ISSUE-4073: Fix RPC app crash on BLE/USB disconnect (fixes #4073)

applications/services/rpc/rpc.c

@@ -155,6 +155,12 @@ void rpc_session_set_terminated_callback(
     furi_mutex_release(session->callbacks_mutex);
 }
 
+void rpc_session_wait_send_done(RpcSession* session) {
+    furi_check(session);
+    furi_mutex_acquire(session->callbacks_mutex, FuriWaitForever);
+    furi_mutex_release(session->callbacks_mutex);
+}
+
 /* Doesn't forbid using rpc_feed_bytes() after session close - it's safe.
  * Because any bytes received in buffer will be flushed before next session.
  * If bytes get into stream buffer before it's get epmtified and this

applications/services/rpc/rpc_app.c

@@ -502,5 +502,9 @@ void rpc_system_app_free(void* context) {
         furi_delay_tick(1);
     }
 
+    /* Wait for any in-flight rpc_send (e.g. from rpc_system_app_confirm) to complete
+     * before freeing rpc_app, so the app thread never uses rpc_app after free. */
+    RpcSession* session = rpc_app->session;
+    rpc_session_wait_send_done(session);
     free(rpc_app);
 }

applications/services/rpc/rpc_i.h

@@ -29,6 +29,9 @@ void rpc_send_and_release_empty(RpcSession* session, uint32_t command_id, PB_Com
 
 void rpc_add_handler(RpcSession* session, pb_size_t message_tag, RpcHandler* handler);
 
+/** Wait for any in-flight rpc_send to complete. Used before freeing RpcAppSystem. */
+void rpc_session_wait_send_done(RpcSession* session);
+
 void* rpc_system_system_alloc(RpcSession* session);
 void* rpc_system_storage_alloc(RpcSession* session);
 void rpc_system_storage_free(void* ctx);