Summary

In the interrupt event dispatch, the SHT short-buffer branch writes sc->chan[ch]->last_rxerr/short_error with no NULL check, while every sibling consumer of the same hardware-extracted channel index checks (tx_eom/rx_eom bail on NULL; their own comments concede events for unconfigured channels occur). Any event word naming a never-hooked channel drives a write to address ~offsetof(last_rxerr) - NULL-deref write panic in hard-interrupt context. Stray/stale hardware events needed; sibling-guard fix.