Additional info:
reporter:       libreport-2.17.11
list_del corruption, ffff9c3e4561b000->prev is LIST_POISON2 (dead000000000122)
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:56!
invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
CPU: 0 PID: 102 Comm: kworker/u9:0 Not tainted 6.4.7-200.fc38.x86_64 #1
Hardware name: HUAWEI BOHB-WAX9/BOHB-WAX9-PCB, BIOS 1.41 02/21/2022
Workqueue: hci0 hci_cmd_sync_work [bluetooth]
RIP: 0010:__list_del_entry_valid+0x93/0xc0
Code: e8 12 3c 9a ff 0f 0b 48 89 fe 48 c7 c7 60 23 93 85 e8 01 3c 9a ff 0f 0b 48 89 fe 48 89 ca 48 c7 c7 98 23 93 85 e8 ed 3b 9a ff <0f> 0b 48 89 fe 48 89 c2 48 c7 c7 d0 23 93 85 e8 d9 3b 9a ff 0f 0b
RSP: 0018:ffffaec30039fda8 EFLAGS: 00010246
RAX: 000000000000004e RBX: ffff9c3e4561b000 RCX: 0000000000000027
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff9c3f9a621540
RBP: ffff9c3e5d9ac000 R08: 0000000000000000 R09: ffffaec30039fc50
R10: 0000000000000003 R11: ffffffff86146708 R12: ffff9c3e5d9acbf8
R13: ffff9c3f01fc78c0 R14: dead000000000122 R15: dead000000000100
FS:  0000000000000000(0000) GS:ffff9c3f9a600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c000447000 CR3: 0000000128c92004 CR4: 00000000003706f0
Call Trace:
 <TASK>
 ? die+0x36/0x90
Bluetooth: hci0: command 0x0408 tx timeout
 ? do_trap+0xda/0x100
 ? __list_del_entry_valid+0x93/0xc0
 ? do_error_trap+0x6a/0x90
 ? __list_del_entry_valid+0x93/0xc0
 ? exc_invalid_op+0x50/0x70
 ? __list_del_entry_valid+0x93/0xc0
 ? asm_exc_invalid_op+0x1a/0x20
 ? __list_del_entry_valid+0x93/0xc0
 ? __list_del_entry_valid+0x93/0xc0
 hci_conn_cleanup+0x43/0x1d0 [bluetooth]
 hci_abort_conn_sync+0xae/0x230 [bluetooth]
 ? hci_stop_discovery_sync+0xba/0x1d0 [bluetooth]
 hci_set_powered_sync+0x16a/0x2b0 [bluetooth]
 ? iwl_pcie_rx_allocator_work+0x2f7/0x370 [iwlwifi]
 hci_cmd_sync_work+0xc8/0x190 [bluetooth]
 process_one_work+0x1c4/0x3d0
 worker_thread+0x51/0x390
 ? __pfx_worker_thread+0x10/0x10
 kthread+0xe5/0x120
 ? __pfx_kthread+0x10/0x10
 ret_from_fork+0x29/0x50
 </TASK>
Modules linked in: uinput rfcomm snd_seq_dummy snd_hrtimer nf_conntrack_netbios_ns nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables nfnetlink qrtr bnep sunrpc snd_sof_pci_intel_cnl snd_sof_intel_hda_common soundwire_intel soundwire_cadence snd_sof_intel_hda_mlink snd_sof_intel_hda snd_sof_pci snd_sof_xtensa_dsp snd_sof uvcvideo uvc videobuf2_vmalloc snd_sof_utils intel_tcc_cooling videobuf2_memops x86_pkg_temp_thermal snd_soc_hdac_hda videobuf2_v4l2 iTCO_wdt intel_powerclamp snd_hda_ext_core coretemp videobuf2_common snd_soc_acpi_intel_match intel_pmc_bxt snd_soc_acpi iwlmvm iTCO_vendor_support kvm_intel soundwire_generic_allocation mei_hdcp mei_pxp soundwire_bus intel_rapl_msr mac80211 videodev snd_hda_codec_hdmi mc kvm btusb libarc4 binfmt_misc snd_hda_codec_realtek snd_hda_codec_generic vfat fat btrtl irqbypass rapl snd_hda_intel btbcm
 btintel snd_intel_dspcfg snd_soc_es8316 snd_intel_sdw_acpi intel_cstate snd_soc_core snd_hda_codec btmtk iwlwifi i2c_i801 intel_uncore snd_hda_core snd_compress huawei_wmi ac97_bus ledtrig_audio pcspkr snd_pcm_dmaengine sparse_keymap processor_thermal_device_pci_legacy wmi_bmof snd_hwdep i2c_smbus snd_seq bluetooth cfg80211 snd_seq_device processor_thermal_device processor_thermal_rfim snd_pcm processor_thermal_mbox mei_me processor_thermal_rapl mei st_accel_i2c st_sensors_i2c intel_rapl_common intel_soc_dts_iosf rfkill idma64 st_accel snd_timer intel_pch_thermal st_sensors industrialio_triggered_buffer snd kfifo_buf industrialio soundcore int3400_thermal int3403_thermal acpi_thermal_rel int340x_thermal_zone acpi_pad joydev squashfs loop zram i915 i2c_algo_bit drm_buddy drm_display_helper crct10dif_pclmul crc32_pclmul nvme crc32c_intel polyval_clmulni polyval_generic nvme_core cec spi_pxa2xx_platform hid_multitouch ghash_clmulni_intel sha512_ssse3 ttm dw_dmac nvme_common hid_uclogic i2c_hid_acpi i2c_hid
 video wmi pinctrl_cannonlake serio_raw fuse