From 63017388f1338a6769b0a540c830d2fbc8ec356d Mon Sep 17 00:00:00 2001
From: Anubhav Rawal <rawalexe@amazon.com>
Date: Wed, 6 May 2026 16:26:57 -0700
Subject: [PATCH] Fix: Invalidate MPU object pool entry on timer delete in MPU
 wrappers v2

---
 portable/Common/mpu_wrappers_v2.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/portable/Common/mpu_wrappers_v2.c b/portable/Common/mpu_wrappers_v2.c
index 70082b829..8f9f09277 100644
--- a/portable/Common/mpu_wrappers_v2.c
+++ b/portable/Common/mpu_wrappers_v2.c
@@ -3541,6 +3541,15 @@
                                                                             pxParams->xOptionalValue,
                                                                             pxParams->pxHigherPriorityTaskWoken,
                                                                             pxParams->xTicksToWait );
+
+                                    /* Timer deletion is asynchronous - eagerly invalidate the
+                                     * object pool entry only if the delete command was successfully
+                                     * queued, to prevent stale handle access after the timer daemon
+                                     * frees the Timer_t. */
+                                    if( ( xReturn == pdPASS ) && ( pxParams->xCommandID == tmrCOMMAND_DELETE ) )
+                                    {
+                                        MPU_SetIndexFreeInKernelObjectPool( CONVERT_TO_INTERNAL_INDEX( lIndex ) );
+                                    }
                                 }
                             }
                         }