esp-zigbee-sdk: esp_zb_zcl_set_attribute_val crash (TZ-143)

Hi, Im looking for sending an attibut state when I push a button. I tested esp_zb_zcl_set_attribute_val saw in #3. But I have a crash when I call it:

esp_zb_zcl_set_attribute_val(HA_ESP_SMOKE_ENDPOINT, ESP_ZB_ZCL_CLUSTER_ID_IAS_ZONE, ESP_ZB_ZCL_CLUSTER_SERVER_ROLE, ESP_ZB_ZCL_ATTR_IAS_ZONE_ZONESTATUS_ID, &lastState);

I (538) main_task: Returned from app_main()
I (548) ESP_ZB_ON_OFF_LIGHT: ZDO signal: 23, status: -1
I (548) ESP_ZB_ON_OFF_LIGHT: Zigbee stack initialized
I (1168) ESP_ZB_ON_OFF_LIGHT: Start network steering
I (1178) ESP_ZB_ON_OFF_LIGHT: Joined network successfully (Extended PAN ID: 29:dc:3c:60:9e:ab:a4:f5, PAN ID: 0x1e78, Channel:15)
Button pressed
Guru Meditation Error: Core  0 panic'ed (Load access fault). Exception was unhandled.

Core  0 register dump:
MEPC    : 0x42027760  RA      : 0x42027760  SP      : 0x40819de0  GP      : 0x4080e0d0
0x42027760: zb_zcl_ias_zone_write_attr_hook_server at ??:?

0x42027760: zb_zcl_ias_zone_write_attr_hook_server at ??:?

TP      : 0x4080d4d0  T0      : 0x00000000  T1      : 0x4087ee0b  T2      : 0x00000000
0x4080d4d0: spi_flash_chip_generic_read at C:/Espressif/ESP-IDF/esp-idf/components/spi_flash/spi_flash_chip_generic.c:256

S0/FP   : 0x00000002  S1      : 0x40819e6c  A0      : 0x00000000  A1      : 0x0000effe
A2      : 0x0000ffff  A3      : 0x0000ffff  A4      : 0x00000007  A5      : 0x00000007
A6      : 0x00000000  A7      : 0x00000007  S2      : 0x0000000a  S3      : 0x0000ffff
S4      : 0x00000500  S5      : 0x00000002  S6      : 0x00000001  S7      : 0x00000000
S8      : 0x00000000  S9      : 0x00000000  S10     : 0x00000000  S11     : 0x00000000
T3      : 0x0000000a  T4      : 0x00000000  T5      : 0x00000000  T6      : 0x00000000
MSTATUS : 0x00001881  MTVEC   : 0x40800001  MCAUSE  : 0x00000005  MTVAL   : 0x00000006
0x40800001: _vector_table at ??:?

MHARTID : 0x00000000

Stack memory:
40819de0: 0x40819e6c 0x00000002 0x0000000a 0x0000ffff 0x40819e6c 0x00000002 0x0000000a 0x42038006
0x42038006: zb_zcl_write_attr_hook at ??:?

40819e00: 0x40819e6c 0x00000000 0x4087ed26 0x0000000a 0x40819e6c 0x00000000 0x4087ed26 0x42024fbc
0x42024fbc: zb_zcl_set_attr_val at ??:?

40819e20: 0x00000000 0x4087ef04 0x40815eb0 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
40819e40: 0x00000000 0x00000000 0x00000000 0x42007650 0x00000000 0x00000000 0x00000000 0x420070e8
0x42007650: esp_zb_zcl_set_attribute_val at ??:?

0x420070e8: buttonLoop at C:/Espressif/Workspace/TestSmoke/main/esp_zb_light.c:162

40819e60: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x4080a398
0x4080a398: vPortTaskWrapper at C:/Espressif/ESP-IDF/esp-idf/components/freertos/FreeRTOS-Kernel/portable/riscv/port.c:205

40819e80: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
40819ea0: 0x00000000 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5
40819ec0: 0x00062749 0x40815484 0x40815484 0x596f2963 0xaef26566 0xaf58bad1 0xa140e0fd 0x023dfd67
40819ee0: 0xe608483b 0xf6ee7ac1 0x7780eb72 0x78d3fc96 0x29ff8574 0x967eff11 0xcfdb4f75 0xc817a76c
40819f00: 0xfb5d1c8b 0x98ed8439 0x8a95157b 0x687c0c2a 0x2f12d7b4 0xed6fd6b6 0xca545a7a 0xd9f32281
40819f20: 0x05de8c77 0x83327d34 0xde405c28 0x823c62f6 0x0b1a3efa 0x4a6e4b6d 0x08e6bad0 0x36498bb1
40819f40: 0xe7c84098 0xbb98d517 0xc8f5b453 0x1fa580e3 0x2ab21492 0x9e41aaab 0xc654b37d 0x53342cb7
40819f60: 0xedeb6c8c 0xb033ca47 0x435cbbb7 0x81b87591 0x1e903953 0xb19bd847 0xce28d3d9 0xab1f082f
40819f80: 0x2b820dd6 0x221b0f4e 0x2db1be03 0xf0130f21 0x0019f14b 0xa2891260 0x631ca339 0x204c0d95
40819fa0: 0xdfff79e7 0x280137e2 0x9c7e1e1b 0x4b9a1b81 0x6b6f1075 0xb33af362 0xce89c48c 0x529d4236
40819fc0: 0x249666a5 0x6b27ce9c 0x081db00a 0x0ab6ae42 0x659d9030 0x7e4ac771 0xbe273185 0x369f4ce3
40819fe0: 0xe02bb838 0x22cf7402 0x00c16998 0x35e9b8d2 0x3acf7870 0x7f973024 0x8f0dab4d 0xfc820f4a
4081a000: 0x59c2ec27 0xbb252acf 0xb9ea2867 0xc16801da 0x4663d0ef 0x645aae61 0x863fb78d 0x21705e89
4081a020: 0x87cf356c 0x92e65bed 0x5f351726 0x6a4c5e3d 0x0be96f56 0x6ce0c897 0xf00677a6 0x0dde4827
4081a040: 0x2ca6c3e3 0x51c96dfe 0x77bdfca0 0x9b443725 0x62df93d9 0x6eabb356 0x103ceb64 0x94f2c95d
4081a060: 0x08c0bfae 0x8cd01b93 0x4d71a954 0x8b6b9344 0xa7b820ea 0x7bd4adb9 0x4095b2cd 0x8a1532e9
4081a080: 0x7eaffb73 0x1c4121d6 0xcb017c66 0xa0506b37 0x2e88ae3c 0x4dece525 0x468f25bb 0xfa1835f1
4081a0a0: 0x3bc218f7 0x6e537b36 0x61870bc8 0xa7df41f3 0x2b8a87e7 0xdb43586a 0xeb709036 0xde1e1f89
4081a0c0: 0x445f3a7b 0x246582a1 0x83e0eeb7 0xe0afae46 0x81ecd584 0x37dd3d61 0xe4e2941e 0xdd2b95e7
4081a0e0: 0x8aecf4f2 0x6a34025a 0x1b5f8050 0x40e2a16a 0x4d430417 0x99f07723 0x9e820bd3 0xaa3beb66
4081a100: 0xe3dec9c3 0x1fbf4c87 0x8ab78516 0xe3ad1844 0x0b756974 0x33432b32 0x718479b7 0xaa6bd84d
4081a120: 0x1101ae92 0x171e7bc2 0xbacc0b6e 0x086c3687 0x17793739 0x4a260396 0xf1d24483 0x5c6c6ba6
4081a140: 0x1cd74e47 0x7dd1e450 0xd2d7ffe4 0xb91eca5b 0x3739d8ce 0x731c26d5 0x200ef5cc 0xe62fdd3f
4081a160: 0xc9f7b4f5 0x01ca8e01 0x6c175196 0xa30c1bea 0x9550cd2f 0x0c98bee1 0xd591e198 0x02194c53
4081a180: 0x11a43b42 0x3c99638b 0xd4baccf3 0xb0456a17 0xd86422a2 0x6b3ec182 0x433beca6 0xd0159723
4081a1a0: 0x4dfa7987 0x2b9c100d 0xbdd4b829 0x91806c45 0x9a01c516 0x4bb1fccc 0xb7d36803 0x1c7e567a
4081a1c0: 0x3dc3cec1 0x5fef177c 0xb0a90b26 0x9191ef65 0x87a38ffd 0xa683d430 0xbca0919b 0x872a3529

My code:

#include "esp_log.h"
#include "freertos/FreeRTOS.h"
#include "freertos/task.h"
#include "ha/esp_zigbee_ha_standard.h"
#include "esp_zb_light.h"
#include "nvs_flash.h"
#include "driver/gpio.h"

/**
 * @note Make sure set idf.py menuconfig in zigbee component as zigbee end device!
 */
#if !defined ZB_ED_ROLE
#error Define ZB_ED_ROLE in idf.py menuconfig to compile light (End Device) source code.
#endif

static const char *TAG = "ESP_ZB_ON_OFF_LIGHT";
/********************* Define functions **************************/
static void bdb_start_top_level_commissioning_cb(uint8_t mode_mask)
{
    ESP_ERROR_CHECK(esp_zb_bdb_start_top_level_commissioning(mode_mask));
}

void attr_cb(uint8_t status, uint8_t endpoint, uint16_t cluster_id, uint16_t attr_id, void *new_value)
{
    ESP_LOGI(TAG, "cluster:0x%x, attribute:0x%x changed ", cluster_id, attr_id);
}

void esp_zb_app_signal_handler(esp_zb_app_signal_t *signal_struct)
{
    uint32_t *p_sg_p = signal_struct->p_app_signal;
    esp_err_t err_status = signal_struct->esp_err_status;

    esp_zb_app_signal_type_t sig_type = *p_sg_p;
    switch (sig_type)
    {
    case ESP_ZB_ZDO_SIGNAL_SKIP_STARTUP:
        ESP_LOGI(TAG, "Zigbee stack initialized");
        esp_zb_bdb_start_top_level_commissioning(ESP_ZB_BDB_MODE_INITIALIZATION);
        break;
    case ESP_ZB_BDB_SIGNAL_DEVICE_FIRST_START:
    case ESP_ZB_BDB_SIGNAL_DEVICE_REBOOT:
        if (err_status == ESP_OK)
        {
            ESP_LOGI(TAG, "Start network steering");
            esp_zb_bdb_start_top_level_commissioning(ESP_ZB_BDB_MODE_NETWORK_STEERING);
        }
        else
        {
            /* commissioning failed */
            ESP_LOGW(TAG, "Failed to initialize Zigbee stack (status: %d)", err_status);
        }
        break;

    case ESP_ZB_BDB_SIGNAL_STEERING:
        if (err_status == ESP_OK)
        {
            esp_zb_ieee_addr_t extended_pan_id;
            esp_zb_get_extended_pan_id(extended_pan_id);
            ESP_LOGI(TAG, "Joined network successfully (Extended PAN ID: %02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x, PAN ID: 0x%04hx, Channel:%d)",
                     extended_pan_id[7], extended_pan_id[6], extended_pan_id[5], extended_pan_id[4],
                     extended_pan_id[3], extended_pan_id[2], extended_pan_id[1], extended_pan_id[0],
                     esp_zb_get_pan_id(), esp_zb_get_current_channel());
        }
        else
        {
            ESP_LOGI(TAG, "Network steering was not successful (status: %d)", err_status);
            esp_zb_scheduler_alarm((esp_zb_callback_t)bdb_start_top_level_commissioning_cb, ESP_ZB_BDB_MODE_NETWORK_STEERING, 1000);
        }
        break;
    default:
        ESP_LOGI(TAG, "ZDO signal: %d, status: %d", sig_type, err_status);
        break;
    }
}

uint32_t test_attr = 55;
uint32_t test_attr2 = 3;

uint32_t ZCLVersion = 0x0003;
uint32_t ApplicationVersion = 0x0001;
uint32_t StackVersion = 0x0002;
uint32_t HWVersion = 0x0002;
uint8_t ManufacturerName[] = {14, 'G', 'a', 'm', 'm', 'a', 'T', 'r', 'o', 'n', 'i', 'q', 'u', 'e', 's'};
uint8_t ModelIdentifier[] = {14, 'S', 'm', 'o', 'k', 'e', ' ', 'D', 'e', 't', 'e', 'c', 't', 'o', 'r'};
uint8_t DateCode[] = {8, '2', '0', '2', '3', '0', '5', '2', '4'};
uint32_t PowerSource = 0x03; // Mains (single phase)
uint32_t SWBuildID = 0x01;

esp_zb_attribute_list_t *esp_zb_smoke_cluster;

static void esp_zb_task(void *pvParameters)
{

    /* initialize Zigbee stack with Zigbee end-device config */
    esp_zb_cfg_t zb_nwk_cfg = ESP_ZB_ZED_CONFIG();
    esp_zb_init(&zb_nwk_cfg);
    //------------------------------------------ Attribute ------------------------------------------------
    /* basic cluster create with fully customized */
    esp_zb_basic_cluster_cfg_t basic_cluster_cfg = {
        .power_source = ESP_ZB_ZCL_BASIC_ZCL_VERSION_DEFAULT_VALUE,
        .zcl_version = ESP_ZB_ZCL_BASIC_POWER_SOURCE_DEFAULT_VALUE,
    };

    esp_zb_attribute_list_t *esp_zb_basic_cluster = esp_zb_basic_cluster_create(&basic_cluster_cfg);
    esp_zb_basic_cluster_add_attr(esp_zb_basic_cluster, ESP_ZB_ZCL_ATTR_BASIC_APPLICATION_VERSION_ID, &ApplicationVersion);
    esp_zb_basic_cluster_add_attr(esp_zb_basic_cluster, ESP_ZB_ZCL_ATTR_BASIC_STACK_VERSION_ID, &StackVersion);
    esp_zb_basic_cluster_add_attr(esp_zb_basic_cluster, ESP_ZB_ZCL_ATTR_BASIC_HW_VERSION_ID, &HWVersion);
    esp_zb_basic_cluster_add_attr(esp_zb_basic_cluster, ESP_ZB_ZCL_ATTR_BASIC_MANUFACTURER_NAME_ID, ManufacturerName);
    esp_zb_basic_cluster_add_attr(esp_zb_basic_cluster, ESP_ZB_ZCL_ATTR_BASIC_MODEL_IDENTIFIER_ID, ModelIdentifier);
    esp_zb_basic_cluster_add_attr(esp_zb_basic_cluster, ESP_ZB_ZCL_ATTR_BASIC_DATE_CODE_ID, DateCode);
    esp_zb_basic_cluster_add_attr(esp_zb_basic_cluster, ESP_ZB_ZCL_ATTR_BASIC_SW_BUILD_ID, &SWBuildID);

    esp_zb_ias_zone_cluster_cfg_t smoke_cfg = {
        .zone_state = ESP_ZB_ZCL_IAS_ZONE_ZONESTATE_NOT_ENROLLED,
        .zone_type = ESP_ZB_ZCL_IAS_ZONE_ZONETYPE_FIRE_SENSOR,
        .zone_status = 0,
        .ias_cie_addr = ESP_ZB_ZCL_ZONE_IAS_CIE_ADDR_DEFAULT,
        .zone_id = 0,
    };
    esp_zb_smoke_cluster = esp_zb_ias_zone_cluster_create(&smoke_cfg);

    //------------------------------------------ Cluster ------------------------------------------------
    /* on-off cluster create with standard cluster config*/
    esp_zb_on_off_cluster_cfg_t on_off_cfg;
    on_off_cfg.on_off = ESP_ZB_ZCL_ON_OFF_ON_OFF_DEFAULT_VALUE;
    esp_zb_attribute_list_t *esp_zb_on_off_cluster = esp_zb_on_off_cluster_create(&on_off_cfg);

    /* create cluster lists for this endpoint */
    esp_zb_cluster_list_t *esp_zb_cluster_list = esp_zb_zcl_cluster_list_create();
    esp_zb_cluster_list_add_basic_cluster(esp_zb_cluster_list, esp_zb_basic_cluster, ESP_ZB_ZCL_CLUSTER_SERVER_ROLE);
    esp_zb_cluster_list_add_ias_zone_cluster(esp_zb_cluster_list, esp_zb_smoke_cluster, ESP_ZB_ZCL_CLUSTER_SERVER_ROLE);

    /* update basic cluster in the existed cluster list */
    esp_zb_cluster_list_add_on_off_cluster(esp_zb_cluster_list, esp_zb_on_off_cluster, ESP_ZB_ZCL_CLUSTER_SERVER_ROLE);
    //------------------------------------------ Endpoint ------------------------------------------------
    esp_zb_ep_list_t *esp_zb_ep_list = esp_zb_ep_list_create();
    esp_zb_ep_list_add_ep(esp_zb_ep_list, esp_zb_cluster_list, HA_ESP_SMOKE_ENDPOINT, ESP_ZB_AF_HA_PROFILE_ID, ESP_ZB_HA_ON_OFF_OUTPUT_DEVICE_ID);
    esp_zb_device_register(esp_zb_ep_list);

    //------------------------------------------ Callback ------------------------------------------------
    esp_zb_device_add_set_attr_value_cb(attr_cb);
    esp_zb_device_add_report_attr_cb(attr_cb);

    esp_zb_set_primary_network_channel_set(ESP_ZB_PRIMARY_CHANNEL_MASK);
    esp_zb_set_secondary_network_channel_set(0x07FFF800);
    ESP_ERROR_CHECK(esp_zb_start(false));
    esp_zb_main_loop_iteration();
}

void buttonLoop(void *pvParameter)
{
    uint32_t lastState = 0;
    while (1)
    {
        if (gpio_get_level(GPIO_NUM_9) != lastState)
        {
            lastState = gpio_get_level(GPIO_NUM_9);
            if (lastState == 0)
            {
                printf("Button pressed\n");
                // report smoke
                esp_zb_zcl_set_attribute_val(HA_ESP_SMOKE_ENDPOINT, ESP_ZB_ZCL_CLUSTER_ID_IAS_ZONE, ESP_ZB_ZCL_CLUSTER_SERVER_ROLE, ESP_ZB_ZCL_ATTR_IAS_ZONE_ZONESTATUS_ID, &lastState);
            }
            else
            {
                printf("Button released\n");
            }
        }
        vTaskDelay(100 / portTICK_PERIOD_MS);
    }
}

void app_main(void)
{
    esp_zb_platform_config_t config = {
        .radio_config = ESP_ZB_DEFAULT_RADIO_CONFIG(),
        .host_config = ESP_ZB_DEFAULT_HOST_CONFIG(),
    };
    ESP_ERROR_CHECK(nvs_flash_init());
    /* load Zigbee light_bulb platform config to initialization */
    ESP_ERROR_CHECK(esp_zb_platform_config(&config));
    /* hardware related and device init */
    light_driver_init(LIGHT_DEFAULT_OFF);
    xTaskCreate(esp_zb_task, "Zigbee_main", 4096, NULL, 5, NULL);
    xTaskCreate(buttonLoop, "buttonLoop", 4096, NULL, 5, NULL);
}

Do you have any idea what im doing wrong ? Can I have an example to use this function ? Thanks