From b81ce6981f741fbb9c664d5f425783e603feff0c Mon Sep 17 00:00:00 2001 From: Markus Fritsche Date: Tue, 5 May 2026 14:15:40 +0000 Subject: [PATCH] iter4 fix: B-slice L1 reflist .fields copy-paste bug In h264_va_slice_to_v4l2, the B-slice L1 reflist loop wrote .fields into ref_pic_list0[i] instead of ref_pic_list1[i]. This corrupted L0 reflist fields when L1 was being built and left ref_pic_list1[i].fields zero (which the kernel may interpret as "no valid field reference"). Pre-existing pre-iter4 bug (caught by iter4 Phase 5 sonnet review, finding C2). Latent on hantro bbb_1080p30 in FRAME_BASED mode because hantro walks reference_ts directly and ignores SLICE_PARAMS.fields, but the bug is wrong-by-construction and would surface on any driver that reads SLICE_PARAMS reflist fields, on interlaced content, or in SLICE_BASED decode mode. Co-Authored-By: Claude Opus 4.7 (1M context) --- src/h264.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/h264.c b/src/h264.c index 9270233..5c07818 100644 --- a/src/h264.c +++ b/src/h264.c @@ -700,7 +700,7 @@ static void h264_va_slice_to_v4l2(struct request_data *driver_data, continue; slice->ref_pic_list1[i].index = idx; - slice->ref_pic_list0[i].fields = fields; + slice->ref_pic_list1[i].fields = fields; } }