DataFlash log contains received MAVLink commands . The cause seems cmd=400 ( COMPONENT_ARM_DISARM) with Param2=21196 (force disarm).
