Potential Bugs

[RealManShao]

P1 — High priority

Issue	Location
IWDG starts before lengthy IMU calibration, potentially causing a boot-reset loop	Core/Src/main.c:117-119, application/sentry/robot.c:24-29
HardFault handler returns to corrupted execution instead of safely resetting	Core/Src/stm32h7xx_it.c:101-111
CHASSIS_ZERO_FORCE still applies velocity references, allowing unintended movement	application/chassis/agv_chassis.c:277-286
Remote/VTM commands have no freshness timeout; stale movement/fire commands persist after link loss	application/cmd/vtm_cmd.c:137-241, module/remote/remote_control.c:94-136, module/referee/vtm_26.c:87-114
Motor feedback watchdog is disabled; PID can continue applying current after CAN/encoder loss	module/motor/DJImotor/dji_motor.c:157,213-222,259-338
Watchdog refresh is unconditional and does not verify control-task health	application/*/robot.c:58-62
SPI/IIC registration limits exceed pointer-array sizes, causing memory corruption	bsp/spi/bsp_spi.c:6-37, bsp/iic/bsp_iic.c:6-24
CAN communication lengths can overflow fixed 64-byte buffers	module/can_comm/can_comm.c:85-91
Partial UART frames are decoded as complete 18-byte remote-control frames	bsp/usart/bsp_usart.c:107-119, module/remote/remote_control.c:35-55
Malformed referee-frame lengths can wrap the parser offset to zero and lock interrupt processing	module/referee/referee_26.c:53-59,132-135, module/referee/vtm_26.c:57-72
Async SPI transmit never releases chip-select on completion	bsp/spi/bsp_spi.c:41-63,156-185
Fire-cease/release does not reliably disable friction wheels or preserve a requested single shot	application/shoot/auto_ammo_booster.c:271-305, application/shoot/ammo_booster.c:405-424
Gimbal and XM-motor tasks concurrently modify/send the same CAN frame	application/gimbal/2yaw_gimbal.c:123-125, module/motor/XMmotor/xm_motor.c:281-285,353-375
BMI088 gyro calibration offsets are calculated but never applied	module/BMI088/bmi088.c:252-266,343-405
Startup orientation can normalize a zero vector, injecting NaNs into control state	module/imu/ins_task.c:55-62, module/algorithm/user_lib.c:166-172

P2 — Medium priority

• GIMBAL_LOCK continues using incoming pitch commands: application/gimbal/2yaw_gimbal.c:98-125
• BMI088 reset delay becomes zero; initialization can retry forever: module/BMI088/bmi088.c:119-125,446-454
• BMI088 DMA buffers are decoded before transfer completion: module/BMI088/bmi088.c:209-239,271-287
• Invalid power constraints can produce sqrt(negative) and NaN motor commands: module/motor/power_control.c:279-317
• Servo ID handling can dereference null slots and always transmits ID 1: module/motor/servo_motor/servo_motor.c:35-74
• CAN reassembly reads headers from frames shorter than two bytes: module/can_comm/can_comm.c:31-33
• Fragmented CAN sends ignore individual transmission failures: module/can_comm/can_comm.c:116-121
• Referee commands copy fixed payload sizes without validating declared length: module/referee/referee_26.c:68-126
• UI formatting uses unbounded vsprintf into a 30-byte buffer: module/referee/referee_UI_26.c:335-340
• IIC hold/release enum values are identical: bsp/iic/bsp_iic.h:26-30
• USB transmit drops busy/error status and may silently lose packets: bsp/usb/bsp_usb.c:29-32
• Several allocation results are dereferenced without null checks
• Daemon’s normalized startup timeout is immediately overwritten: module/daemon/daemon.c:17-22

P3 — Low priority

• Message-center topic cap is declared but never enforced: module/message_center/message_center.c:39-65
• IIC registration allocates twice and leaks the first allocation: bsp/iic/bsp_iic.c:14-16

The highest-value fixes are the zero-force behavior, stale-command failsafes, motor-feedback watchdog, HardFault handling, and registration buffer corruption.