[Nexus 5 Original Android Development] PresidentMcCain:
I flashed the "aosp_hammerhead-8.0.0-20171006.zip" build. Noticed that the signal bar is now always full or empty. The crash is still happening though as soon as mobile data is enabled:

10-06 16:57:03.561 3603 3614 F libc : Fatal signal 11 (SIGSEGV), code 1, fault addr 0x0 in tid 3614 (rild)
10-06 16:57:03.575 614 2250 D ConnectivityService: registerNetworkAgent NetworkAgentInfo{ ni{[type: MOBILE[LTE], state: CONNECTED/CONNECTED, reason: connected, extra: h2g2, failover: false, available: true, roaming: false, metered: true]} network{103} nethandle{442398067422} lp{{InterfaceName: rmnet0 LinkAddresses: [25.43.165.189/30,2607:fb90:3de:ccbe:2fdf:41e4:cd13:d71d/64,] Routes: [0.0.0.0/0 -> 25.43.165.190 rmnet0,::/0 -> 2607:fb90:3de:ccbe:f580:cc40:bf04:93f0 rmnet0,] DnsAddresses: [10.177.0.34,10.177.0.210,fd00:976a::9,fd00:976a::10,] Domains: null MTU: 1440 TcpBufferSizes: 524288,1048576,2097152,262144,524288,1048576}} nc{[ Transports: CELLULAR Capabilities: MMS&SUPL&DUN&INTERNET&NOT_RESTRICTED&TRUSTED&NOT_VPN LinkUpBandwidth>=51200Kbps LinkDnBandwidth>=102400Kbps Specifier: <1>]} Score{10} everValidated{false} lastValidated{false} created{false} lingering{false} explicitlySelected{false} acceptUnvalidated{false} everCaptivePortalDetected{false} lastCaptivePortalDetected{false} }
10-06 16:57:03.575 614 739 D ConnectivityService: NetworkAgentInfo [MOBILE (LTE) - 103] EVENT_NETWORK_INFO_CHANGED, going from null to CONNECTED
10-06 16:57:03.576 614 739 D ConnectivityService: Adding iface rmnet0 to network 103
10-06 16:57:03.585 181 325 E Netd : Error adding route ::/0 -> 2607:fb90:3de:ccbe:f580:cc40:bf04:93f0 rmnet0 to table 1002: File exists
10-06 16:57:03.586 614 739 D ConnectivityService: Setting DNS servers for network 103 to [/10.177.0.34, /10.177.0.210, /fd00:976a::9, /fd00:976a::10]
10-06 16:57:03.618 614 739 D ConnectivityService: Switching to new default network: NetworkAgentInfo{ ni{[type: MOBILE[LTE], state: CONNECTED/CONNECTED, reason: connected, extra: h2g2, failover: false, available: true, roaming: false, metered: true]} network{103} nethandle{442398067422} lp{{InterfaceName: rmnet0 LinkAddresses: [25.43.165.189/30,2607:fb90:3de:ccbe:2fdf:41e4:cd13:d71d/64,] Routes: [0.0.0.0/0 -> 25.43.165.190 rmnet0,::/0 -> 2607:fb90:3de:ccbe:f580:cc40:bf04:93f0 rmnet0,] DnsAddresses: [10.177.0.34,10.177.0.210,fd00:976a::9,fd00:976a::10,] Domains: null MTU: 1440 TcpBufferSizes: 524288,1048576,2097152,262144,524288,1048576}} nc{[ Transports: CELLULAR Capabilities: MMS&SUPL&DUN&INTERNET&NOT_RESTRICTED&TRUSTED&NOT_VPN&FOREGROUND LinkUpBandwidth>=51200Kbps LinkDnBandwidth>=102400Kbps Specifier: <1>]} Score{10} everValidated{false} lastValidated{false} created{true} lingering{false} explicitlySelected{false} acceptUnvalidated{false} everCaptivePortalDetected{false} lastCaptivePortalDetected{false} }
10-06 16:57:03.648 3969 3969 I crash_dump32: obtaining output fd from tombstoned
10-06 16:57:03.650 245 245 I /system/bin/tombstoned: received crash request for pid 3603
10-06 16:57:03.652 3969 3969 I crash_dump32: performing dump of process 3603 (target tid = 3614)
10-06 16:57:03.653 3969 3969 F DEBUG : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
10-06 16:57:03.653 3969 3969 F DEBUG : Build fingerprint: 'google/hammerhead/hammerhead:6.0.1/M4B30Z/3437181:user/release-keys'
10-06 16:57:03.653 3969 3969 F DEBUG : Revision: '11'
10-06 16:57:03.653 3969 3969 F DEBUG : ABI: 'arm'
10-06 16:57:03.653 3969 3969 F DEBUG : pid: 3603, tid: 3614, name: rild >>> /vendor/bin/hw/rild <<<
10-06 16:57:03.653 3969 3969 F DEBUG : signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0
10-06 16:57:03.653 3969 3969 F DEBUG : Cause: null pointer dereference
10-06 16:57:03.653 3969 3969 F DEBUG : r0 00000000 r1 00000001 r2 00000000 r3 00000000
10-06 16:57:03.653 3969 3969 F DEBUG : r4 00000000 r5 a6dbb608 r6 00000411 r7 00000001
10-06 16:57:03.653 3969 3969 F DEBUG : r8 a4a8c000 r9 00000001 sl 00000004 fp a6dbb5a4
10-06 16:57:03.653 3969 3969 F DEBUG : ip a6dba794 sp a5a9d580 lr a6d98cf3 pc 00000000 cpsr 60000010
10-06 16:57:03.683 3969 3969 F DEBUG :
10-06 16:57:03.683 3969 3969 F DEBUG : backtrace:
10-06 16:57:03.683 3969 3969 F DEBUG : #00 pc 00000000 <unknown>
10-06 16:57:03.683 3969 3969 F DEBUG : #01 pc 00010cf1 /system/vendor/lib/libril.so (RIL_onUnsolicitedResponse+164)
10-06 16:57:03.683 3969 3969 F DEBUG : #02 pc 0005332b /system/lib/libril-qc-qmi-1.so
10-06 16:57:03.683 3969 3969 F DEBUG : #03 pc 000536d5 /system/lib/libril-qc-qmi-1.so (qcril_send_unsol_response+548)
10-06 16:57:03.683 3969 3969 F DEBUG : #04 pc 000f53c9 /system/lib/libril-qc-qmi-1.so
10-06 16:57:03.683 3969 3969 F DEBUG : #05 pc 0004ee1b /system/lib/libril-qc-qmi-1.so (qcril_timed_callback_dispatch+38)
10-06 16:57:03.683 3969 3969 F DEBUG : #06 pc 00011c9d /system/vendor/lib/libril.so (_ZN7androidL17userTimerCallbackEisPv+8)
10-06 16:57:03.683 3969 3969 F DEBUG : #07 pc 000121bf /system/vendor/lib/libril.so (_Z14ril_event_loopv+502)
10-06 16:57:03.683 3969 3969 F DEBUG : #08 pc 00010fad /system/vendor/lib/libril.so (_ZN7androidL9eventLoopEPv+120)
10-06 16:57:03.683 3969 3969 F DEBUG : #09 pc 000479df /system/lib/libc.so (_ZL15__pthread_startPv+22)
10-06 16:57:03.683 3969 3969 F DEBUG : #10 pc 0001ab9f /system/lib/libc.so (__start_thread+32)