In xEventGroupSync (event_groups.c:182), I believe the following line has a concurrency issue:
/* Rendezvous always clear the bits. They will have been cleared already unless this is the only task in the rendezvous. */ pxEventBits->uxEventBits &= uxBitsToWaitFor;
This line is within a vTaskSuspendAll/vTaskResumeAll block, but interrupts are still enabled.
Therefore it is possible that an interrupt could occur just before updating the uxEventBits value.
If this interrupt called xEventGroupClearBitsFromISR, then after it returns, the now stale data could overwrite the correct data.
xEventGroupWaitBits (event_groups.c:301) and xEventGroupSetBits(event_groups.c:486 and 549) also appear to have the same issue.
NOTE: I believe event_groups.c:182 also has a logical error:
pxEventBits->uxEventBits &= uxBitsToWaitFor;
pxEventBits->uxEventBits &= ~uxBitsToWaitFor;