Some months ago I saw someone on Reddit sharing their "Tab5 Smart Terminal" project with still had limited functionality and seeing this device kind of pulled me in to order one myself! It wasn't that easy to get your hands on such development device, but I managed to put in an order and had to wait for the restock.
Halfway through May it arrived and I started the same day working with this device trying to make a portable "Wardriver" out of it combined with the M5stack SMA Antenna (AT6668).

I thought I was prepared for the journey, but I wasn't! I had to work around quite a lot of quirks and limitations of the device and this ended up in a submission to the "M5Stack Global Innovation Contest 2026" and of which I already made it to the next round.

More of this project you can find and read through this link on Hackster.io.

https://www.hackster.io/Runaque/tab5-wardriver-a-custom-gps-enabled-wardriving-platform-d5948a

Additional finding: Secondary firmware bug — boot sequence crash on cold boot (MEPC: 0x00000006)
While investigating the sta.scan() crash, I discovered a second distinct firmware bug affecting the Tab5 in UIFlow2 v2.4.4.
Description:
On every cold boot, the device crashes during UIFlow2's initialization sequence before any user code runs. The device automatically reboots and boots successfully on the second attempt.
Crash signature:
Guru Meditation Error: Core 1 panic'ed (Instruction access fault). Exception was unhandled.

MEPC : 0x00000006
MCAUSE : 0x00000001
MTVAL : 0x00000006
Key observation:
The stack contains 0x7474696c (ASCII: "litt") pointing to a crash inside UIFlow2's LittlevGL/LVGL initialization sequence — not in user code.
Reproducibility:

100% reproducible on cold boot
Device always self-recovers on automatic reboot
Completely independent of user code — happens before any user application starts

This is a separate bug from issue #94 (sta.scan() at MEPC: 0x4ff13582). Both bugs share the same root environment (UIFlow2 v2.4.4 on Tab5) but occur at different stages and involve different subsystems.

Hey everyone,

Yesterday I got my M5Stack Tab5 and started building a wardriving app in UIFlow2 MicroPython. During development I discovered that calling sta.scan() causes a fatal Guru Meditation Error every single time, crashing and rebooting the device.

After extensive testing I can confirm:

• The crash is 100% reproducible - every scan attempt crashes
• The same crash address (MEPC: 0x4ff13582) appears every single time
• It happens regardless of code complexity, UI framework, scan interval or WiFi credentials
• It cannot be caught by Python exception handling - it crashes below the MicroPython VM
• Register analysis points to a null pointer dereference in the esp-hosted SDIO transport layer after an ETIMEDOUT on the ESP32-C6 coprocessor

I've filed a detailed bug report on GitHub including a minimal reproducer, crash dump analysis and probable root cause:

👉 https://github.com/m5stack/uiflow-micropython/issues/94

Has anyone else hit this on their Tab5? Any confirmations would help strengthen the case for a fix!