Camera session: an unrequested bulk record (subtype 0x06) drops a thumbnail and keeps the session open for minutes #256

Seen on hardware on 2026-11-15 (S3 main board, TC100 F4_C1_56_06_ED_3B, main with #239 and #252), while testing #239.

What happened

A scan found two new recordings. The thumbnail of the first (dir 100 num 34) was stored. Then:

1. 2035.06 s: GetThumbnail (cmdId 772) for the second one (num 33, a video). The camera starts the record on bulk subtype 0x04, 1 of 21 frames arrives.
2. 2035.15 s: the camera sends a record on bulk subtype 0x06 (ver 9, typ 1, 25 payload bytes, one frame). handle_bulk_frame() has one reassembler for all subtypes and resets it for the new record; the thumbnail is lost.
3. The remaining thumbnail frames match no open record, are acknowledged as stray frames and dropped (logged on DEBUG only). check_thumbnail_stall() does not fire, because it only looks at a record on subtype 0x04.
4. Until 2278 s the camera sends 53 such records (typ counting up 1..53, 25 or 26 bytes, every 2 to 40 s). Each one counts as progress and restarts the idle timeout.
5. 2338.6 s: No answer or data from the camera for 60 s; closing the camera session, ESP_ERR_TIMEOUT, 1 item(s) stored (session ended early).

The session kept the camera's Wi-Fi on for about five minutes; the video has no thumbnail in the catalog (flags 0).

Two defects

• A record on another subtype destroys the thumbnail being received.
• Nothing asks for the thumbnail again, and frames nobody asked for count as progress.

Open

• What the camera reports on subtype 0x06 (the log did not show the content).
• Why the records start after the second thumbnail request of the session and were not seen in earlier scans.

Generated by Claude Code