[SubGHz] Fix crash when exiting CLI subghz chat with external CC1101 (#1036)

* [SubGHz] Fix crash when exiting CLI `subghz chat` with external CC1101

Pressing Ctrl+C to exit `subghz chat` while using an external CC1101
crashed the Flipper (null-pointer dereference + reboot).

The exit path called subghz_devices_deinit() before stopping the chat
worker. deinit unloads the external CC1101 radio-device plugin, freeing
its SubGhzDevice struct and interconnect vtable; the TxRx worker thread
sleeps/ends that device from its own thread on shutdown, so joining it
after deinit dereferenced freed plugin memory. The internal CC1101 is a
static device that deinit never frees, which is why the crash was
external-only.

Stop and free the worker before subghz_devices_deinit(), matching the
teardown order already used by subghz_cli_command_rx. Also add the
missing deinit + radio power-off to the "tx not allowed" early return so
a subsequent subghz command's subghz_devices_init() does not
furi_check-fail on an already-valid registry.

Fixes #829

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* changelog: SubGHz crash exiting CLI chat with external CC1101 (PR #1036, Fixes #829)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: mishamyte

CHANGELOG.md

@@ -1,6 +1,7 @@
 ## Main changes
 - Current API: 87.12
 * SubGHz: **Fix endless TX causing RAW files to be transmitted and crash the system** (via RPC / Mobile App) (Fixes issue #1008)
+* SubGHz: **Fix crash when exiting CLI `subghz chat` with an external CC1101** - pressing Ctrl+C dereferenced the just-freed external CC1101 radio plugin during chat worker shutdown; internal CC1101 was unaffected (by @mishamyte | PR #1036 | Fixes #829)
 * SubGHz: **Add Telcoma/Cardin EDGE protocol** (32bit, Static) (by @half2me | PR #1001)
 * LFRFID: **Support of Hitag Micro chips** (8265/8210/H5.5) (by @mishamyte | PR #1002)
 * LFRFID: **Wipe T5577** (reset to blank, with read-back verification) (by @mishamyte | PR #1003)

applications/main/subghz/subghz_cli.c

@@ -966,6 +966,8 @@ static void subghz_cli_command_chat(PipeSide* pipe, FuriString* args) {
             "In your settings, only reception on this frequency (%lu) is allowed,\r\n"
             "the actual operation of the application is not possible\r\n ",
             frequency);
+        subghz_devices_deinit();
+        subghz_cli_radio_device_power_off();
         return;
     }
 
@@ -1113,16 +1115,19 @@ static void subghz_cli_command_chat(PipeSide* pipe, FuriString* args) {
     furi_string_free(output);
     furi_string_free(sysmsg);
 
+    // Stop the worker before deinit: its TxRx thread sleeps/ends the device on
+    // exit, and deinit frees that device when it's an external CC1101 plugin (UAF, #829).
+    if(subghz_chat_worker_is_running(subghz_chat)) {
+        subghz_chat_worker_stop(subghz_chat);
+        subghz_chat_worker_free(subghz_chat);
+    }
+
     subghz_devices_deinit();
     subghz_cli_radio_device_power_off();
 
     furi_hal_power_suppress_charge_exit();
     furi_record_close(RECORD_NOTIFICATION);
 
-    if(subghz_chat_worker_is_running(subghz_chat)) {
-        subghz_chat_worker_stop(subghz_chat);
-        subghz_chat_worker_free(subghz_chat);
-    }
     printf("\r\nExit chat\r\n");
 }