14.3: 0x00000001 | umac data2
[ 23.883414] iwlwifi 0000:00:14.3: 0x00000000 | umac data3
[ 23.883417] iwlwifi 0000:00:14.3: 0x00000053 | umac major
[ 23.883420] iwlwifi 0000:00:14.3: 0xE8F84E98 | umac minor
[ 23.883423] iwlwifi 0000:00:14.3: 0x0112D24E | frame pointer
[ 23.883426] iwlwifi 0000:00:14.3: 0xC0886C08 | stack pointer
[ 23.883429] iwlwifi 0000:00:14.3: 0x0085010D | last host cmd
[ 23.883432] iwlwifi 0000:00:14.3: 0x00000000 | isr status reg
[ 23.883491] iwlwifi 0000:00:14.3: IML/ROM dump:
[ 23.883494] iwlwifi 0000:00:14.3: 0x00000B03 | IML/ROM error/state
[ 23.883553] iwlwifi 0000:00:14.3: 0x00008105 | IML/ROM data1
[ 23.883616] iwlwifi 0000:00:14.3: 0x00000090 | IML/ROM WFPM_AUTH_KEY_0
[ 23.883673] iwlwifi 0000:00:14.3: Fseq Registers:
[ 23.883726] iwlwifi 0000:00:14.3: 0x60000000 | FSEQ_ERROR_CODE
[ 23.883779] iwlwifi 0000:00:14.3: 0x003E0003 | FSEQ_TOP_INIT_VERSION
[ 23.883833] iwlwifi 0000:00:14.3: 0x00190003 | FSEQ_CNVIO_INIT_VERSION
[ 23.883886] iwlwifi 0000:00:14.3: 0x0000A652 | FSEQ_OTP_VERSION
[ 23.883939] iwlwifi 0000:00:14.3: 0x00000003 | FSEQ_TOP_CONTENT_VERSION
[ 23.883993] iwlwifi 0000:00:14.3: 0x4552414E | FSEQ_ALIVE_TOKEN
[ 23.884046] iwlwifi 0000:00:14.3: 0x00080400 | FSEQ_CNVI_ID
[ 23.884099] iwlwifi 0000:00:14.3: 0x00400410 | FSEQ_CNVR_ID
[ 23.884153] iwlwifi 0000:00:14.3: 0x00080400 | CNVI_AUX_MISC_CHIP
[ 23.884211] iwlwifi 0000:00:14.3: 0x00400410 | CNVR_AUX_MISC_CHIP
[ 23.884266] iwlwifi 0000:00:14.3: 0x00009061 | CNVR_SCU_SD_REGS_SD_REG_DIG_DCDC_VTRIM
[ 23.884322] iwlwifi 0000:00:14.3: 0x00000061 | CNVR_SCU_SD_REGS_SD_REG_ACTIVE_VDIG_MIRROR
[ 23.884375] iwlwifi 0000:00:14.3: 0x00190003 | FSEQ_PREV_CNVIO_INIT_VERSION
[ 23.884431] iwlwifi 0000:00:14.3: 0x003E0003 | FSEQ_WIFI_FSEQ_VERSION
[ 23.884482] iwlwifi 0000:00:14.3: 0x003E0003 | FSEQ_BT_FSEQ_VERSION
[ 23.884534] iwlwifi 0000:00:14.3: 0x000000DC | FSEQ_CLASS_TP_VERSION
[ 23.884594] iwlwifi 0000:00:14.3: UMAC CURRENT PC: 0x80493890
[ 23.884649] iwlwifi 0000:00:14.3: LMAC1 CURRENT PC: 0xd0
[ 23.884897] iwlwifi 0000:00:14.3: WRT: Collecting data: ini trigger 4 fired (delay=0ms).
[ 23.884910] ieee80211 phy0: Hardware restart was requested
[ 23.884976] iwlwifi 0000:00:14.3: FW error in SYNC CMD SCAN_REQ_UMAC
[ 23.884993] CPU: 9 PID: 2537 Comm: iwlist Not tainted 6.6.0-060600-generic #202311151808
[ 23.885000] Hardware name: LENOVO 21HNS1AH00/21HNS1AH00, BIOS N3XET48W (1.23 ) 11/01/2023
[ 23.885004] Call Trace:
[ 23.885008] <TASK>
[ 23.885014] dump_stack_lvl+0x48/0x70
[ 23.885030] dump_stack+0x10/0x20
[ 23.885039] iwl_trans_txq_send_hcmd_sync+0x1d5/0x370 [iwlwifi]
[ 23.885124] ? __pfx_autoremove_wake_function+0x10/0x10
[ 23.885133] iwl_trans_txq_send_hcmd+0xb8/0x170 [iwlwifi]
[ 23.885195] iwl_trans_send_cmd+0x81/0x110 [iwlwifi]
[ 23.885257] iwl_mvm_send_cmd+0x38/0xa0 [iwlmvm]
[ 23.885327] iwl_mvm_reg_scan_start+0x30a/0x420 [iwlmvm]
[ 23.885402] iwl_mvm_mac_hw_scan+0x50/0x80 [iwlmvm]
[ 23.885455] drv_hw_scan+0xbc/0x180 [mac80211]
[ 23.885605] __ieee80211_start_scan+0x28e/0x6a0 [mac80211]
[ 23.885732] ieee80211_request_scan+0x30/0x60 [mac80211]
[ 23.885859] ieee80211_scan+0x6b/0xf0 [mac80211]
[ 23.886004] rdev_scan+0x2a/0xe0 [cfg80211]
[ 23.886159] cfg80211_wext_siwscan+0x3a3/0x690 [cfg80211]
[ 23.886277] ? __kmalloc+0x54/0x180
[ 23.886284] ioctl_standard_iw_point+0x1d1/0x400
[ 23.886291] ? __pfx_cfg80211_wext_siwscan+0x10/0x10 [cfg80211]
[ 23.886408] ? check_heap_object+0x186/0x1e0
[ 23.886414] ? ioctl_standard_iw_point+0x210/0x400
[ 23.886419] ? __pfx_cfg80211_wext_siwscan+0x10/0x10 [cfg80211]
[ 23.886534] ioctl_standard_call+0xd0/0x140
[ 23.886539] ? __pfx_ioctl_private_call+0x10/0x10
[ 23.886545] ? __pfx_ioctl_standard_call+0x10/0x10
[ 23.886550] wireless_process_ioctl+0x1df/0x210
[ 23.886555] wext_handle_ioctl+0x168/0x1a0
[ 23.886561] sock_ioctl+0x124/0x340
[ 23.886566] ? rtnl_unlock+0xe/0x20
[ 23.886574] ? wext_handle_ioctl+0x186/0x1a0
[ 23.886579] __x64_sys_ioctl+0xa0/0xf0
[ 23.886586] do_syscall_64+0x59/0x90
[ 23.886593] ? syscall_exit_to_user_mode+0x37/0x60
[ 23.886602] ? exit_to_user_mode_prepare+0x30/0xb0
[ 23.886607] ? syscall_exit_to_user_mode+0x37/0x60
[ 23.886613] ? do_syscall_64+0x68/0x90
[ 23.886618] ? irqentry_exit_to_user_mode+0x17/0x20
[ 23.886624] ? irqentry_exit+0x43/0x50
[ 23.886630] ? exc_page_fault+0x94/0x1b0
[ 23.886636] entry_SYSCALL_64_after_hwframe+0x6e/0xd8
[ 23.886645] RIP: 0033:0x7d0a8a11a94f
[ 23.886698] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <41> 89 c0 3d 00 f0 ff ff 77 1f 48 8b 44 24 18 64 48 2b 04 25 28 00
[ 23.886702] RSP: 002b:00007ffdcf1b5b30 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 23.886708] RAX: ffffffffffffffda RBX: 00007ffdcf1b61a0 RCX: 00007d0a8a11a94f
[ 23.886711] RDX: 00007ffdcf1b5c10 RSI: 0000000000008b18 RDI: 0000000000000003
[ 23.886713] RBP: 0000566d43f3b2a0 R08: 0000000000000006 R09: 0033663032733070
[ 23.886716] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 23.886718] R13: 0000000000000009 R14: 00007ffdcf1b61a0 R15: 0000000000000000
[ 23.886723] </TASK>
[ 23.886728] iwlwifi 0000:00:14.3: Scan failed! ret -5
[ 23.886849] ------------[ cut here ]------------
[ 23.886855] WARNING: CPU: 5 PID: 11 at net/mac80211/scan.c:423 __ieee80211_scan_completed+0x345/0x370 [mac80211]
[ 23.887008] Modules linked in: ccm rfcomm l2tp_ppp l2tp_netlink xfrm_user l2tp_core xfrm_algo ip6_udp_tunnel udp_tunnel pppox cmac algif_hash algif_skcipher af_alg bnep btusb uvcvideo btrtl videobuf2_vmalloc btintel uvc videobuf2_memops btbcm videobuf2_v4l2 btmtk videodev bluetooth videobuf2_common mc ecdh_generic ecc snd_ctl_led snd_soc_skl_hda_dsp snd_soc_intel_hda_dsp_common snd_soc_hdac_hdmi snd_sof_probes snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic snd_soc_dmic snd_sof_pci_intel_tgl snd_sof_intel_hda_common soundwire_intel ipmi_devintf ipmi_msghandler snd_sof_intel_hda_mlink soundwire_cadence snd_sof_intel_hda snd_sof_pci snd_sof_xtensa_dsp snd_sof snd_sof_utils snd_soc_hdac_hda snd_hda_ext_core snd_soc_acpi_intel_match snd_soc_acpi soundwire_generic_allocation soundwire_bus snd_soc_core snd_compress ac97_bus snd_pcm_dmaengine snd_hda_intel intel_uncore_frequency intel_uncore_frequency_common snd_intel_dspcfg intel_tcc_cooling snd_intel_sdw_acpi iwlmvm snd_hda_codec x86_pkg_temp_thermal
[ 23.887088] intel_powerclamp joydev sunrpc snd_hda_core coretemp snd_hwdep mac80211 kvm_intel binfmt_misc snd_pcm snd_seq_midi libarc4 mei_pxp mei_hdcp snd_seq_midi_event kvm snd_rawmidi irqbypass processor_thermal_device_pci thinkpad_acpi snd_seq iwlwifi processor_thermal_device nvram pmt_telemetry processor_thermal_rfim rapl intel_rapl_msr pmt_class input_leds spi_nor think_lmi processor_thermal_mbox nls_iso8859_1 snd_seq_device ledtrig_audio intel_cstate processor_thermal_rapl mei_me serio_raw firmware_attributes_class wmi_bmof mtd platform_profile snd_timer cfg80211 intel_rapl_common intel_vsec hid_multitouch mei snd soundcore int3403_thermal soc_button_array int340x_thermal_zone mac_hid int3400_thermal acpi_thermal_rel intel_hid acpi_pad acpi_tad sparse_keymap sch_fq_codel msr parport_pc ppdev lp parport efi_pstore ip_tables x_tables autofs4 i915 drm_buddy i2c_algo_bit ttm crct10dif_pclmul hid_generic crc32_pclmul drm_display_helper polyval_clmulni polyval_generic cec ghash_clmulni_intel i2c_hid_acpi nvme
[ 23.887187] rc_core sha512_ssse3 i2c_hid ucsi_acpi intel_lpss_pci nvme_core aesni_intel drm_kms_helper hid intel_lpss typec_ucsi i2c_i801 xhci_pci spi_intel_pci crypto_simd cryptd psmouse thunderbolt spi_intel i2c_smbus idma64 xhci_pci_renesas nvme_common typec drm video wmi pinctrl_tigerlake
[ 23.887221] CPU: 5 PID: 11 Comm: kworker/u24:0 Not tainted 6.6.0-060600-generic #202311151808
[ 23.887226] Hardware name: LENOVO 21HNS1AH00/21HNS1AH00, BIOS N3XET48W (1.23 ) 11/01/2023
[ 23.887230] Workqueue: phy0 ieee80211_scan_work [mac80211]
[ 23.887360] RIP: 0010:__ieee80211_scan_completed+0x345/0x370 [mac80211]
[ 23.887492] Code: 18 00 48 85 c0 74 0c 48 8b 78 08 4c 89 e6 e8 c2 2e 05 00 65 ff 0d e3 50 d9 3e 0f 85 99 fe ff ff 0f 1f 44 00 00 e9 8f fe ff ff <0f> 0b 48 83 c4 10 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 d2 31 c9
[ 23.887496] RSP: 0018:ffffc90000127d90 EFLAGS: 00010246
[ 23.887501] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000001
[ 23.887503] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8881222f0900
[ 23.887506] RBP: ffffc90000127dc8 R08: 0000000000000000 R09: 0000000000000000
[ 23.887508] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8881222f0900
[ 23.887510] R13: ffff8881222f0900 R14: 0000000000000000 R15: ffff8881222f1c28
[ 23.887513] FS: 0000000000000000(0000) GS:ffff88844f480000(0000) knlGS:0000000000000000
[ 23.887516] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 23.887519] CR2: 00005e7ddb736004 CR3: 00000001ca63c000 CR4: 0000000000f50ee0
[ 23.887522] PKRU: 55555554
[ 23.887524] Call Trace:
[ 23.887528] <TASK>
[ 23.887533] ? show_regs+0x6d/0x80
[ 23.887542] ? __warn+0x89/0x160
[ 23.887548] ? __ieee80211_scan_completed+0x345/0x370 [mac80211]
[ 23.887680] ? report_bug+0x17e/0x1b0
[ 23.887690] ? handle_bug+0x51/0xa0
[ 23.887697] ? exc_invalid_op+0x18/0x80
[ 23.887702] ? asm_exc_invalid_op+0x1b/0x20
[ 23.887708] ? __ieee80211_scan_completed+0x345/0x370 [mac80211]
[ 23.887834] ieee80211_scan_work+0x16b/0x630 [mac80211]
[ 23.887960] ? __schedule+0x2d4/0x770
[ 23.887967] process_one_work+0x16c/0x350
[ 23.887973] worker_thread+0x306/0x440
[ 23.887977] ? __pfx_worker_thread+0x10/0x10
[ 23.887981] kthread+0xef/0x120
[ 23.887988] ? __pfx_kthread+0x10/0x10
[ 23.887993] ret_from_fork+0x44/0x70
[ 23.887998] ? __pfx_kthread+0x10/0x10
[ 23.888003] ret_from_fork_asm+0x1b/0x30
[ 23.888009] </TASK>
[ 23.888011] ---[ end trace 0000000000000000 ]---
[ 24.387242] iwlwifi 0000:00:14.3: WRT: Invalid buffer destination
[ 24.544749] iwlwifi 0000:00:14.3: WFPM_UMAC_PD_NOTIFICATION: 0x20
[ 24.544797] iwlwifi 0000:00:14.3: WFPM_LMAC2_PD_NOTIFICATION: 0x1f
[ 24.544861] iwlwifi 0000:00:14.3: WFPM_AUTH_KEY_0: 0x90
[ 24.544988] iwlwifi 0000:00:14.3: CNVI_SCU_SEQ_DATA_DW9: 0x0
[ 24.546445] iwlwifi 0000:00:14.3: RFIm is deactivated, reason = 4