NixOS boots error on HP EliteDesk

Help
1

HP EliteDesk 800 G4 DM (i5-8500, 6 cores) — NixOS boots with all cores only with acpi=off, which disables SMP and limits to 1 core. Exhaustive kernel param testing failed.

Hardware:

  • HP EliteDesk 800 G4 DM 65W
  • Intel Core i5-8500 (Coffee Lake, 6 cores, no hyperthreading)
  • 15.8 GB RAM, NVMe SSD
  • BIOS: Q21 Ver. 02.27.00 (updated to latest available, 12/2023)

OS: NixOS 25.11 (Xantusia), kernel 6.12.91

The problem:
The machine only boots fully when acpi=off is in kernel params. With acpi=off, the system is stable and all services run — but SMP is disabled, so only 1 of 6 cores is visible. Every
other combination either crashes or hangs silently.

There is also a recurring ACPI BIOS error visible in early boot regardless of params:
ACPI BIOS Error (bug): AE_AML_BUFFER_LIMIT, Field [CAP1] at bit offset/length 64/32
exceeds size of target Buffer (64 bits) (20230628/dsopcode-198)
ACPI Error: Aborting method _SB._OSC due to previous error (AE_AML_BUFFER_LIMIT)

What we have tried:

  1. BIOS update
    Updated to the latest available firmware (Q21 02.27.00). No change in behavior.

  2. Older kernel (6.6.141)
    Kernel 6.6 has additional bugs on this hardware regardless of ACPI params:

  • Without nomodeset: simple-framebuffer / fb_flashcursor NULL pointer dereference crash
  • With pci=noacpi: psi_task_switch NULL pointer crash
  • With acpi=noirq: same fb_flashcursor crash

Kernel 6.6 is a dead end on this hardware. All further testing on kernel 6.12.91.

  1. nomodeset
    Causes simple-framebuffer fb_flashcursor NULL pointer dereference. Must not be used. Intel i915 driver loads correctly without it.

  2. pci=noacpi
    Disables ACPI for PCI IRQ routing only. Result: initramfs ZSTD decompression fails with “corrupt data” — boot never reaches init. Likely cause: ACPI assigns PCI BARs to memory regions
    overlapping where the initramfs is loaded in RAM.

  3. acpi=noirq psi=0
    SMP active (CPU 2 visible), microcode updated, networking initialized — crashes at ~0.4s:
    BUG: unable to handle page fault for address: 00000000fffbbf5c
    RIP: __timer_delete_sync
    Comm: rcu_exp_gp_kthr Tainted: [D]=DIE
    CR2: 00000000fffbbf5c
    RCU expedited grace period thread crashes in timer deletion. Pointer 0xfffbbf5c looks like a 32-bit value used as a 64-bit pointer — likely caused by misconfigured interrupt routing
    corrupting a timer struct.

  4. psi=0 only (no ACPI params)
    Silent hang. ACPI IRQ routing is broken on this hardware even with the updated BIOS.

  5. acpi=noirq psi=0 rcu_nocbs=all
    Added rcu_nocbs=all to work around the RCU crash from #5. Result: silent hang.

  6. acpi=ht psi=0
    acpi=ht enables ACPI only for CPU topology enumeration, disabling everything else including IRQ routing. Result: silent hang.

  7. acpi=noirq noapic psi=0
    Disabled both ACPI IRQ routing and the IOAPIC to force legacy PIC interrupt handling. Result: silent hang.

Summary table:

┌────────────────────────────────┬───────────────────────────┐
│ Kernel params │ Result │
├────────────────────────────────┼───────────────────────────┤
│ acpi=off │ :white_check_mark: boots, 1 core only │
├────────────────────────────────┼───────────────────────────┤
│ nomodeset │ :cross_mark: fb_flashcursor crash │
├────────────────────────────────┼───────────────────────────┤
│ pci=noacpi │ :cross_mark: initramfs ZSTD corrupt │
├────────────────────────────────┼───────────────────────────┤
│ acpi=noirq psi=0 │ :cross_mark: rcu_exp_gp_kthr crash │
├────────────────────────────────┼───────────────────────────┤
│ psi=0 only │ :cross_mark: silent hang │
├────────────────────────────────┼───────────────────────────┤
│ acpi=noirq psi=0 rcu_nocbs=all │ :cross_mark: silent hang │
├────────────────────────────────┼───────────────────────────┤
│ acpi=ht psi=0 │ :cross_mark: silent hang │
├────────────────────────────────┼───────────────────────────┤
│ acpi=noirq noapic psi=0 │ :cross_mark: silent hang │
└────────────────────────────────┴───────────────────────────┘

Question:
Is there a kernel param combination that keeps ACPI active for SMP/CPU enumeration (all 6 cores) while safely disabling the broken ACPI IRQ routing on this HP hardware? Or is there a
known workaround for the _SB._OSC AE_AML_BUFFER_LIMIT firmware bug? The only param that boots is acpi=off, which disables SMP entirely.