AIKIDO-2026-997388

TL;DR

The PSA Protected Storage TLS credential backend declares its credential-store mutex as a statically zero-filled structure and never initializes it, leaving its wait queue with NULL list pointers. The uncontended lock path works, but when two contexts contend the lock the blocking thread is appended to the zeroed wait queue and dereferences a NULL pointer, faulting the kernel. A deployment performing concurrent TLS handshakes, or a credential operation concurrent with a handshake, triggers a deterministic kernel panic and device reset. The fix defines the mutex with the static initializer that installs a valid wait queue.