When a UE attaches to a gNB with multiple neighbour cells configured and default A3 event configuration is used, the generated RRCReconfiguration contains a `MeasIdToAddMod` whose `reportConfigId` is `0`. UPER encoding then fails because the ASN.1 schema constrains the field. gNB log immediately before the crash: ``` [NR_RRC] Preparing A3 Event Measurement Configuration! … [NR_RRC] Failed to encode DL-DCCH message [NR_RRC] UE 1: Failed to generate RRCReconfiguration [Thread 8 "TASK_RRC_GNB" received signal SIGSEGV] 0x… in __libc_free (mem=0xfff01feefe6b) #1 asn_set_empty #2 SET_OF_free (asn_DEF_NR_DRB_ToAddModList) #3 free_RRCReconfiguration_params (rrc_gNB.c) #4 rrc_gNB_generate_dedicatedRRCReconfiguration ``` The root cause is that there are **`continue`** paths that skip the index increment in the producer/consumer pair that maps neighbour cells to A3 reportConfigIds. Producer: `nr_rrc_get_measconfig()` in `openair2/RRC/NR/rrc_gNB.c` ``` int *neigh_a3_id = calloc_or_fail(neighbour_cells->size, sizeof(int)); // zero-filled … int i = 0; FOR_EACH_SEQ_ARR(nr_neighbour_cell_t *, neighbourCell, neighbour_cells) { … if (!a3Event) { if (default_a3_added) { neigh_a3_id[i] = 3; continue; // ← BUG: i not incremented } a3Event = get_a3_configuration(rrc, -1); if (!a3Event) { neigh_a3_id[i] = -1; continue; // ← BUG: i not incremented } default_a3_added = true; neigh_a3_id[i] = 3; } else { neigh_a3_id[i] = i + 4; } … i++; } ``` Consumer: `get_MeasConfig()` in `openair2/RRC/NR/MESSAGES/asn1_msg.c` ``` int i = 0; FOR_EACH_SEQ_ARR(nr_neighbour_cell_t *, neigh_cell, neigh_seq) { NR_ReportConfigId_t reportConfigId = neigh_a3_id[i]; if (reportConfigId == -1) continue; // ← BUG: i not incremented; … i++; } ```