请教这段代码，出错Fatal exception (9)

[saosang]

user_esp_platform_recv_cb(void *arg, char *pusrdata, unsigned short length)
{
.......
LOCAL char pbuffer[1024 * 2] = {0};
........
os_memcpy(pbuffer, pusrdata, length);
pstr = (char *)os_strstr(pbuffer,"start");
if (pstr != NULL && wlen>0 && waddr>0){
if((waddr % 4096)==0){
spi_flash_erase_sector(waddr/4096);
ESP_DBG("erase:%x\n",waddr/4096);
}
ESP_DBG("write addr:%x len:%x;recvlen:%d\n",waddr,wlen,length);
ESP_DBG("str1:%s\n",pstr);
ESP_DBG("str2:%s\n",pstr+5);
spi_flash_write(waddr,(uint32 *)(pstr+5), wlen/4);
}
服务器发送字节数组，前面为可见字符，后面为userbin2的数据，每次1024个bin字节。为什么执行到spi_flash_write的地方得到错误：
erase:81
write addr:81000 len:400;recvlen:1070
str1:start?
str2:?
Fatal exception (9):
epc1=0x400041dc, epc2=0x00000000, epc3=0x400043e6, excvaddr=0x3fff03be, depc=0x00000000