00:14.3 Network controller [0280]: Intel Corporation Wireless-AC 9560 [Jefferson Peak] [8086:a370] (rev 10)
    Subsystem: Intel Corporation Device [8086:02a4]
    Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
    Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
    Latency: 0, Cache Line Size: 64 bytes
    Interrupt: pin A routed to IRQ 16
    Region 0: Memory at a4314000 (64-bit, non-prefetchable) [size=16K]
    Capabilities: [c8] Power Management version 3
        Flags: PMEClk- DSI+ D1- D2- AuxCurrent=0mA PME(D0+,D1-,D2-,D3hot+,D3cold+)
        Status: D0 NoSoftRst+ PME-Enable- DSel=0 DScale=0 PME-
    Capabilities: [d0] MSI: Enable- Count=1/1 Maskable- 64bit+
        Address: 0000000000000000  Data: 0000
    Capabilities: [40] Express (v2) Root Complex Integrated Endpoint, MSI 00
        DevCap:    MaxPayload 128 bytes, PhantFunc 0
            ExtTag- RBE-
        DevCtl:    Report errors: Correctable- Non-Fatal- Fatal- Unsupported-
            RlxdOrd+ ExtTag- PhantFunc- AuxPwr+ NoSnoop+
            MaxPayload 128 bytes, MaxReadReq 128 bytes
        DevSta:    CorrErr- UncorrErr- FatalErr- UnsuppReq- AuxPwr+ TransPend-
        DevCap2: Completion Timeout: Range B, TimeoutDis+, LTR+, OBFF Via WAKE#
        DevCtl2: Completion Timeout: 16ms to 55ms, TimeoutDis-, LTR+, OBFF Disabled
    Capabilities: [80] MSI-X: Enable+ Count=16 Masked-
        Vector table: BAR=0 offset=00002000
        PBA: BAR=0 offset=00003000
    Capabilities: [100 v0] #00
    Capabilities: [14c v1] Latency Tolerance Reporting
        Max snoop latency: 0ns
        Max no snoop latency: 0ns
    Capabilities: [164 v1] Vendor Specific Information: ID=0010 Rev=0 Len=014 <?>
    Kernel driver in use: iwlwifi
    Kernel modules: iwlwifi

[  133.973862] iwlwifi 0000:00:14.3: RF_KILL bit toggled to enable radio.
[  133.973867] iwlwifi 0000:00:14.3: reporting RF_KILL (radio enabled)
[  133.986950] iwlwifi 0000:00:14.3: Applying debug destination EXTERNAL_DRAM
[  134.079752] iwlwifi 0000:00:14.3: Applying debug destination EXTERNAL_DRAM
[  134.145714] iwlwifi 0000:00:14.3: FW already configured (0) - re-configuring
[  134.155772] iwlwifi 0000:00:14.3: Conflict between TLV & NVM regarding enabling LAR (TLV = enabled NVM =disabled)
[  134.205167] usb 1-14: new full-speed USB device number 5 using xhci_hcd
[  134.332577] usb 1-14: config 1 interface 1 altsetting 0 endpoint 0x3 has wMaxPacketSize 0, skipping
[  134.332583] usb 1-14: config 1 interface 1 altsetting 0 endpoint 0x83 has wMaxPacketSize 0, skipping
[  134.332594] usb 1-14: New USB device found, idVendor=8087, idProduct=0aaa, bcdDevice= 0.02
[  134.332597] usb 1-14: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  134.355753] iwlwifi 0000:00:14.3: Microcode SW error detected. Restarting 0x0.
[  134.356120] iwlwifi 0000:00:14.3: Start IWL Error Log Dump:
[  134.356122] iwlwifi 0000:00:14.3: Status: 0x00000040, count: 6
[  134.356123] iwlwifi 0000:00:14.3: Loaded firmware version: 46.6bf1df06.0
[  134.356124] iwlwifi 0000:00:14.3: 0x00000071 | NMI_INTERRUPT_UMAC_FATAL    
[  134.356125] iwlwifi 0000:00:14.3: 0x00A022F1 | trm_hw_status0
[  134.356126] iwlwifi 0000:00:14.3: 0x00000000 | trm_hw_status1
[  134.356127] iwlwifi 0000:00:14.3: 0x004882DA | branchlink2
[  134.356128] iwlwifi 0000:00:14.3: 0x0047932A | interruptlink1
[  134.356129] iwlwifi 0000:00:14.3: 0x0000B0D0 | interruptlink2
[  134.356130] iwlwifi 0000:00:14.3: 0x0001A83E | data1
[  134.356132] iwlwifi 0000:00:14.3: 0x00001000 | data2
[  134.356135] iwlwifi 0000:00:14.3: 0xF0000008 | data3
[  134.356137] iwlwifi 0000:00:14.3: 0x00000000 | beacon time
[  134.356139] iwlwifi 0000:00:14.3: 0x00039B59 | tsf low
[  134.356142] iwlwifi 0000:00:14.3: 0x00000000 | tsf hi
[  134.356143] iwlwifi 0000:00:14.3: 0x00000000 | time gp1
[  134.356144] iwlwifi 0000:00:14.3: 0x00039B5A | time gp2
[  134.356145] iwlwifi 0000:00:14.3: 0x00000001 | uCode revision type
[  134.356146] iwlwifi 0000:00:14.3: 0x0000002E | uCode version major
[  134.356147] iwlwifi 0000:00:14.3: 0x6BF1DF06 | uCode version minor
[  134.356148] iwlwifi 0000:00:14.3: 0x00000312 | hw version
[  134.356149] iwlwifi 0000:00:14.3: 0x00C89008 | board version
[  134.356149] iwlwifi 0000:00:14.3: 0x001E0177 | hcmd
[  134.356150] iwlwifi 0000:00:14.3: 0x00122080 | isr0
[  134.356151] iwlwifi 0000:00:14.3: 0x00000000 | isr1
[  134.356152] iwlwifi 0000:00:14.3: 0x08001802 | isr2
[  134.356153] iwlwifi 0000:00:14.3: 0x404001C0 | isr3
[  134.356154] iwlwifi 0000:00:14.3: 0x00000000 | isr4
[  134.356154] iwlwifi 0000:00:14.3: 0x001E0177 | last cmd Id
[  134.356155] iwlwifi 0000:00:14.3: 0x0001A83E | wait_event
[  134.356156] iwlwifi 0000:00:14.3: 0x00000000 | l2p_control
[  134.356157] iwlwifi 0000:00:14.3: 0x00000820 | l2p_duration
[  134.356158] iwlwifi 0000:00:14.3: 0x00000000 | l2p_mhvalid
[  134.356159] iwlwifi 0000:00:14.3: 0x00000000 | l2p_addr_match
[  134.356160] iwlwifi 0000:00:14.3: 0x0000000D | lmpm_pmg_sel
[  134.356161] iwlwifi 0000:00:14.3: 0x08081425 | timestamp
[  134.356161] iwlwifi 0000:00:14.3: 0x0000183C | flow_handler
[  134.356325] iwlwifi 0000:00:14.3: Start IWL Error Log Dump:
[  134.356326] iwlwifi 0000:00:14.3: Status: 0x00000040, count: 7
[  134.356327] iwlwifi 0000:00:14.3: 0x20000034 | NMI_INTERRUPT_WDG
[  134.356328] iwlwifi 0000:00:14.3: 0x00000000 | umac branchlink1
[  134.356328] iwlwifi 0000:00:14.3: 0xC008885E | umac branchlink2
[  134.356329] iwlwifi 0000:00:14.3: 0x80454D04 | umac interruptlink1
[  134.356330] iwlwifi 0000:00:14.3: 0xC00842AC | umac interruptlink2
[  134.356331] iwlwifi 0000:00:14.3: 0x00000400 | umac data1
[  134.356332] iwlwifi 0000:00:14.3: 0xC00842AC | umac data2
[  134.356332] iwlwifi 0000:00:14.3: 0xDEADBEEF | umac data3
[  134.356351] iwlwifi 0000:00:14.3: 0x0000002E | umac major
[  134.356352] iwlwifi 0000:00:14.3: 0x6BF1DF06 | umac minor
[  134.356352] iwlwifi 0000:00:14.3: 0x00039B40 | frame pointer
[  134.356353] iwlwifi 0000:00:14.3: 0xC0886B5C | stack pointer
[  134.356354] iwlwifi 0000:00:14.3: 0x001F010C | last host cmd
[  134.356355] iwlwifi 0000:00:14.3: 0x00000000 | isr status reg
[  134.356371] iwlwifi 0000:00:14.3: Fseq Registers:
[  134.356380] iwlwifi 0000:00:14.3: 0xF3DB2F89 | FSEQ_ERROR_CODE
[  134.356389] iwlwifi 0000:00:14.3: 0x00000000 | FSEQ_TOP_INIT_VERSION
[  134.356397] iwlwifi 0000:00:14.3: 0xFD113668 | FSEQ_CNVIO_INIT_VERSION
[  134.356405] iwlwifi 0000:00:14.3: 0x0000A384 | FSEQ_OTP_VERSION
[  134.356414] iwlwifi 0000:00:14.3: 0xE2432A72 | FSEQ_TOP_CONTENT_VERSION
[  134.356422] iwlwifi 0000:00:14.3: 0x2DA12C6F | FSEQ_ALIVE_TOKEN
[  134.356430] iwlwifi 0000:00:14.3: 0xC1561102 | FSEQ_CNVI_ID
[  134.356439] iwlwifi 0000:00:14.3: 0xD4BA046A | FSEQ_CNVR_ID
[  134.356447] iwlwifi 0000:00:14.3: 0x01000100 | CNVI_AUX_MISC_CHIP
[  134.356458] iwlwifi 0000:00:14.3: 0x00000201 | CNVR_AUX_MISC_CHIP
[  134.356468] iwlwifi 0000:00:14.3: 0x0000485B | CNVR_SCU_SD_REGS_SD_REG_DIG_DCDC_VTRIM
[  134.356509] iwlwifi 0000:00:14.3: 0xA5A5A5A2 | CNVR_SCU_SD_REGS_SD_REG_ACTIVE_VDIG_MIRROR
[  134.356518] iwlwifi 0000:00:14.3: Collecting data: trigger 2 fired.
[  134.356521] ieee80211 phy0: Hardware restart was requested
[  134.356558] iwlwifi 0000:00:14.3: iwlwifi transaction failed, dumping registers
[  134.356560] iwlwifi 0000:00:14.3: iwlwifi device config registers:
[  134.357399] iwlwifi 0000:00:14.3: 00000000: a3708086 00100406 02800010 00800010 a4314004 00000000 00000000 00000000
[  134.357400] iwlwifi 0000:00:14.3: 00000020: 00000000 00000000 00000000 02a48086 00000000 000000c8 00000000 000001ff
[  134.357402] iwlwifi 0000:00:14.3: 00000040: 00928010 10000ec0 00100c10 00000000 00000000 00000000 00000000 00000000
[  134.357403] iwlwifi 0000:00:14.3: 00000060: 00000000 00080812 00000405 00000000 00000000 00000000 00000000 00000000
[  134.357404] iwlwifi 0000:00:14.3: 00000080: 800f0011 00002000 00003000 00000000 00000000 00000000 00000000 00000000
[  134.357405] iwlwifi 0000:00:14.3: 000000a0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[  134.357406] iwlwifi 0000:00:14.3: 000000c0: 00000000 00000000 c823d001 0d000008 00804005 00000000 00000000 00000000
[  134.357407] iwlwifi 0000:00:14.3: 000000e0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[  134.357408] iwlwifi 0000:00:14.3: 00000100: 14c00000 ff000000 000000ff 00462031 00000000 00002000 00000000 00000000
[  134.357409] iwlwifi 0000:00:14.3: 00000120: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[  134.357410] iwlwifi 0000:00:14.3: 00000140: 00000000 00000000 00000000 16410018 00000000 0001001e 00481e1f 00000000
[  134.357411] iwlwifi 0000:00:14.3: iwlwifi device memory mapped registers:
[  134.357529] iwlwifi 0000:00:14.3: 00000000: 00c89008 00000040 00000000 00000000 00000000 00000000 00000000 00000000
[  134.357530] iwlwifi 0000:00:14.3: 00000020: 00000000 0c040005 00000312 d55555d5 d55555d5 d55555d5 80008040 041f0040
[  134.357554] iwlwifi 0000:00:14.3: FW error in SYNC CMD SCAN_CFG_CMD
[  134.357555] CPU: 11 PID: 948 Comm: NetworkManager Tainted: G     U            5.4.0 #1
[  134.357556] Hardware name: Micro-Star International Co., Ltd. GV62 8RC/MS-16JF, BIOS E16JFIMS.10C 05/22/2019
[  134.357556] Call Trace:
[  134.357561]  dump_stack+0x6f/0x95
[  134.357568]  iwl_trans_pcie_send_hcmd+0x410/0x420 [iwlwifi]
[  134.357570]  ? wait_woken+0x80/0x80
[  134.357575]  iwl_trans_send_cmd+0x5f/0xc0 [iwlwifi]
[  134.357580]  iwl_mvm_send_cmd+0x1f/0x50 [iwlmvm]
[  134.357585]  iwl_mvm_legacy_config_scan+0x28e/0x450 [iwlmvm]
[  134.357590]  iwl_mvm_config_scan+0x113/0x120 [iwlmvm]
[  134.357594]  ? iwl_mvm_config_scan+0x113/0x120 [iwlmvm]
[  134.357597]  iwl_mvm_up+0x896/0xba0 [iwlmvm]
[  134.357600]  ? iwl_mvm_up+0x896/0xba0 [iwlmvm]
[  134.357602]  ? dev_mc_add+0x10/0x20
[  134.357606]  __iwl_mvm_mac_start+0x2b/0x1d0 [iwlmvm]
[  134.357609]  iwl_mvm_mac_start+0x28/0x40 [iwlmvm]
[  134.357621]  drv_start+0x43/0x130 [mac80211]
[  134.357630]  ieee80211_do_open+0x162/0x8c0 [mac80211]
[  134.357638]  ieee80211_open+0x52/0x60 [mac80211]
[  134.357639]  __dev_open+0xda/0x170
[  134.357640]  ? __local_bh_enable_ip+0x37/0x80
[  134.357641]  __dev_change_flags+0x185/0x1d0
[  134.357643]  dev_change_flags+0x29/0x60
[  134.357644]  do_setlink+0x2f7/0xf40
[  134.357645]  ? cpumask_next_and+0x1e/0x20
[  134.357646]  ? update_sd_lb_stats+0x670/0x7d0
[  134.357649]  ? __nla_validate_parse+0x58/0x8d0
[  134.357650]  __rtnl_newlink+0x548/0x930
[  134.357652]  ? __update_load_avg_se+0x11c/0x300
[  134.357653]  ? __update_load_avg_se+0x11c/0x300
[  134.357654]  ? update_load_avg+0x82/0x650
[  134.357655]  ? update_load_avg+0x82/0x650
[  134.357656]  ? __enqueue_entity+0x6c/0x70
[  134.357657]  ? enqueue_entity+0x111/0x6f0
[  134.357659]  ? record_times+0x1b/0x90
[  134.357663]  ? security_capable+0x3f/0x60
[  134.357664]  ? kmem_cache_alloc_trace+0x33/0x230
[  134.357665]  rtnl_newlink+0x4c/0x70
[  134.357667]  rtnetlink_rcv_msg+0x139/0x330
[  134.357667]  ? __wake_up_common+0x73/0x120
[  134.357668]  ? rtnl_calcit.isra.30+0x130/0x130
[  134.357670]  netlink_rcv_skb+0x51/0x120
[  134.357671]  rtnetlink_rcv+0x15/0x20
[  134.357672]  netlink_unicast+0x199/0x230
[  134.357673]  netlink_sendmsg+0x2d7/0x3d0
[  134.357675]  sock_sendmsg+0x63/0x70
[  134.357676]  ___sys_sendmsg+0x2a9/0x320
[  134.357678]  ? touch_atime+0x34/0xd0
[  134.357679]  ? chacha_block+0x6a/0xb0
[  134.357680]  ? __fget+0x7a/0xa0
[  134.357682]  __sys_sendmsg+0x63/0xa0
[  134.357683]  ? __sys_sendmsg+0x63/0xa0
[  134.357685]  __x64_sys_sendmsg+0x1f/0x30
[  134.357686]  do_syscall_64+0x57/0x190
[  134.357688]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[  134.357689] RIP: 0033:0x7f80f87ec607
[  134.357690] Code: 44 00 00 41 54 55 41 89 d4 53 48 89 f5 89 fb 48 83 ec 10 e8 0b ea ff ff 44 89 e2 41 89 c0 48 89 ee 89 df b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 48 89 44 24 08 e8 44 ea ff ff 48
[  134.357691] RSP: 002b:00007ffcad50da40 EFLAGS: 00000293 ORIG_RAX: 000000000000002e
[  134.357692] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 00007f80f87ec607
[  134.357692] RDX: 0000000000000000 RSI: 00007ffcad50daa0 RDI: 0000000000000007
[  134.357693] RBP: 00007ffcad50daa0 R08: 0000000000000000 R09: 0000556ee34d9fe0
[  134.357693] R10: 0000556ee336d010 R11: 0000000000000293 R12: 0000000000000000
[  134.357694] R13: 00007ffcad50daa0 R14: 00007ffcad50dc24 R15: 0000000000000000
[  134.357697] iwlwifi 0000:00:14.3: Firmware not running - cannot dump error
[  134.394758] Bluetooth: Core ver 2.22
[  134.394773] NET: Registered protocol family 31
[  134.394774] Bluetooth: HCI device and connection manager initialized
[  134.394776] Bluetooth: HCI socket layer initialized
[  134.394777] Bluetooth: L2CAP socket layer initialized
[  134.394779] Bluetooth: SCO socket layer initialized
[  134.455585] usbcore: registered new interface driver btusb
[  134.456547] Bluetooth: hci0: Bootloader revision 0.1 build 42 week 52 2015
[  134.457580] Bluetooth: hci0: Device revision is 2
[  134.457582] Bluetooth: hci0: Secure boot is enabled
[  134.457583] Bluetooth: hci0: OTP lock is enabled
[  134.457584] Bluetooth: hci0: API lock is enabled
[  134.457585] Bluetooth: hci0: Debug lock is disabled
[  134.457586] Bluetooth: hci0: Minimum firmware build 1 week 10 2014
[  134.548255] Bluetooth: hci0: Found device firmware: intel/ibt-17-16-1.sfi
[  134.665322] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
[  134.665323] Bluetooth: BNEP filters: protocol multicast
[  134.665326] Bluetooth: BNEP socket layer initialized
[  136.056590] Bluetooth: hci0: Waiting for firmware download to complete
[  136.057606] Bluetooth: hci0: Firmware loaded in 1564500 usecs
[  136.057748] Bluetooth: hci0: Waiting for device to boot
[  136.070622] Bluetooth: hci0: Device booted in 12659 usecs
[  136.082307] Bluetooth: hci0: Found Intel DDC parameters: intel/ibt-17-16-1.ddc
[  136.085694] Bluetooth: hci0: Applying Intel DDC parameters completed
[  136.190682] Bluetooth: RFCOMM TTY layer initialized
[  136.190687] Bluetooth: RFCOMM socket layer initialized
[  136.190690] Bluetooth: RFCOMM ver 1.11

--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c.orig
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
@@ -1220,7 +1220,7 @@ static int iwl_mvm_legacy_config_scan(st
         cmd_size = sizeof(struct iwl_scan_config_v2);
     else
         cmd_size = sizeof(struct iwl_scan_config_v1);
-    cmd_size += num_channels;
+    cmd_size += mvm->fw->ucode_capa.n_scan_channels;
 
     cfg = kzalloc(cmd_size, GFP_KERNEL);
     if (!cfg)