My explanations for this bug are: 1) CMASK allocation is wrong. We should try and overallocate it. 2) CMASK contains garbage, which can hang the hardware. Either the clear_buffer function isn't reliable (it uses CP DMA) or CMASK was corrupted by eviction. Or an out-of-bounds access from some other source corrupted it.