Crash after short rc_lost due to false kill switch

https://review.px4.io/plot_app?log=714f373d-da63-42cd-b151-446568cd3d60
Strange behavior: after rc was lost (near 13:32.500), logs indicated enabled kill switch and change to altitude hold mode, though pilot didn’t commanded this (only the second kill switch, near 13:34, was real). This led to crash.

Why did this happen?

Expected behavior (according to parameters: NAV_RCL_ACT, 2; RTL_LAND_DELAY, 0.0; RTL_TYPE, 1) is to change to RTL and land. When we disabled RC with drone armed without propellers, we see it: https://logs.px4.io/plot_app?log=e8dda0c7-5917-4971-9a19-b57632729f7b

One more log: we have disabled and re-enabled joystick.
https://review.px4.io/plot_app?log=d10be4f1-290d-4748-8c4f-e0955920e75f
It looks like after reconnecting for short time controller sees changed values of switches, kill switch and flight mode switch.
Very weird.

What have we found (spoiler: bug in QGC?).

RC_MAP_KILL_SW=8, that is kill switch corresponds to input_rc/values.07. On failsafe receiver gives us 1494 on this channel (middle value of stick). As we had RC_KILLSWITCH_TH=0.25, this triggered kill switch (rc values from 1000 to 2000 are mapped to 0…1 and than are compared with RC_KILLSWITCH_TH).

Following logs demonstrate this behavior on RC_KILLSWITCH_TH=0.25 (input_rc/values.07=1494 maps to manual_control_setpoint/kill_switch=1(ON)) and not triggering of kill switch on RC_KILLSWITCH_TH=0.75 (input_rc/values.07=1494 maps to manual_control_setpoint/kill_switch=3(OFF))
https://review.px4.io/plot_app?log=983b5253-0e95-4735-b35a-2d368f2bd650
https://review.px4.io/plot_app?log=9f8c9a15-92b6-4c63-8304-d8c0c070a39f

The problem is that our pilot have checked kill switch in QGC, and for both RC_KILLSWITCH_TH=0.25 and 0.75 QGC draws that middle position of stick (1494) does not trigger kill switch.

Looks like a bug in QGC.