[NiLuJe]

Okay, on the Sage, it's much easier to reproduce with the NickelMenu Home menu, especially *after* closing the Battery popup.

[pid  1295] 15:42:13.363289 [b1bfd4ec] ioctl(6</dev/disp>, DISP_EINK_UPDATE2, {area={x_top=676, y_top=144, x_bottom=1396, y_bottom=558}, layer_num=1, update_mode=EINK_PARTIAL_MODE|EINK_GL16_MODE, lyr_cfg2={info={mode=LAYER_MODE_BUFFER, zorder=0, alpha_mode=1, alpha_value=255, screen_win={x=0, y=0, width=1440, height=1920}, b_trd_out=0, out_trd_mode=DISP_3D_OUT_MODE_TB, fb={fd=5, y8_fd=0, size=[{width=1440, height=1920}, {width=1440, height=1920}, {width=1440, height=1920}], align=[2, 2, 2], format=DISP_FORMAT_ARGB_8888, color_space=DISP_UNDEF, trd_right_fd=0, pre_multiply=1, crop={x=0, y=0, width=1440 << 32, height=1920 << 32}, flags=DISP_BF_NORMAL, scan=DISP_SCAN_PROGRESSIVE, eotf=DISP_EOTF_RESERVED, depth=0, fbd_en=0, metadata_fd=0, metadata_size=0, metadata_flag=0}, id=0, atw={used=0, mode=NORMAL_MODE, b_row=0, b_col=0, cof_fd=0}}, enable=1, channel=0, layer_id=0}, frame_id=[343], rotate=90, cfa_use=*0}) = 343 <0.025538>
[pid  1295] 15:42:13.408816 [b1bfd4ec] ioctl(6</dev/disp>, DISP_EINK_UPDATE2, {area={x_top=1056, y_top=0, x_bottom=1145, y_bottom=138}, layer_num=1, update_mode=EINK_PARTIAL_MODE|EINK_GL16_MODE, lyr_cfg2={info={mode=LAYER_MODE_BUFFER, zorder=0, alpha_mode=1, alpha_value=255, screen_win={x=0, y=0, width=1440, height=1920}, b_trd_out=0, out_trd_mode=DISP_3D_OUT_MODE_TB, fb={fd=5, y8_fd=0, size=[{width=1440, height=1920}, {width=1440, height=1920}, {width=1440, height=1920}], align=[2, 2, 2], format=DISP_FORMAT_ARGB_8888, color_space=DISP_UNDEF, trd_right_fd=0, pre_multiply=1, crop={x=0, y=0, width=1440 << 32, height=1920 << 32}, flags=DISP_BF_NORMAL, scan=DISP_SCAN_PROGRESSIVE, eotf=DISP_EOTF_RESERVED, depth=0, fbd_en=0, metadata_fd=0, metadata_size=0, metadata_flag=0}, id=0, atw={used=0, mode=NORMAL_MODE, b_row=0, b_col=0, cof_fd=0}}, enable=1, channel=0, layer_id=0}, frame_id=[344], rotate=90, cfa_use=*0}) = 344 <0.015941>
[pid  1295] 15:42:13.702241 [b1bfd4ec] ioctl(6</dev/disp>, DISP_EINK_UPDATE2, {area={x_top=1152, y_top=1781, x_bottom=1439, y_bottom=1919}, layer_num=1, update_mode=EINK_PARTIAL_MODE|EINK_GL16_MODE, lyr_cfg2={info={mode=LAYER_MODE_BUFFER, zorder=0, alpha_mode=1, alpha_value=255, screen_win={x=0, y=0, width=1440, height=1920}, b_trd_out=0, out_trd_mode=DISP_3D_OUT_MODE_TB, fb={fd=5, y8_fd=0, size=[{width=1440, height=1920}, {width=1440, height=1920}, {width=1440, height=1920}], align=[2, 2, 2], format=DISP_FORMAT_ARGB_8888, color_space=DISP_UNDEF, trd_right_fd=0, pre_multiply=1, crop={x=0, y=0, width=1440 << 32, height=1920 << 32}, flags=DISP_BF_NORMAL, scan=DISP_SCAN_PROGRESSIVE, eotf=DISP_EOTF_RESERVED, depth=0, fbd_en=0, metadata_fd=0, metadata_size=0, metadata_flag=0}, id=0, atw={used=0, mode=NORMAL_MODE, b_row=0, b_col=0, cof_fd=0}}, enable=1, channel=0, layer_id=0}, frame_id=[345], rotate=90, cfa_use=*0}) = 345 <0.030606>
[pid  1295] 15:42:13.953617 [b1bfd4ec] ioctl(6</dev/disp>, DISP_EINK_UPDATE2, {area={x_top=992, y_top=1139, x_bottom=1439, y_bottom=1781}, layer_num=1, update_mode=EINK_PARTIAL_MODE|EINK_GL16_MODE, lyr_cfg2={info={mode=LAYER_MODE_BUFFER, zorder=0, alpha_mode=1, alpha_value=255, screen_win={x=0, y=0, width=1440, height=1920}, b_trd_out=0, out_trd_mode=DISP_3D_OUT_MODE_TB, fb={fd=5, y8_fd=0, size=[{width=1440, height=1920}, {width=1440, height=1920}, {width=1440, height=1920}], align=[2, 2, 2], format=DISP_FORMAT_ARGB_8888, color_space=DISP_UNDEF, trd_right_fd=0, pre_multiply=1, crop={x=0, y=0, width=1440 << 32, height=1920 << 32}, flags=DISP_BF_NORMAL, scan=DISP_SCAN_PROGRESSIVE, eotf=DISP_EOTF_RESERVED, depth=0, fbd_en=0, metadata_fd=0, metadata_size=0, metadata_flag=0}, id=0, atw={used=0, mode=NORMAL_MODE, b_row=0, b_col=0, cof_fd=0}}, enable=1, channel=0, layer_id=0}, frame_id=[346], rotate=90, cfa_use=*0}) = 346 <0.026500>
[pid  1295] 15:42:13.982064 [b1bfd4ec] ioctl(6</dev/disp>, DISP_EINK_UPDATE2, {area={x_top=1152, y_top=1782, x_bottom=1439, y_bottom=1919}, layer_num=1, update_mode=EINK_PARTIAL_MODE|EINK_GL16_MODE, lyr_cfg2={info={mode=LAYER_MODE_BUFFER, zorder=0, alpha_mode=1, alpha_value=255, screen_win={x=0, y=0, width=1440, height=1920}, b_trd_out=0, out_trd_mode=DISP_3D_OUT_MODE_TB, fb={fd=5, y8_fd=0, size=[{width=1440, height=1920}, {width=1440, height=1920}, {width=1440, height=1920}], align=[2, 2, 2], format=DISP_FORMAT_ARGB_8888, color_space=DISP_UNDEF, trd_right_fd=0, pre_multiply=1, crop={x=0, y=0, width=1440 << 32, height=1920 << 32}, flags=DISP_BF_NORMAL, scan=DISP_SCAN_PROGRESSIVE, eotf=DISP_EOTF_RESERVED, depth=0, fbd_en=0, metadata_fd=0, metadata_size=0, metadata_flag=0}, id=0, atw={used=0, mode=NORMAL_MODE, b_row=0, b_col=0, cof_fd=0}}, enable=1, channel=0, layer_id=0}, frame_id=[347], rotate=90, cfa_use=*0}) = 347 <0.034047>
[pid  1295] 15:42:14.018351 [b1bfd4ec] ioctl(6</dev/disp>, DISP_EINK_WAIT_FRAME_SYNC_COMPLETE, 347) = 0 <0.376256>

It also happens with long presses on cover thumbnails in the Home screen's top row (e.g., closing the battery popup, and long-press on a thumbnail that was below the popup), so I'm guessing it has to do with races/collision handling, possibly because mixed content is slower to process...

Shit happens during the DISP_EINK_WAIT_FRAME_SYNC_COMPLETE in every case (and that appears to be called by the floating menu code, hence the NM menu & long-press menu triggers).

EDIT: Strangely enough, on the Forma, while the cover thumbnail menu does bracket everything in a couple of MXCFB_WAIT_FOR_UPDATE_COMPLETE_V3 ioctls, the NM menu does NOT.