diff --git a/CHANGELOG.md b/CHANGELOG.md
index b64ff1530..09f00097f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -46,7 +46,7 @@
   - Combo Cracker: Many usability improvements (by @CharlesTheGreat77)
   - ESP Flasher: Bump Marauder 1.7.1 (by @justcallmekoko), FlipperHTTP 2.0 (by @jblanked)
   - Flame RNG: New App Icon (by @Kuronons), Improved the RNG using the hardware RNG and some bit mixing (by @OrionW06)
-  - FlipDownloader: Add Picoware (by @jblanked)
+  - FlipDownloader: Add Picoware, rewrite in C++, new downloading screen (by @jblanked)
   - FlipWiFi: Added Deauthentication mode (by @jblanked)
   - Metroflip: Added 80+ card AIDs, more AIDs for DESFire, Calypso card saving, fixed DESFire parsing, Navigo crash, Clipper timestamp (by @luu176)
   - NFC Magic: Fix Ultimate Magic Gen4 Max Block Number Set Incorrectly for the NTAG Protocol (by @alfie65536)
@@ -81,6 +81,7 @@
   - Fix card info not being parsed when using Extra Actions > Read Specific Card Type (by @WillyJL)
   - UL: Fix clipper date timestamp (by @luu176)
 - BadKB: Fix key combos main keys being case sensitive (by @WillyJL)
+- FuriHalSerial: Fix RXFNE interrupt hang, aka freezing with UART output when Expansion Modules are enabled (by @WillyJL)
 - Sub-GHz:
   - Fix possible frequency analyzer deadlock when holding Ok (by @WillyJL)
   - UL: Fix CAME 24bit decoder (by @xMasterX)
diff --git a/applications/external b/applications/external
index 66f4fbefa..d28fd3dda 160000
--- a/applications/external
+++ b/applications/external
@@ -1 +1 @@
-Subproject commit 66f4fbefa46e6bd649eab4c8a969b1f2b4fc8e8c
+Subproject commit d28fd3ddaa1a6dbf84851a75e602d448c38f61e5
diff --git a/applications/services/expansion/expansion_worker.c b/applications/services/expansion/expansion_worker.c
index b7562823e..e6d17c152 100644
--- a/applications/services/expansion/expansion_worker.c
+++ b/applications/services/expansion/expansion_worker.c
@@ -35,7 +35,8 @@ typedef enum {
     ExpansionWorkerFlagError = 1 << 2,
 } ExpansionWorkerFlag;
 
-#define EXPANSION_ALL_FLAGS (ExpansionWorkerFlagData | ExpansionWorkerFlagStop)
+#define EXPANSION_ALL_FLAGS \
+    (ExpansionWorkerFlagData | ExpansionWorkerFlagStop | ExpansionWorkerFlagError)
 
 struct ExpansionWorker {
     FuriThread* thread;
@@ -361,6 +362,8 @@ static int32_t expansion_worker(void* context) {
         expansion_worker_state_machine(instance);
     }
 
+    furi_hal_serial_async_rx_stop(instance->serial_handle);
+
     if(instance->state == ExpansionWorkerStateRpcActive) {
         expansion_worker_rpc_session_close(instance);
     }
diff --git a/targets/f7/furi_hal/furi_hal_serial.c b/targets/f7/furi_hal/furi_hal_serial.c
index 8ad9794a8..e5c30a278 100644
--- a/targets/f7/furi_hal/furi_hal_serial.c
+++ b/targets/f7/furi_hal/furi_hal_serial.c
@@ -817,6 +817,21 @@ static void furi_hal_serial_async_rx_configure(
     FuriHalSerialHandle* handle,
     FuriHalSerialAsyncRxCallback callback,
     void* context) {
+    // Disable RXFNE interrupts before unsetting the user callback that reads data
+    // Otherwise interrupt runs without reading data and without clearing RXFNE flag
+    // This would cause a system hang as the same interrupt runs in loop forever
+    if(!callback) {
+        if(handle->id == FuriHalSerialIdUsart) {
+            LL_USART_DisableIT_RXNE_RXFNE(USART1);
+            furi_hal_interrupt_set_isr(FuriHalInterruptIdUart1, NULL, NULL);
+            furi_hal_serial_usart_deinit_dma_rx();
+        } else if(handle->id == FuriHalSerialIdLpuart) {
+            LL_LPUART_DisableIT_RXNE_RXFNE(LPUART1);
+            furi_hal_interrupt_set_isr(FuriHalInterruptIdLpUart1, NULL, NULL);
+            furi_hal_serial_lpuart_deinit_dma_rx();
+        }
+    }
+
     // Handle must be configured before enabling RX interrupt
     // as it might be triggered right away on a misconfigured handle
     furi_hal_serial[handle->id].rx_byte_callback = callback;
@@ -824,27 +839,17 @@ static void furi_hal_serial_async_rx_configure(
     furi_hal_serial[handle->id].rx_dma_callback = NULL;
     furi_hal_serial[handle->id].context = context;
 
-    if(handle->id == FuriHalSerialIdUsart) {
-        if(callback) {
+    if(callback) {
+        if(handle->id == FuriHalSerialIdUsart) {
             furi_hal_serial_usart_deinit_dma_rx();
             furi_hal_interrupt_set_isr(
                 FuriHalInterruptIdUart1, furi_hal_serial_usart_irq_callback, NULL);
             LL_USART_EnableIT_RXNE_RXFNE(USART1);
-        } else {
-            furi_hal_interrupt_set_isr(FuriHalInterruptIdUart1, NULL, NULL);
-            furi_hal_serial_usart_deinit_dma_rx();
-            LL_USART_DisableIT_RXNE_RXFNE(USART1);
-        }
-    } else if(handle->id == FuriHalSerialIdLpuart) {
-        if(callback) {
+        } else if(handle->id == FuriHalSerialIdLpuart) {
             furi_hal_serial_lpuart_deinit_dma_rx();
             furi_hal_interrupt_set_isr(
                 FuriHalInterruptIdLpUart1, furi_hal_serial_lpuart_irq_callback, NULL);
             LL_LPUART_EnableIT_RXNE_RXFNE(LPUART1);
-        } else {
-            furi_hal_interrupt_set_isr(FuriHalInterruptIdLpUart1, NULL, NULL);
-            furi_hal_serial_lpuart_deinit_dma_rx();
-            LL_LPUART_DisableIT_RXNE_RXFNE(LPUART1);
         }
     }
 }
@@ -944,33 +949,39 @@ static void furi_hal_serial_dma_configure(
     FuriHalSerialHandle* handle,
     FuriHalSerialDmaRxCallback callback,
     void* context) {
-    furi_check(handle);
-
-    if(handle->id == FuriHalSerialIdUsart) {
-        if(callback) {
-            furi_hal_serial_usart_init_dma_rx();
-            furi_hal_interrupt_set_isr(
-                FuriHalInterruptIdUart1, furi_hal_serial_usart_irq_callback, NULL);
-        } else {
+    // Disable RXFNE interrupts before unsetting the user callback that reads data
+    // Otherwise interrupt runs without reading data and without clearing RXFNE flag
+    // This would cause a system hang as the same interrupt runs in loop forever
+    if(!callback) {
+        if(handle->id == FuriHalSerialIdUsart) {
             LL_USART_DisableIT_RXNE_RXFNE(USART1);
             furi_hal_interrupt_set_isr(FuriHalInterruptIdUart1, NULL, NULL);
             furi_hal_serial_usart_deinit_dma_rx();
-        }
-    } else if(handle->id == FuriHalSerialIdLpuart) {
-        if(callback) {
-            furi_hal_serial_lpuart_init_dma_rx();
-            furi_hal_interrupt_set_isr(
-                FuriHalInterruptIdLpUart1, furi_hal_serial_lpuart_irq_callback, NULL);
-        } else {
+        } else if(handle->id == FuriHalSerialIdLpuart) {
             LL_LPUART_DisableIT_RXNE_RXFNE(LPUART1);
             furi_hal_interrupt_set_isr(FuriHalInterruptIdLpUart1, NULL, NULL);
             furi_hal_serial_lpuart_deinit_dma_rx();
         }
     }
+
+    // Handle must be configured before enabling RX interrupt
+    // as it might be triggered right away on a misconfigured handle
     furi_hal_serial[handle->id].rx_byte_callback = NULL;
     furi_hal_serial[handle->id].handle = handle;
     furi_hal_serial[handle->id].rx_dma_callback = callback;
     furi_hal_serial[handle->id].context = context;
+
+    if(callback) {
+        if(handle->id == FuriHalSerialIdUsart) {
+            furi_hal_serial_usart_init_dma_rx();
+            furi_hal_interrupt_set_isr(
+                FuriHalInterruptIdUart1, furi_hal_serial_usart_irq_callback, NULL);
+        } else if(handle->id == FuriHalSerialIdLpuart) {
+            furi_hal_serial_lpuart_init_dma_rx();
+            furi_hal_interrupt_set_isr(
+                FuriHalInterruptIdLpUart1, furi_hal_serial_lpuart_irq_callback, NULL);
+        }
+    }
 }
 
 void furi_hal_serial_dma_rx_start(