Trying to understand the code, it looks like there are always two rounds of reqests. The first one always fails ("requesting one big chunk of DMA memory"), the second one (providing multiple chunks of DMA memory) is supposed to work - and we do allocate memory.
In the *working* cases we have
Respond mem req failed, result: 1, err: 0
qmi failed to respond fw mem req:-22
...
chip_id 0x0 chip_family 0xb board_id 0xff soc_id 0xffffffff
We don't fail in qmi_txn_wait() - second request w
In the *non-working* cases we have
Respond mem req failed, result: 1, err: 0
qmi failed to respond fw mem req:-22
...
qmi failed memory request, err = -110
qmi failed to respond fw mem req:-110
We fail in qmi_txn_wait(). We run into a timeout (ETIMEDOUT).
Can we bump up the timeout limit and see if things change? Maybe FW needs more time with other addresses.