Debugging 5G registration failure

Registration is the first real procedure a UE performs and the most common place a conformance run dies. Failures split into three classes: the network rejected you, the network never answered, or the UE never asked.

Class 1 — Registration Reject

The network answered with a 5GMM cause. This is a protocol or provisioning problem and the cause value tells you which.

Class 2 — T3510 expiry (no answer)

The UE asked and heard nothing back. Almost always lower-layer: gain, timing, or a tunnel with excessive jitter. Check SINR before you touch NAS code.

• SINR below 5 dB: adjust rf.tx_gain / rf.rx_gain, or request a fresh lane calibration.
• Tunnel RTT above 80 ms: switch to a hosted build (Model A) instead of Model B.
• Uplink grant never seen in the MAC PCAP: PRACH power problem, raise tx_gain.

[NAS] Registration Request (initial) sent, T3510 started (15s)
[RRC] state: RRC_CONNECTED
[PHY] rsrp=-104.8 dBm sinr=1.2 dB   <- weak link
[NAS] T3510 expiry (attempt 1/5)
verdict: fail  clause 24.501:5.5.1.2.4

Class 3 — no Registration Request at all

• SIB1 never decoded: wrong dl_arfcn or ssb_arfcn — the UE never found the cell.
• Cell found but no PRACH: PLMN in SIB1 is not in the UE's allowed list.
• USIM read failure: usim.mode = soft with a malformed k value.

Fast triage

aeon copilot explain --exec 4821 --focus registration
aeon exec artifacts --id 4821 --get ue_nas.pcap --out ./e/
tshark -r ./e/ue_nas.pcap -Y 'nas-5gs' -T fields -e nas-5gs.mm.message_type

noteOrder of investigation: SINR, then SIB1, then USIM, then NAS. Skipping to NAS wastes the most time.