Kernel crash when unplugging Logitech MX Master 3 dongle

[matsvanmolle]

On my Mac Studio (M1 Max) I consistently encounter a kernel crash when I unplug the Logitech Unifying or Bolt receiver dongle for the MX Master 3 mouse. After unplugging, the kernel immediately panics with a page fault in the hidinput_led_worker.

This leaves the USB subsystem in a broken state — tools like lsusb hang, and the input device stop responding until reboot.

Steps to reproduce:

1. Plug in Logitech Unifying or Bolt dongle for MX Master 3.
2. Unplug the dongle.

Setup:

Machine: Mac Studio (M1 Max, 2022)
Input device: Logitech MX Master 3 via USB receiver
Kernel: 6.13.7-401.asahi.fc41.aarch64+16k

Relevant logs:

usb 1-1.2: USB disconnect, device number 3
Unable to handle kernel paging request at virtual address ffff78e395138008
...
Internal error: Oops: 0000000096000005 [#1] SMP
...
Workqueue: events hidinput_led_worker
...
Call trace:
  __srcu_read_lock+0x48/0x98
  dispatch_hid_bpf_output_report+0x70/0x120
  hid_hw_output_report+0x60/0xd0
  hidinput_led_worker+0xb0/0x110

[vulpes2]

This is an HID bug in the kernel around hid_bpf_dispatch, not just limited to USB. See here: #344. Tried to reproduce it with a Bolt receiver on J313 but couldn't trigger it unfortunately, someone needs to come up with a reliable way to reproduce it.