Note to Colors about using the GSI 16 on a Moto G 2026

Colors, I was surprised that ChatGPT had such a question. When I first flashed the original GSI that you had, it was bigger than the partition ( partition a I believe) had available and ChatGPT deleted some unnecessary items and borrowed space from the other partition (b if I remember) and got it to the size it needed for that original GSI.

Later when it helped me flash the LineageOS, there was a small difference in sizes but ChatGPT pointed out to me that the size was dynamically resized to fit the image.

So now it’s wondering what to do? I’ll just tell it to figure it out and I’ll let you know what happens.

you can try this section with delete-logical-partition if there’s a Not enough space to resize partition message shown- Moto G60s · TrebleDroid/treble_experimentations Wiki · GitHub

I looked around and look what I found:

Here’s the sequence of commands for installing a GSI on a device with dynamic partitions, when system.img is larger than the current system partition:

Reboot to fastbootd (not regular fastboot):
fastboot reboot fastboot

Check current partition sizes (optional but useful):
fastboot getvar all (look for partition-size:system and super)

Delete the existing system logical partition:
fastboot delete-logical-partition system

Create a new logical partition with a size equal to or larger than your system.img (in bytes):
fastboot create-logical-partition system

Example: fastboot create-logical-partition system 3000000000 for ~2.8 GB

Flash the GSI:
fastboot flash system system.img

Optional – reset active slot if needed:
fastboot set_active other
fastboot reboot

Important: The total free space inside the super partition must be sufficient. If you run out of space, you may need to delete other logical partitions (e.g., vendor, product) to free up room, then recreate them after flashing.

Before attempting an installation, make sure you have a recovery plan in case something goes wrong.

Thank you, tcecyk, we need a little help. Partition size has become a stress, lately.

my understanding is to remove the product partitions as system will get resized on the fly from system.img if there’s space available

ChatGPT resized the partition a and we flashed the new /e/OS. It forgot to erase user data and the previous LineageOS had a database version 24 but the new /e/OS needed version 21 and the boot sequence got stuck because of this. We went back to fastbootd and erased user data and rebooted without problems. Right now I am waiting for the OS to recognize my SIM and I will test the calling functions.

Originally, if I remember, ChatGPT did a bunch with all of those other partitions like vendor_a, vendor_b, product_a, product_b, etc to make room to grow the system_a for the original 4.3 GIS that I originally flashed.

I’m on the free ChatGPT and the chats keep ending and it keeps loosing the chat history. ChatGPT is able to see a summary of previous chats and we continue but I no longer have an archive that I can go back to. After the testing I will ask ChatGPT to write a summary of what it did (to the best of its memory.)

OK here is the ChatGPT summary. I can tell, however, that it is only writing a summary of what we did today. It has lost its memory of what we originally did with all of those other partitions. My chat history that I do have is spotty. I have some and have lost others. I will try to go back and see if I can find that original chat with the original resizing. Here is today’s summary.

I don’t think this has been mentioned but my Moto G 2026 has only 128GB and not 256 GB. FWIW.

Installing /e/OS 4.4 on Moto g-2026 (XT2613-1 / nevada)

I successfully installed /e/OS 4.4 (Android 16, microG GSI) on a Motorola Moto g-2026 (XT2613-1, codename nevada).

The phone has a MediaTek MT6835, dynamic partitions, and an unlocked bootloader. The procedure below resulted in a fully functioning system with the T-Mobile physical SIM.

/e/OS image

The GSI used was:

eOS-4.4-a16-2026.09.30-microG-gsi.img

The image was flashed to system_a.

Important: resize system_a before flashing

The stock system_a partition was not large enough for this GSI, so it was necessary to resize it in fastbootd.

First, boot the phone into the bootloader and enter fastbootd:

fastboot devices

Then:

fastboot reboot fastboot

Once in fastbootd, resize system_a:

fastboot resize-logical-partition system_a 0xEA3EA000

The resulting partition size is:

0xEA3EA000

which is:

3,929,972,736 bytes

I verified the new size with:

fastboot getvar partition-size:system_a 2>&1

The result was:

partition-size:system_a: 0xEA3EA000

Flash /e/OS

With the phone still in fastbootd, I flashed the GSI:

fastboot flash system_a /home/ehardin/Downloads/eOS-4.4-a16-2026.09.30-microG-gsi.img

The image was successfully written in 15 sparse chunks, all returning OKAY.

Afterward, I verified the partition size again:

fastboot getvar partition-size:system_a 2>&1

Result:

partition-size:system_a: 0xEA3EA000

Important: wipe userdata when changing from the previous ROM

The first boot initially stopped at the /e/OS boot animation.

ADB was still accessible, and the system log showed that the existing /data contained an old LineageOS Settings database:

java.lang.RuntimeException: Unable to get provider
org.lineageos.lineagesettings.LineageSettingsProvider

with:

android.database.sqlite.SQLiteException:
Can't downgrade database from version 24 to 21

This indicated that the old ROM’s database was incompatible with /e/OS.

I therefore wiped userdata only. I did not reflash the system image.

From fastbootd:

fastboot erase userdata

The result was:

Erasing 'userdata'                                 OKAY

Then:

fastboot reboot

After this, /e/OS booted normally.

Note: Erasing userdata obviously removes the existing user data, so anything important should be backed up beforehand.

T-Mobile network setting

After completing the /e/OS setup and inserting the T-Mobile SIM, the SIM was detected correctly, but the phone initially would not make or receive cellular calls.

The important setting was:

Settings → Network & internet → SIMs → T-Mobile → Preferred network type

The default setting was 3G.

Changing it to LTE resolved the cellular registration problem.

After changing the setting, I restarted the phone.

Final testing

With the T-Mobile SIM installed:

  • Outgoing calls: WORKING
  • Incoming calls: WORKING
  • Mobile data: WORKING
  • Wi-Fi disabled: All of the above continued to work

So the final /e/OS 4.4 installation was successfully operating on the T-Mobile cellular network without Wi-Fi.

Summary of the critical commands

For reference, the key fastbootd commands were:

fastboot reboot fastboot

fastboot resize-logical-partition system_a 0xEA3EA000

fastboot getvar partition-size:system_a 2>&1

fastboot flash system_a /home/ehardin/Downloads/eOS-4.4-a16-2026.09.30-microG-gsi.img

fastboot getvar partition-size:system_a 2>&1

fastboot erase userdata

fastboot reboot

The two critical points that may not be obvious to someone attempting this on the same device are:

  1. system_a needs to be enlarged to 0xEA3EA000 before flashing this /e/OS 4.4 GSI.
  2. After switching from the previous ROM, wiping userdata was necessary to eliminate the incompatible old LineageOS Settings database.

Finally, if T-Mobile cellular service appears not to work after installation, check:

Settings → Network & internet → SIMs → T-Mobile → Preferred network type

and make sure it is set to LTE, rather than 3G.

This should give someone enough detail to reproduce the successful installation while avoiding the earlier dead ends. If you want, I can also turn this into a shorter XDA-style post with just the device specs, commands, and results.

OK…here is what I was able to find from my ChatGPT chat history during the time the AI was helping me flash the original 4.3 /e/OS GSI onto my stock Moto G 2026.

in this part of this chat the AI is trying to remember what we did previously

The phone is in fastbootd. :white_check_mark:

Then you ran:

fastboot getvar partition-size:system

and got:

FAILED (remote: ‘Could not open partition’)

That initially looked like a problem, but it wasn’t. In fastbootd your phone exposes the actual logical partition as system_a, not system.

We then ran:

fastboot getvar all

and got the very useful information you pasted earlier.

The critical part was:

is-logical:system_a: yes
partition-size:system_a: 0x29467000

Your phone also reported:

dynamic-partition: true
super-partition-name: super
partition-size:super: 0x22C000000

and:

is-logical:product_a: yes
is-logical:system_a: yes
is-logical:system_ext_a: yes
is-logical:vendor_a: yes
is-logical:system_dlkm_a: yes
is-logical:vendor_dlkm_a: yes

So this is why we were checking the partition size. A GSI gets flashed into the logical system partition, and on dynamic-partition devices that partition can be resized. AOSP specifically documents checking for insufficient space when flashing a GSI and, if necessary, deleting another logical partition such as product_a to make room.

And there’s an important detail

Your system_a is:

0x29467000

which is about 660 MiB.

That is relatively small.

But we should not conclude yet that the new /e/OS GSI won’t fit. With dynamic partitions, system_a can potentially be resized within the super partition. The important question is whether there is enough free space in super to accommodate the GSI after the appropriate resizing/deletion of other logical partitions. That’s exactly why we were gathering this information rather than blindly issuing a fastboot flash system … command.

And /e/OS itself specifically warns that an unsupported device using a GSI should have a way to restore the original software if something goes wrong — which is why having that Motorola Software Fix package sitting there is a very good safety net.

…

I added up the current logical partitions we obtained earlier:

Logical partition Size
product_a ~4.0 GB
system_a ~660 MB
system_ext_a ~593 MB
vendor_a ~849 MB
vendor_dlkm_a ~13 MB
system_dlkm_a ~0.33 MB
Total ~5.97 GB

That leaves approximately:

2.92 GB of space inside super.

Your GSI needs:

3.90 GB.

Therefore, it does NOT currently fit.

But this does not mean the GSI can’t be installed.

This is exactly the dynamic-partition issue we were investigating. The likely solution is to remove/resize one or more existing logical partitions—most importantly product_a—before flashing the GSI. The GSI itself becomes the new system partition.

And there’s a very important reason we did all this measurement before flashing: we now know we shouldn’t simply issue:

fastboot flash system v4.3-a16-20260821-microG-gsi.img

That would be the wrong approach with this partition layout.

*** that chat ended and I am now going to another chat ***

First, delete only product_a:

fastboot delete-logical-partition product_a

*** and again…You’ve reached the limit for chats that include data analysis. ***

Continuing on the next relevant command I see is:

fastboot resize-logical-partition system_a 0x100000000

That makes system_a exactly 4 GiB, which is large enough for your 3.896-GB GSI.

*** and again…You’ve reached the limit for chats that include data analysis. ***

Next step

We need to continue with the partition preparation for the GSI.

Please run this next command from the same fastboot window:

fastboot delete-logical-partition product_a

Next command

Stay in fastboot and run:

fastboot delete-logical-partition product_b

So far we have successfully:

Resized system_a
Deleted product_a
Deleted product_b
Next command

Still in fastboot, run:

fastboot delete-logical-partition product

Now run:

fastboot delete-logical-partition product_a

Then run:

fastboot getvar partition-size:system_a

Perfect. That confirms:

partition-size:system_a: 0x100000000

That’s 4,294,967,296 bytes (4 GiB).

Your GSI file is about 3,896,528,896 bytes (~3.63 GiB), so it fits within the current system_a partition.

Now run:

fastboot getvar partition-size:super

Excellent. We now have the two critical sizes:

system_a = 0x100000000 = 4 GiB
super = 0x22C000000 = 9.17 GiB
Your GSI = 3,896,528,896 bytes ≈ 3.63 GiB

So the GSI fits in the 4 GiB system_a partition.

Next step: flash the GSI

Your phone is still in fastboot and slot A is active. The system_a partition is already 4 GiB, and your GSI is about 3.63 GiB, so we can now attempt the actual flash.

Run this exactly:

fastboot flash system_a “C:\Users\Administrator\Downloads\eOS_GSI_16\v4.3-a16-20260821-microG-gsi.img”
(Note: it looks like I had rebooted to Windows at some point for some reason judging by the path. I believe this was to get that Motorola Software Fix package that could only be downloaded via Windows.)

Next, run this command:

fastboot erase userdata

This will wipe the phone’s user-data partition, which is normally required when changing from the stock Motorola system to a substantially different GSI.

fastboot reboot

And that is when the original 4.3 /e/OS GSI rebooted and worked except for the calling functions. Of course this latest 4.4 /e/OS GSI works for everything that I have tested so far and that includes incoming and outgoing phone calls.

I hope someone can distill this into a useful “How To” page.

Thanks for the documentation. It will certainly benefit others who find themselves in the same situation as yours.

Colors,

I might have some more for you later. I had tested just making and receiving a phone call. I didn’t actually speak since I was calling myself on another phone. I just verified that the calls went through. Well, it turns out that the call audio was having trouble and was not going through. I worked on it a little yesterday with AI and, before I called it quits for the day, here is where the AI left off: (The table gets all crushed together so I will try to force it open a little.

There it is. This gives us a very important difference:

Working Lineage GSI /e/OS 4.4
Android 16 16
Framework build BP4A.251205.006 BP2A.250805.005
AudioPolicyManager 735,040 bytes 735,256 bytes
Call connection Works Works
Call audio Works Fails / audioserver crashes

So the working Lineage image is based on a newer Android 16 framework base than /e/OS 4.4.

That is much more informative than simply knowing the libraries differ.

What I think we should do next

Before changing anything on your phone, I’d like to determine whether the /e/OS 4.4 audio crash is a known Android 16 AudioPolicyManager/vendor compatibility issue associated with its older framework base.

I’ll let you know what I find out when I get back to this AI project.

I’ve been working with ChatGPT to solve the problem of not having call audio after connecting a phone call. Since I am on the free ChatGPT program the program keeps cutting my time off and telling me I can start again in 5-7 hours. Rather than start a new chat that I have found to limit the AI’s memory of what has taken place previously, I have had to wait, sometime over night, to continue so that the AI would not loose the details of the chat. The AI is still working towards a solution but, I am afraid of loosing this chat completely before a final solution could be reached so I asked it to summarize what it had discovered so far in order to preserve a history in call all is lost. Here is the AI summary to date:

Moto g-2026 (nevada) — /e/OS 4.4 GSI Call-Audio Problem

Device

  • Motorola Moto g-2026 / nevada / XT2613-1
  • MediaTek MT6835
  • T-Mobile SIM
  • Dynamic-partition device
  • /e/OS 4.4 Android 16 GSI
  • GSI: eOS-4.4-a16-2026.09.30-microG-gsi.img
  • Android 16 / SDK 36
  • Build: BP2A.250805.005
  • /e/OS was clean-flashed with userdata erased.

What works

The phone boots normally and the cellular network works.

  • T-Mobile SIM is recognized.
  • Correct phone number is displayed.
  • Outgoing calls connect.
  • Incoming calls connect.
  • Ringtone works.
  • Normal media/video/web audio works.
  • Microphone permissions have been checked.
  • Audio volumes have been checked.

The problem is specifically cellular call audio:

  • Once a cellular call connects, neither side can hear the other.
  • Earpiece produces no call audio.
  • Speakerphone also produces no call audio.

The same Moto hardware/vendor stack previously worked correctly with the user’s LineageOS GSI. With LineageOS, both outgoing and incoming calls had working two-way call audio.

Therefore this does not appear to be a basic modem, SIM, speaker, microphone, or carrier problem.


Important finding: the vendor audio policy is not the problem

/e/OS is using:

/vendor/etc/audio_policy_configuration.xml

The policy contains the expected Motorola telephony audio definitions.

In particular:

  • Voice Call In = AUDIO_DEVICE_IN_TELEPHONY_RX
  • It supports 8/16/32/44.1/48 kHz.
  • Earpiece, Speaker, wired, USB and BT SCO routes all include Voice Call In.
  • voice tx also uses Voice Call In.

The live dump shows:

Config source: /vendor/etc/audio_policy_configuration.xml

and the Voice Call In definition is present.
The relevant routes are also present:

  • Earpiece ← Voice Call In
  • Speaker ← Voice Call In
  • Wired outputs ← Voice Call In
  • BT SCO ← Voice Call In
  • voice tx ← Voice Call In

The /e/OS vendor policy files were also compared against the Motorola stock vendor files and found to be byte-for-byte identical.

Therefore changing the Motorola vendor audio_policy_configuration.xml is probably not the solution.


Actual failure

During an active cellular call, Android AudioPolicyManager selects the Motorola telephony RX hardware bridge:

selectBestRxSinkDevicesForCall() ... using HW Bridge

Immediately afterward it crashes with:

connectAudioSourceToSink: a swOutput shall always be associated

audioserver then aborts/restarts.

The important Android source assertion is effectively:

sp<SwAudioOutputDescriptor> swOutput =
        
sourceDesc->swOutput().promote();
ALOG_ASSERT(swOutput != nullptr,
            
"%s: a swOutput shall always be associated",
            
__func__);

The failing object is therefore the SourceClientDescriptor representing the telephony RX source. Its swOutput weak reference is null when AudioPolicyManager tries to promote it.

This is a framework AudioPolicyManager problem, not simply a missing audio route.


Framework libraries investigated

The two most relevant /system/lib64 libraries are:

/system/lib64/libaudiopolicymanagerdefault.so

/e/OS:

  • size: 735,256 bytes
  • SHA256:
    96af43edf1913688ac23c7a4f812f5bb2b69dae1e0f538bfa3b97097450395d2

Lineage:

  • size: 735,040 bytes
  • SHA256:
    0bef7245bed893a7fc0d3045eb4ced8bc945c54f2f495bfed08407c3a45de192

/system/lib64/libaudiopolicycomponents.so

/e/OS:

  • size: 689,536 bytes
  • SHA256:
    2e7c17c9638b83a6f86df1109463f2a6653e8c9f7533777c7a80a691837f0901

Lineage:

  • size: 706,040 bytes
  • SHA256:
    2b6e3cc69fe334efe8c21fb8d1e6c4bb78d498f34f49b525dba74991bf87924

These are therefore the first framework libraries I would investigate for replacement or rebuilding.

However, the investigation has NOT yet proven that simply copying the Lineage versions into /e/OS is safe. The libraries are from different framework builds, so the C++ ABI/vtables and surrounding framework components must match.


Important binary comparison

The actual connectAudioSourceToSink() code in /e/OS and Lineage is essentially the same at the point where it promotes SourceClientDescriptor::swOutput.

Both contain the expected setSwOutput() operation.

Therefore the problem is not simply:

“/e/OS forgot to call setSwOutput().”

Instead, the /e/OS object reaches the assertion with a null swOutput, while the equivalent Lineage path does not.

This points toward an AudioPolicyManager/framework object-lifecycle or ABI difference, rather than a missing XML route.


Particularly interesting difference

A real structural difference was found in startSource().

Lineage performs an indirect virtual call through an object/vtable slot at:

[x23,#216]

while /e/OS performs the corresponding call through:

[x23,#200]

Specifically:

Lineage

ldr x8, [x23,#216]
mov x0,x22
mov w1,#9
mov w2,wzr
blr x8

/e/OS

ldr x8, [x23,#200]
mov x0,x22
mov w1,#9
mov w2,wzr
blr x8

This is a genuine structural difference and not merely a relocated address.

The exact virtual functions represented by those slots have not yet been identified because the stripped binaries do not retain usable vtable symbols.

This difference is potentially important because startSource() is directly involved in establishing the source/output relationship before connectAudioSourceToSink() reaches the fatal swOutput assertion.


Other relevant framework libraries

The /e/OS framework currently contains:

/system/lib64/libaudiopolicy.so
/system/lib64/libaudiopolicycomponents.so
/system/lib64/libaudiopolicyengineconfigurable.so
/system/lib64/libaudiopolicyenginedefault.so
/system/lib64/libaudiopolicymanagerdefault.so

Because AudioPolicyManager, AudioPolicy components, policy engine and their C++ classes interact through shared objects, replacing only one library may create an ABI/vtable mismatch.

Therefore, if building a corrected /e/OS GSI, I would investigate the complete AudioPolicy framework set, rather than blindly replacing one .so.

The most obvious comparison/replacement candidates are:

libaudiopolicymanagerdefault.so
libaudiopolicycomponents.so
libaudiopolicy.so
libaudiopolicyengineconfigurable.so
libaudiopolicyenginedefault.so

The first two are the strongest suspects based on the binary investigation so far.


What should NOT need changing

The Motorola vendor audio policy should probably be retained.

In particular, do NOT start by replacing:

/vendor/etc/audio_policy_configuration.xml
/vendor/etc/audio_policy.conf

The /e/OS copies were compared against the Motorola stock vendor copies and are identical.

The vendor configuration already contains the necessary:

Voice Call In
AUDIO_DEVICE_IN_TELEPHONY_RX
voip_rx
voice tx
Telephony Tx

and the necessary routes.


Most likely explanation

The current evidence points to a compatibility problem between the Android 16 /e/OS framework AudioPolicy implementation and the Motorola vendor audio HAL/policy behavior.

The Motorola vendor side is exposing a telephony RX hardware bridge.

/e/OS recognizes that bridge and selects:

using HW Bridge

but the /e/OS AudioPolicyManager subsequently reaches:

connectAudioSourceToSink()

with a SourceClientDescriptor whose swOutput weak reference is null.

That triggers Android’s fatal assertion:

a swOutput shall always be associated

and kills audioserver.

The result is exactly what the user experiences: the cellular call itself remains connected, but the call-audio path cannot be established.


Recommended development direction

Rather than modifying the Motorola vendor audio configuration, compare the /e/OS AudioPolicy framework against the working LineageOS framework.

Priority:

  1. libaudiopolicymanagerdefault.so
  2. libaudiopolicycomponents.so
  3. The remaining libaudiopolicy*.so libraries as a matched set if necessary.

The goal should be to identify the framework implementation that correctly establishes the SourceClientDescriptor → SwAudioOutputDescriptor association for AUDIO_DEVICE_IN_TELEPHONY_RX.

If the Lineage AudioPolicy implementation is compatible with the /e/OS Android base, the Lineage versions may provide a working reference or possibly a replacement. But this should be checked for framework/ABI compatibility before simply copying them into the GSI.


Bottom line

The phone’s T-Mobile connection works.

The modem/call connection works.

The Motorola vendor audio policy contains the correct telephony routes.

The failure occurs inside Android framework AudioPolicyManager when it tries to create the telephony RX audio connection.

The strongest current target for fixing the GSI is therefore the framework AudioPolicy implementation, especially:

libaudiopolicymanagerdefault.so
libaudiopolicycomponents.so

with the other libaudiopolicy*.so files considered as a matched framework group.

The key error to search for in any future test/build is:

connectAudioSourceToSink: a swOutput shall always be associated

and the preceding:

selectBestRxSinkDevicesForCall() ... using HW Bridge

A successful fix should allow the Motorola telephony RX hardware bridge to be connected without SourceClientDescriptor::swOutput() being null, preventing the audioserver crash and restoring cellular call audio.

Thank you, I’ll look into it.

I’ve done a little more looking into this with the AI. I asked it to write a summary that brings us up to date. Naturally, it make to very technical but hopefully the main points are made. I don’t see a way to attach a text file so here is the summary:
Please use this as the most recent state of the Moto g-2026 /e/OS 4.4 cellular-call audio investigation. It supersedes the older summary I sent you several days ago.

Current device

  • Motorola Moto g-2026
  • Codename: nevada
  • Model: XT2613-1
  • MediaTek MT6835
  • 4 GB RAM / 128 GB storage
  • T-Mobile physical SIM
  • Unofficial /e/OS 4.4 Android 16 microG GSI
  • Build: eOS 4.4-a16-20260930-UNOFFICIAL-GSI
  • Android build ID: BP2A.250805.005
  • userdebug, rooted via adb root
  • AVB/verity disabled
  • Overlayfs available for system/vendor areas

The phone can now:

  • boot normally
  • connect to Wi-Fi
  • use T-Mobile cellular data
  • make outgoing cellular calls
  • receive incoming cellular calls
  • make/receive calls with Wi-Fi completely disabled
  • play normal media/web audio
  • play ringtone audio

So IMS registration, VoLTE/call establishment, T-Mobile service, and basic speaker/audio playback are no longer the primary problem.

Current failure

The remaining problem is cellular voice-call audio.

When a cellular call is connected:

  • Neither side reliably hears the other.
  • There may occasionally be tiny/bursty fragments of audio, but the current synchronized test produced no usable audio in either direction.
  • Android’s audio server crashes during the call-mode/routing transition.
  • After the call ends, the normal audio services recover, but Recorder may remain unable to record.
  • Historically, Recorder can work immediately after a reboot, then a cellular call causes Recorder input to stop working until another reboot.

We have not established with absolute certainty that every post-call Recorder failure is caused by the call, because the most recent synchronized test did not include a Recorder test immediately before dialing. That should be tested in a future controlled experiment.

The important breakthrough

We performed a synchronized cellular-call transition capture.

The critical sequence in the logs is:

  1. Android switches to MODE_IN_CALL.

  2. AudioPolicyManager selects the earpiece for call receive.

  3. Android requests the telephony RX path:

    AUDIO_DEVICE_IN_TELEPHONY_RX (0x80000040) -> AUDIO_DEVICE_OUT_EARPIECE (0x1)

  4. The MediaTek audio HAL receives the request.

  5. The MediaTek HAL enters its phone-call routing path.

  6. The HAL logs creation of a patch with handle 0x6.

  7. AudioPolicyManager then enters:

    connectTelephonyRxAudioSource()
    → connectAudioSource()
    → connectAudioSourceToSink()

  8. It aborts on:

    connectAudioSourceToSink: a swOutput shall always be associated

  9. audioserver crashes/restarts.

  10. The call remains established, but call audio is broken.

  11. After hangup, AudioPolicy/AudioFlinger become available again, but Recorder can remain broken.

This is currently the strongest evidence in the entire investigation.

What this means

The evidence now strongly points to an Android 16 AudioPolicyManager ↔ Motorola/MediaTek audio HAL compatibility/bookkeeping failure during the telephony RX hardware-bridge path.

In other words, this does NOT currently look like:

  • microphone permission problem
  • T-Mobile problem
  • IMS registration problem
  • missing VoLTE property
  • simple missing audio-policy XML route
  • ordinary speaker-volume problem
  • ordinary microphone permission problem

The MediaTek HAL appears to accept/process the telephony RX patch request. The fatal failure occurs in the Android framework’s AudioPolicyManager afterward, when it expects the RX source descriptor to have an associated software output:

swOutput != nullptr

but it is null.

Audio policy findings

The active policy file is:

/vendor/etc/audio_policy_configuration.xml

It contains:

  • Built-In Mic input port
  • Back Mic input port
  • Telephony RX input port:
    Voice Call In
  • Telephony TX output sink
  • routes allowing Voice Call In to earpiece/speaker
  • routes allowing Built-In Mic / Back Mic / headset/USB microphones toward Telephony Tx

So the basic policy declarations for telephony audio are present.

There is also an incall_music_uplink output with:

  • I/O handle 45
  • AUDIO_OUTPUT_FLAG_INCALL_MUSIC

but it is normally standby/zero-frame and should not be assumed to represent the actual microphone uplink.

AudioPolicy dumps before/after the call show the expected policy objects, but during the actual failure AudioPolicy/AudioFlinger become temporarily unavailable because audioserver is crashing.

MediaTek HAL findings

Primary vendor HAL:

/vendor/lib64/hw/audio.primary.mediatek.so

audio.primary.mt6835.so points to it.

Active service:

android.hardware.audio.service.mediatek

The HAL contains relevant symbols including:

  • AudioALSAHardware::createAudioPatch()
  • AudioALSAHardware::releaseAudioPatch()
  • AudioALSAStreamManager::routingOutputDevicePhoneCall()

HAL Build ID:

7ec9e82c5323021f47749912bd58947d

The actual runtime log for:

TELEPHONY_RX -> EARPIECE

shows the MediaTek phone-call routing path being entered and a patch handle 0x6 being produced.

The HAL does not expose the Android framework concept of:

SourceClientDescriptor::swOutput

That is framework-side bookkeeping.

Therefore the most useful current characterization is:

The vendor HAL appears to process the hardware patch request, but Android 16 AudioPolicyManager does not establish the framework-side software-output association that its own assertion requires.

We do not yet know exactly why that association is missing.

Framework binary investigation

The running framework library is:

/system/lib64/libaudiopolicymanagerdefault.so

Build ID:

475bf46c47c9e3c8e48db9544b664bc7

A matching copy exists in the investigation directory as:

framework-library.so

The binary is stripped, but it contains enough embedded symbol information to identify the relevant functions. There is not enough usable DWARF/local-variable information to directly determine the missing descriptor state.

The exact source commit used to build this unofficial GSI has not yet been identified.

Comparison against AOSP Android 16 AudioPolicyManager shows that the swOutput invariant is expected behavior; reaching the assertion is not a normal successful-call state.

Other important findings

  • No MSD module was found, so an MSD-specific exception does not currently explain the behavior.
  • Audio policy normally returns to MODE_NORMAL after the crash/hangup.
  • The five stable policy patches return after recovery.
  • Earlier observations of AUDIO_DEVICE_NONE in AudioFlinger were initially suspected to indicate broken microphone routing, but they were later correctly determined to be fields in existing output-thread records and are NOT, by themselves, proof of a broken mic route.
  • There was no active AudioFlinger input thread in the initial stable snapshot.
  • The policy dump’s declaration of microphone/telephony inputs does not prove that a live microphone input stream was successfully opened.

What has NOT been changed

During this investigation we deliberately did NOT modify:

  • audio_policy_configuration.xml
  • MediaTek audio HAL
  • tinymix mixer controls
  • VoLTE/IMS properties
  • vendor audio configuration
  • framework binaries
  • partition layout
  • GSI image

Everything so far has been diagnostic/read-only.

Reversibility

The /e/OS 4.4 GSI can be reflashed if necessary, so controlled experiments are possible.

However, the preferred next step is not random modification of vendor audio XML, mixer values, IMS settings, or the HAL.

We want to understand the exact framework-side reason why the SourceClientDescriptor has no swOutput during the TELEPHONY_RX -> EARPIECE hardware-bridge request.

Most promising next research direction

The next investigation should focus specifically on:

Why Android 16 AudioPolicyManager’s telephony RX hardware bridge reaches connectAudioSourceToSink() with swOutput == nullptr on this MediaTek/MT6835 vendor HAL.

Potential areas to investigate:

  1. Exact Android 16 AudioPolicyManager source logic around:

    • connectTelephonyRxAudioSource()
    • connectAudioSource()
    • connectAudioSourceToSink()
    • SourceClientDescriptor
    • AudioPatch
    • hardware bridge vs software bridge selection
    • swOutput association
  2. Determine what output descriptor Android expects for the telephony RX source.

  3. Determine why that descriptor is absent on this GSI/vendor combination.

  4. Compare the behavior with an Android/Moto firmware environment where the same MediaTek HAL successfully handles calls, if such a comparison can be made.

  5. Look for a targeted framework/policy workaround that avoids the fatal invariant or correctly associates the required output, rather than blindly changing mixer controls.

  6. If necessary, design a minimal reversible experiment that can distinguish:

    • AudioPolicyManager bug
    • hardware-bridge descriptor-selection problem
    • vendor HAL/framework contract mismatch
    • GSI/vendor incompatibility

Diagnostic files

All investigation material has been copied from the original Linux machine to the external OS drive in:

Moto_g2026_Audio_Investigation

It contains:

  • Agents.md
  • audio-call-transition-20261007T150448Z/
  • audio-policy-crash-path-20261007/
  • audio-hal-patch-20261007/

The directory is about 23 MB.

Important files include the actual captured logs and read-only copies of:

  • libaudiopolicymanagerdefault.so
  • audio.primary.mediatek.so
  • android.hardware.audio@7.1-impl-mediatek.so
  • mini-debug data

The Agents.md file contains the full accumulated investigation state and should be read before beginning any new experiments.

Bottom line

At this point, the investigation has moved substantially beyond “the phone has no call audio.”

We have a reproducible framework crash on the exact telephony RX routing transition:

MODE_IN_CALL
→ TELEPHONY_RX -> EARPIECE
→ MediaTek HAL creates patch 0x6
→ AudioPolicyManager swOutput == nullptr
→ audioserver aborts
→ no call audio
→ possible persistent post-call Recorder failure.

Please start from this state rather than restarting the older IMS/VoLTE investigation.

I noticed that in TrebleDroid Settings there is the option” Disable ‘Voice Call in’ route", which sets persist.sys.phh.disable_voice_call_in and removes the voice call route In audiopolicy voice_tx from audiopolicy when loading the configuration.

I don’t know if you’ve already tried it. If not, could you turn it on and reboot, then test a call?

I don’t suppose this is the solution, but the problem in your analysis seems close enough that it would be worth a test. If it changes something (the audio works, the audioserver crash disappears/changes or the behavior changes in any way), it would be very useful information for the investigation.

Edit: Never mind! I’ll do a compilation and we’ll see.

I have said it before and I will say it again…“You are a genius!” :grinning_face:

"We have now isolated a reproducible configuration that works:

TrebleDroid → Misc features → Disable Voice Call In = ON"

Fantastic…The only comment I have is that
The TrebleDroid Settings is already installed in your /e/OS 4.4.
but
the TrebleDroid package has no launcher activity declared.
so I had to expose the settings with
adb shell am start -n me.phh.treble.app/.SettingsActivity

Again, Thanks a million. I will continue to test but I believe we have it…

Ed

I have tested successfully outgoing and incoming phone calls with and without WiFi. Same with incoming and outgoing SMS and MMS messages.

I have also gone to the Internet with WiFi off and browsed and even listened to a YouTube music video successfully.

I have tested the Camera front and back, photo and video including playback and all worked.

USB is working for both charging and File Transfer.

Volume audio sliders all seem to be working with notifications and calls and ringtones.

Assuming that you do not have a Moto G 2026 to test with, is there any other test you can think of? I do not have any bluetooth devices to test that nor wired ear piece. But other than that, let me know if you think of anything you would like me to test. As far as I’m concerned this should be a “community” image for this phone.

I see that the Moto G Play 2026 is also called “nevada” but they seem to have a different model number, storage capacity, and charging watts so I assume that would not necessarily fit this image without testing.

Ed

PS, I guess there was also that whole deleting product_a partition thing and expanding system_a (I believe I am remembering that correctly)

Ed

Treble Settings are here, in System menu →


The icon is black, yeah… no time for that!

Maybe, i’ll make a trimmed down version, the GSI is huge.

Yes, I found the TrebleDroid settings. I don’t know why I didn’t see them before and AI didn’t know where to direct me. So we are good. All is working on my side. This is a test phone so feel free to ask me to do a new flash anytime you want.

Ed

If you enter TrebleDroid Settings, the last option is Updater. Enter the Updater. The system will automatically check if there is a new GSI version (currently this is it). Up, on the right, on the line with the title Updater, you have three points. The option “Install Update manually” will ask you to provide .the xz archive you downloaded from SourceForge. (eOS-4.4-a16-2026.09.30-microG-gsi.img.xz). It will also ask for the ota file.json, (you will also download it from there), but it is not mandatory. Install, reboot and notice possible problems. Currently, if you have Rotation settings activated, and an online download or local installation in progress, it will stop if you rotate de phone in the hand. You can play by giving it a new local installation, having one already in progress. Or the same, an online download. In principle the action will continue. I played installing successively a14 then a15 and a16. It works, but it’s probably not the best way to upgrade. There are some problems with the timing of the action display. But I need clear conclusions. My only concern is whether it will install properly on the other partition… To me, was not a problem with the size of the partition, so there was no need for any intervention to delete and resize. Or… do you still have the other partition, system_b? I think that should be extended too… Finally, do not rush, look to find out how you stand on a possible Online update.