Further testing has produced a simpler reproducer on the affected RockPro64.
I booted Debian 7.2.10+deb14-arm64 with tailscaled disabled. The
system booted without an Oops, with kernel taint zero. At this point
nf_conntrack was not loaded.
Running just:
sudo modprobe nf_conntrack
triggered an Oops approximately one second later, while tailscaled
remained inactive. The conntrack count was zero immediately after
loading and when checked after the Oops; the hash table had 65,536
buckets.
The fault was:
Unable to handle kernel paging request at virtual address 000000000000fff8
Workqueue: events_power_efficient gc_worker [nf_conntrack]
pc : gc_worker+0x13c/0x780 [nf_conntrack]
Previous failures during Tailscale startup faulted at
gc_worker+0x130/0x780, accessing 0x10037. This reproduction faults
nearby in the same worker, although the relationship between the two
accesses still needs investigation.
Tailscale is therefore not required to reproduce the failure. Loading
nf_conntrack alone is sufficient on this host, without adding
conntrack firewall rules or generating a test workload. PCIe remained
disabled for this test.
The complete kernel log is available if useful.
