Skip to content
Miatafy

The KUOW Radio Bug: How One HD Radio Station Bricked Thousands of Mazdas

In late January 2022, Seattle NPR affiliate KUOW (94.9 FM) broadcast HD Radio metadata that the Gen 6 Mazda Connect CMU could not parse. The radio service cached the bad data to flash, crashed trying to read it, and reloaded the same file on every restart. The result was a permanent reboot loop. The only supported fix was a full CMU hardware replacement.

This applies to any 2014–2017 Mazda running an older CMU firmware revision (Mazda3, Mazda6, CX-3, CX-5, CX-9, and MX-5), because they all share the same Gen 6 Connectivity Master Unit. The bug is the cleanest real-world demonstration of three structural weaknesses in that platform: no input validation on radio metadata, no process isolation, and a cache that survives every reboot.

The Mechanism

Section titled “The Mechanism”

The Gen 6 CMU determines a file’s type by reading its extension (the string after the dot in the filename), not by inspecting the file’s header bytes. KUOW’s HD Radio stream included image data (station logo or album art) transmitted without a file extension. No .jpg, no .png, just raw bytes.

The radio service received that data and cached it to the CMU’s internal flash, the way it caches any received artwork. Then it tried to process it. With no extension to key off, the parsing logic failed and the service crashed. The Service Manager, which supervises every process on the CMU, restarted it. On restart, the service read the same corrupted file back out of cache and crashed again. Restart, crash, restart, crash.

The corrupted file was written to persistent storage, so nothing the owner could do cleared it. Power cycling the car did not help. Disconnecting the battery did not help. The radio service reloaded the bad cache before the owner could ever reach a menu to delete it.

Why a Radio Crash Took Down the Whole Screen

Section titled “Why a Radio Crash Took Down the Whole Screen”

A failed radio tuner should be a missing radio, not a dead car. On the Gen 6 CMU it was the whole screen, because the radio service is not isolated — it is a dependency of the main HMI application, jciMMUI, which draws the entire user interface.

The Service Manager controls the boot sequence and runtime dependencies for over 100 processes, and that dependency tree is rigid. When a required service cannot start, nothing downstream of it starts either. So when the radio service entered its restart loop, jciMMUI could never fully initialize, and the failure cascaded: radio, navigation, Bluetooth, backup camera, and vehicle information screens all went dark, because they all route through the one UI application that was waiting on a service that would never come up.

There is no degrade-gracefully path on the stock CMU. The system cannot decide “radio is broken, skip it, bring up everything else.” It is monolithic by design.

Symptoms

Section titled “Symptoms”

Owners reported a few variants of the same underlying crash:

  • Endless reboot loop. Startup animation, black screen, animation again, repeating.
  • Frozen on KUOW. Some units locked onto the station — audio kept playing, but the touchscreen, navigation, Bluetooth, and everything else were unresponsive.
  • Total infotainment loss. Radio, navigation, Bluetooth, backup camera, and info screens all unavailable. Sometimes only the volume knob still responded.
  • No user recovery. Battery pull, power-button hold, and the reset button behind the volume knob all failed to clear the cache.

Which Vehicles Were Affected

Section titled “Which Vehicles Were Affected”
FactorDetails
Model years2014–2017
ModelsMazda3, Mazda6, CX-3, CX-5, CX-9, MX-5 — any Gen 6 Mazda Connect car with HD Radio
FirmwareOlder CMU software; newer firmware revisions were not affected
GeographySeattle metro — limited to KUOW’s 94.9 FM broadcast range
TriggerVehicle tuned to (or scanning past) 94.9 FM during the January 24–31, 2022 window

The detail that matters: vehicles on newer firmware were not affected. Mazda had improved the input validation in later software but never pushed that fix back to the older units. This is a recurring pattern on the Gen 6 CMU — fixes exist but are not distributed retroactively to the cars that need them, because there is no over-the-air update path.

Timeline

Section titled “Timeline”
DateEvent
January 24, 2022KUOW begins transmitting image files without extensions in its HD Radio stream
January 24–31, 2022Cars tuned to 94.9 FM begin failing as the bad data is cached
Late January 2022Seattle-area Mazda service departments are flooded with calls; one dealer reported around 50 affected customers
Early February 2022The story breaks; KUOW acknowledges the problem
February 8, 2022KUOW publishes its own coverage
February 9–10, 2022National tech press picks it up (The Register, Hackaday, GeekWire, Autoblog)
February–March 2022Mazda distributes service alerts; replacement CMUs begin reaching dealers, delayed by supply-chain constraints

The Root-Cause Dispute

Section titled “The Root-Cause Dispute”

Mazda’s position was that KUOW transmitted malformed data and corrupted the CMU. The company told The Register that “between 1/24–1/31, a radio station in the Seattle area sent image files with no extension,” and that its system “needs an extension to tell what a file is.”

KUOW’s operations director Dane Johnson pushed back, saying the station had not found “any malformed files or an image file without an extension.” Xperi, which owns HD Radio technology, could not initially confirm the malformed-data theory either.

Both sides hold some fault, and only one matters for understanding the platform:

  1. KUOW’s encoding chain sent something non-standard. A missing extension, a malformed metadata frame, or a misconfigured encoder — the broadcast was off-spec in some way.
  2. The firmware was indefensibly fragile. Even granting the bad signal, a robust system does not permanently brick itself over a radio broadcast. It validates the input, discards what it cannot parse, and keeps running. The CMU did none of that.

The second point is the one with consequences, because it is structural.

The Three Structural Failures

Section titled “The Three Structural Failures”

No input validation on radio metadata

Section titled “No input validation on radio metadata”

The radio service accepted HD Radio metadata and wrote it straight to cache without checking file type, size, or integrity, trusting a filename string to decide how to process raw bytes. A robust implementation would check magic bytes instead of the extension, validate size against expected bounds, write to a staging area and verify before promoting to the live cache, and silently skip anything that failed. This was well-understood, avoidable engineering in 2014 when the platform was designed.

A single service crash cascades to everything

Section titled “A single service crash cascades to everything”

Covered above: the radio service is a hard dependency of jciMMUI in the boot ordering, there is no process isolation, and the dependency tree has no fallback. One crash takes the screen, navigation, Bluetooth, and backup camera with it.

The corrupted cache survives reboot

Section titled “The corrupted cache survives reboot”

The service wrote received metadata to flash and read from that same cache on startup, with no validation on load, no integrity check, and no “this file crashed us last time, skip it” logic. A safer design would validate cached data before loading, implement a crash counter that clears the cache after repeated failures, keep received metadata in volatile RAM rather than persistent flash, or offer a safe-mode boot that skips non-essential cached data. The Gen 6 CMU has none of these. The Service Manager will restart a crashing service indefinitely, reloading the same poison on each pass, with no circuit breaker.

Why No Software Fix Was Possible

Section titled “Why No Software Fix Was Possible”

The Gen 6 CMU has no over-the-air update capability — firmware updates require a USB drive and a manual on-screen process. But a car in the reboot loop could not boot far enough to accept a USB update. With no way in, the only option was physical replacement of the Connectivity Master Unit, roughly $1,500 a unit before Mazda authorized goodwill repairs.

The Fix

Section titled “The Fix”

Resolution came from both sides.

KUOW worked with Xperi to correct whatever was non-standard in its HD Radio metadata. The bad transmissions stopped after January 31, 2022.

Mazda North American Operations (MNAO) sent service alerts to dealers. Affected owners could take the car to a dealer, who submitted a goodwill warranty request; once approved, the dealer ordered a replacement CMU and performed the repair at no charge. The process was slow — supply-chain delays meant replacement units took weeks to arrive at some dealerships, during which owners had no infotainment at all.

Recovery Steps (If You Are Still Affected)

Section titled “Recovery Steps (If You Are Still Affected)”

For a 2014–2017 Mazda caught by this bug and never repaired:

  1. Contact your local Mazda dealer and reference the January 2022 KUOW HD Radio issue. Dealers were instructed to submit goodwill warranty requests for free CMU replacement.
  2. If the dealer is unaware of it, ask them to check with MNAO about the January 2022 HD Radio service alert covering 2014–2017 vehicles in the Seattle area.
  3. Do not attempt a USB firmware update. The CMU cannot boot far enough to process one in this state.
  4. Do not attempt to flash the CMU yourself. Clearing the cache through the serial console means disassembling the dash, connecting to UART pins, and deleting files from the Linux filesystem by hand. It voids warranty coverage and risks further damage.
  5. A full CMU replacement is the supported fix. The replacement ships with newer firmware that includes the improved input validation.

References

Section titled “References”