[myTouch 3G, Magic Android Development] imstr8trippin:
I've created a hybrid ROM of my stock 32A (extracted from phone) kernel and the Google ION 1.6 update

Everything works (ie. market, calls, wlan, bluetooth (turns on), data, sound, recording sound, playing music, accelerometer, etc.) except for the camera/camcorder. Here is some log output when starting the Camera app:

...
(t=0x41504e4d l=40)
D/CameraService( 36): CameraService::connect E (pid 332, client 0x22e78)
D/CameraService( 36): Client::Client E (pid 332)
D/QualcommCameraHardware( 36): createInstance: E
E/QualcommCameraHardware( 36): startCamera X: /dev/msm_camera/control0 open failed: No such file or directory!
E/QualcommCameraHardware( 36): ioctl error. camfd=-1, type=21, length=4, rc=-1, ctrlCmd.status=1072, Bad file number
E/QualcommCameraHardware( 36): ioctl error. camfd=-1, type=15, length=4, rc=-1, ctrlCmd.status=1128, Bad file number
E/QualcommCameraHardware( 36): ioctl error. camfd=-1, type=14, length=4, rc=-1, ctrlCmd.status=1200, Bad file number
D/QualcommCameraHardware( 36): createInstance: X created hardware=0x201b8
D/CameraService( 36): Client::Client X (pid 332)
D/CameraService( 36): CameraService::connect X
D/Camera ( 332): app passed NULL surface
D/CameraService( 36): setPreviewDisplay(0x0) (pid 332)
D/CameraService( 36): getParameters(antibanding=off;antibanding-
...
E/QualcommCameraHardware( 36): ioctl error. camfd=-1, type=21, length=4, rc=-1, ctrlCmd.status=11664, Bad file number
E/QualcommCameraHardware( 36): ioctl error. camfd=-1, type=15, length=4, rc=-1, ctrlCmd.status=12224, Bad file number
E/QualcommCameraHardware( 36): ioctl error. camfd=-1, type=14, length=4, rc=-1, ctrlCmd.status=12000, Bad file number
V/camera ( 332): startPreview
D/CameraService( 36): startPreview (pid 332)
D/CameraService( 36): startCameraMode(0) (pid 332)
D/CameraService( 36): mSurface is not set yet.
D/CameraService( 36): startPreviewMode (pid 332)
I/QualcommCameraHardware( 36): initPreview E: preview size=384x288
E/QualcommCameraHardware( 36): register_buf: MSM_CAM_IOCTL_(UN)REGISTER_PMEM fd -1 error Bad file number
E/QualcommCameraHardware( 36): register_buf: MSM_CAM_IOCTL_(UN)REGISTER_PMEM fd -1 error Bad file number
E/QualcommCameraHardware( 36): register_buf: MSM_CAM_IOCTL_(UN)REGISTER_PMEM fd -1 error Bad file number
E/QualcommCameraHardware( 36): register_buf: MSM_CAM_IOCTL_(UN)REGISTER_PMEM fd -1 error Bad file number
E/QualcommCameraHardware( 36): ioctl error. camfd=-1, type=1, length=28, rc=-1, ctrlCmd.status=9135, Bad file number
E/QualcommCameraHardware( 36): startPreview X initPreview failed. Not starting preview.
D/CameraService( 36): stopPreview (pid 332)
D/CameraService( 36): stopPreview(), hardware stopped OK
D/Camera-JNI( 332): release camera
D/CameraService( 36): Client::disconnect() E (pid 332 client 0x22e78)
D/CameraService( 36): hardware teardown
D/QualcommCameraHardware( 36): release E
E/QualcommCameraHardware( 36): ioctl CAMERA_EXIT fd -1 error Bad file number
E/QualcommCameraHardware( 36): config_thread exit failure: Bad file number
D/QualcommCameraHardware( 36): release X
D/QualcommCameraHardware( 36): ~QualcommCameraHardware E
D/QualcommCameraHardware( 36): ~QualcommCameraHardware X
E/QualcommCameraHardware( 36): register_buf: MSM_CAM_IOCTL_(UN)REGISTER_PMEM fd -1 error Bad file number
E/QualcommCameraHardware( 36): register_buf: MSM_CAM_IOCTL_(UN)REGISTER_PMEM fd -1 error Bad file number
E/QualcommCameraHardware( 36): register_buf: MSM_CAM_IOCTL_(UN)REGISTER_PMEM fd -1 error Bad file number
E/QualcommCameraHardware( 36): register_buf: MSM_CAM_IOCTL_(UN)REGISTER_PMEM fd -1 error Bad file number
D/CameraService( 36): removeClient (pid 332) done
D/CameraService( 36): Client::disconnect() X (pid 332)
W/dalvikvm( 332): threadid=13: thread exiting with uncaught exception (group=0x4001da20)
E/AndroidRuntime( 332): Uncaught handler: thread Thread-7 exiting due to uncaught exception
E/AndroidRuntime( 332): java.lang.RuntimeException: startPreview failed
E/AndroidRuntime( 332):	at com.android.camera.Camera.startPreview(Camera.java:1360)
E/AndroidRuntime( 332):	at com.android.camera.Camera.access$4000(Camera.java:78)
E/AndroidRuntime( 332):	at com.android.camera.Camera$3.run(Camera.java:724)
E/AndroidRuntime( 332):	at java.lang.Thread.run(Thread.java:1060)
E/AndroidRuntime( 332): Caused by: java.lang.RuntimeException: startPreview failed
E/AndroidRuntime( 332):	at android.hardware.Camera.startPreview(Native Method)
E/AndroidRuntime( 332):	at com.android.camera.Camera.startPreview(Camera.java:1357)
E/AndroidRuntime( 332):	... 3 more
D/CameraService( 36): Client::~Client E (pid 36, client 0x22e78)
D/CameraService( 36): Client::disconnect() E (pid 36 client 0x22e78)
D/CameraService( 36): Client::~Client X (pid 36)
I/Process ( 59): Sending signal. PID: 332 SIG: 3
I/dalvikvm( 332): threadid=7: reacting to signal 3
I/dalvikvm( 332): Wrote stack trace to '/data/anr/traces.txt'
I/DumpStateReceiver( 59): Added state dump to 1 crashes
I/Process ( 332): Sending signal. PID: 332 SIG: 9
I/ActivityManager( 59): Process com.android.camera (pid 332) has died.

I think the key bit there is 'startCamera X: /dev/msm_camera/control0 open failed: No such file or directory!'

After that, you can see successive ioctl 'Bad file number' errors.

I have a workaround by copying /system/lib/libcamera.so and /system/lib/libqcamera.so from the original, stock image of my phone. This results in a working camera. However, the camcorder can't record video. When pressing record, it freezes. No force close. Can BACK out of the app. Here's the log when that happens. As you can see, mediaserver pukes:

...
I/ActivityManager( 60): Displayed activity com.android.camera/.VideoCamera: 1260 ms (total 1260 ms)
V/videocamera( 354): initializeRecorder
V/videocamera( 354): Releasing media recorder.
D/CameraService( 495): Client::connect E (pid 495, client 0x373fc)
D/CameraService( 495): Connect to the new client (pid 495, client 0x373fc)
V/videocamera( 354): Current camera video filename: /sdcard/DCIM/Camera/video-2009-12-29-22-22-37.3gp
I/MediaRecorderJNI( 354): prepare: surface=0x1ba9a8 (id=1)
D/CameraService( 495): setPreviewDisplay(0x37800) (pid 495)
I/OMXVenc ( 495): component_init::292 Initializing component OMX.qcom.video.encoder.h263
E/OMXVenc ( 495): get_parameter::922 unsupported index 267887431
E/OMXVenc ( 495): get_parameter::899 unsupported index 117440523
E/OMXVenc ( 495): set_parameter::1099 unsupported index in set_parameter 117440523
E/OMXVenc ( 495): get_parameter::922 unsupported index 100663301
E/OMXVenc ( 495): set_parameter::1142 unsupported index 100663301
E/OMXVenc ( 495): get_parameter::922 unsupported index 100663302
E/OMXVenc ( 495): set_parameter::1142 unsupported index 100663302
I/OMXVenc ( 495): send_command::690 attempt to move to new state 2
E/OMXVenc ( 495): Setting OMX_Video_ControlRateVariable
I/VENC_DRV( 495): venc_drv_malloc::1155 /dev/pmem_adsp
I/VENC_DRV( 495): venc_drv_malloc::1183 phys lookup success virt=0x40e64000 -- FD=21 -- size - 524288
D/CameraService( 495): setPreviewDisplay(0x37800) (pid 495)
D/CameraInput( 495): Intended mFrameWidth=176, mFrameHeight=144
V/QualcommCameraHardware( 495): getParameters: EX
D/CameraService( 495): getParameters(antibanding=auto;antibanding-
...
V/QualcommCameraHardware( 495): setParameters: E params = 0x40c63cf8
V/QualcommCameraHardware( 495): requested size 176 x 144
V/QualcommCameraHardware( 495): actual size 176 x 144
V/QualcommCameraHardware( 495): initCameraParameters: E
V/QualcommCameraHardware( 495): camera hardware has been started already
V/QualcommCameraHardware( 495): initCameraParameters: set parm: CAMERA_PARM_PREVIEW_MODE, 0
V/QualcommCameraHardware( 495): Setting Zoom is 0
I/QualcommCameraHardware( 495): setting thumbnail dimensions to 512x384, quality 30
E/QualcommCameraHardware( 495): LINK_camera_set_thumbnail_properties returned 2
V/QualcommCameraHardware( 495): Setting JPEG-image quality to 100
V/QualcommCameraHardware( 495): initCameraParameters: X
V/QualcommCameraHardware( 495): setParameters: X mCameraState=3
V/QualcommCameraHardware( 495): getParameters: EX
D/CameraService( 495): getParameters(antibanding=auto;antibanding-
...
D/CameraInput( 495): Actual mFrameWidth=176, mFrameHeight=144
D/CameraService( 495): startPreview (pid 495)
D/CameraService( 495): startCameraMode(0) (pid 495)
D/CameraService( 495): startPreviewMode (pid 495)
E/MetadataDriver( 495): isCommandSuccessful: Command id(0 and expected 0) and status (-4 and expected 1), data corruption (false) at state (1).
E/MetadataDriver( 495): isCommandSuccessful: Command id(1 and expected 1) and status (-14 and expected 1), data corruption (false) at state (5).
D/dalvikvm( 60): GC freed 8852 objects / 389392 bytes in 235ms
V/videocamera( 354): startVideoRecording
I/OMXVenc ( 495): send_command::690 attempt to move to new state 3
I/VENC_DRV( 495): venc_drv_open::283 TE version = 1
D/CameraService( 495): startRecording (pid 495)
D/CameraService( 495): startCameraMode(1) (pid 495)
D/CameraService( 495): startRecordingMode (pid 495)
V/QualcommCameraHardware( 495): startPreview E
E/QualcommCameraHardware( 495): startPreview is already in progress, doing nothing.
D/AudioHardwareMSM72XX( 495): audpre_index = 0, tx_iir_index = 0
D/HTC Acoustic( 495): msm72xx_enable_audpre: 0x0000
W/AudioFlinger( 495): write blocked for 66 msecs
I/DEBUG ( 494): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
I/DEBUG ( 494): Build fingerprint: 'rogers/htc_magic/sapphire/sapphire:1.5/2.17.631.2/42949:user'
I/DEBUG ( 494): pid: 495, tid: 519 >>> /system/bin/mediaserver <<<
I/DEBUG ( 494): signal 11 (SIGSEGV), fault addr 10000014
I/DEBUG ( 494): r0 00000000 r1 00000001 r2 10000014 r3 ffff0fff
I/DEBUG ( 494): r4 00000000 r5 10000014 r6 a9c8c048 r7 4080bcb4
I/DEBUG ( 494): r8 4070be38 r9 afe39dd4 10 a949bec1 fp 00000001
I/DEBUG ( 494): ip a9d4bcdc sp 4080bc58 lr afe0d46c pc ffff0fc0 cpsr 00000010
I/DEBUG ( 494): #00 pc ffff0fc0
I/DEBUG ( 494): #01 pc 0000d468 /system/lib/libc.so
I/DEBUG ( 494): #02 pc 0000d468 /system/lib/libc.so
I/DEBUG ( 494): #03 pc 0000d468 /system/lib/libc.so
I/DEBUG ( 494): #04 pc 0000d468 /system/lib/libc.so
I/DEBUG ( 494): #05 pc 0000d468 /system/lib/libc.so
I/DEBUG ( 494): #06 pc 0000d468 /system/lib/libc.so
I/DEBUG ( 494): #07 pc 0000d468 /system/lib/libc.so
I/DEBUG ( 494): #08 pc 0000d468 /system/lib/libc.so
I/DEBUG ( 494): #09 pc 0000d468 /system/lib/libc.so
I/DEBUG ( 494): #10 pc 0000d468 /system/lib/libc.so
I/DEBUG ( 494): #11 pc 0000d468 /system/lib/libc.so
I/DEBUG ( 494): #12 pc 0000d468 /system/lib/libc.so
I/DEBUG ( 494): #13 pc 0000d468 /system/lib/libc.so
I/DEBUG ( 494): #14 pc 0000d468 /system/lib/libc.so
I/DEBUG ( 494): #15 pc 0000d468 /system/lib/libc.so
I/DEBUG ( 494): #16 pc 0000d468 /system/lib/libc.so
I/DEBUG ( 494): #17 pc 0000d468 /system/lib/libc.so
I/DEBUG ( 494): #18 pc 0000d468 /system/lib/libc.so
I/DEBUG ( 494): #19 pc 0000d468 /system/lib/libc.so
I/DEBUG ( 494): #20 pc 0000d468 /system/lib/libc.so
I/DEBUG ( 494): #21 pc 0000d468 /system/lib/libc.so
I/DEBUG ( 494): #22 pc 0000d468 /system/lib/libc.so
I/DEBUG ( 494): #23 pc 0000d468 /system/lib/libc.so
I/DEBUG ( 494): #24 pc 0000d468 /system/lib/libc.so
I/DEBUG ( 494): #25 pc 0000d468 /system/lib/libc.so
I/DEBUG ( 494): #26 pc 0000d468 /system/lib/libc.so
I/DEBUG ( 494): #27 pc 0000d468 /system/lib/libc.so
I/DEBUG ( 494): #28 pc 0000d468 /system/lib/libc.so
I/DEBUG ( 494): #29 pc 0000d468 /system/lib/libc.so
I/DEBUG ( 494): #30 pc 0000d468 /system/lib/libc.so
I/DEBUG ( 494): #31 pc 0000d468 /system/lib/libc.so
I/DEBUG ( 494): stack:
I/DEBUG ( 494): 4080bc18 3fc971ba
I/DEBUG ( 494): 4080bc1c 00000000
I/DEBUG ( 494): 4080bc20 00000000
I/DEBUG ( 494): 4080bc24 00000000
I/DEBUG ( 494): 4080bc28 00000000
I/DEBUG ( 494): 4080bc2c 00000000
I/DEBUG ( 494): 4080bc30 00000000
I/DEBUG ( 494): 4080bc34 00000000
I/DEBUG ( 494): 4080bc38 00000000
I/DEBUG ( 494): 4080bc3c 00000000
I/DEBUG ( 494): 4080bc40 00000001
I/DEBUG ( 494): 4080bc44 00000000
I/DEBUG ( 494): 4080bc48 00000002
I/DEBUG ( 494): 4080bc4c 00000000
I/DEBUG ( 494): 4080bc50 df002777
I/DEBUG ( 494): 4080bc54 e3a070ad
I/DEBUG ( 494): #01 4080bc58 00000000
I/DEBUG ( 494): 4080bc5c a9d398a7 /system/lib/libutils.so
W/AudioRecord( 495): obtainBuffer timed out (is the CPU pegged?) user=00005000, server=00005400
W/AudioRecord( 495): *** SERIOUS WARNING *** obtainBuffer() timed out but didn't need to be locked. We recovered, but this shouldn't happen (user=00005000, server=00005400)
W/AudioSystem( 354): AudioFlinger server died!
I/ServiceManager( 31): service 'media.audio_flinger' died
W/MediaMetadataRetriever( 354): MediaMetadataRetriever server died!
I/ServiceManager( 31): service 'media.player' died
W/Camera ( 354): ICamera died
I/ServiceManager( 31): service 'media.camera' died
W/AudioSystem( 60): AudioFlinger server died!
E/Camera ( 354): Error 100
I/DEBUG ( 494): debuggerd committing suicide to free the zombie!
I/DEBUG ( 531): debuggerd: Sep 21 2009 14:37:06
W/Camera ( 354): Camera server died!

The key bit there can be found by searching for 'SIGSEGV'

Any help on how to fix this would be appreciated! I'd like to fix this 'the right way' (ie. do not want to copy old cupcake camera app, etc.) Also, not against re-compiling the kernel, if that's what it takes.

Thanks!