When CH_CFG_USE_MESSAGES_PRIORITY is enabled, the PI walk in chMtxLockS() boosts the priority of a thread blocked in CH_STATE_SNDMSGQ but does not re-enqueue it in the receiver's msgqueue, preserving the priority inversion.
Root cause: u.sentmsg and u.wtobjp alias in the u union, so there is nowhere to store the back-pointer to the receiver's queue while the sender is waiting.