fix(star6e): settle between RGN detach and destroy in debug_osd_destroy (#79)

The OSD overlay region is attached to the live VPE channel
(MI_RGN_AttachToChn on vpe_bind).  debug_osd_destroy() called
MI_RGN_DetachFromChn immediately followed by MI_RGN_Destroy, freeing the
canvas while a VPE frame already mid-composite was still reading it.  The
VPE compositor (MMU client 0x15, IsWrite=0) then read the freed canvas →
MMU read-fault storm → hardware watchdog reset on rapid same-mode respawn
(3-157 faults/respawn, ~33% wedge rate observed on Star6E imx335).

Add a usleep settle (default 50ms ≈ 3 frame intervals @ 60fps,
overridable via VENC_OSD_DESTROY_SETTLE_US) between detach and destroy so
the in-flight composite finishes before the canvas is freed.

Device-validated on 192.168.1.13 (imx335): 14 consecutive same-mode
/api/v1/restart respawns, 0 client-0x15 faults each, 0 wedges, RTP egress
confirmed flowing after the respawn batch.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: snokvist

src/debug_osd.c

@@ -16,6 +16,18 @@
 #include <stdlib.h>
 #include <string.h>
 #include <time.h>
+#include <unistd.h>
+
+/* Settle between MI_RGN_DetachFromChn and MI_RGN_Destroy in
+ * debug_osd_destroy().  The detach removes the region from the VPE
+ * compositor's list, but a frame already mid-composite can still be reading
+ * the RGN canvas; freeing it immediately races that read → MMU read-fault
+ * (ClientId=0x15, IsWrite=0) that storms to a HW watchdog reset on rapid
+ * respawn.  ~3 frame intervals at 60fps covers the in-flight composite.
+ * Overridable at build time for tuning. */
+#ifndef VENC_OSD_DESTROY_SETTLE_US
+#define VENC_OSD_DESTROY_SETTLE_US 50000
+#endif
 
 /* ── MI_RGN types ──────────────────────────────────────────────────────
  * Defined locally because the SDK headers (sdk/ssc338q/include/i6_rgn.h)
@@ -327,6 +339,10 @@ void debug_osd_destroy(DebugOsdState *osd)
 {
 	if (!osd) return;
 	osd->fnDetachChannel(RGN_HANDLE, &osd->vpe_bind);
+	/* Let any in-flight VPE composite finish reading the canvas before the
+	 * destroy frees it — closes the client-0x15 MMU read-fault race that
+	 * wedges rapid respawn (see VENC_OSD_DESTROY_SETTLE_US above). */
+	usleep(VENC_OSD_DESTROY_SETTLE_US);
 	osd->fnDestroyRegion(RGN_HANDLE);
 	osd->fnDeinit();
 	if (osd->lib)