Aftermarket devices that can boost or augment a vehicle’s native advanced driver assistance systems are the target of a new federal investigation this week. The National Highway Traffic Safety Administration’s Office of Defects Investigation says it knows of five crashes in which drivers using devices from comma.ai crashed into stopped or slow-moving cars. Two of the crashes resulted in three deaths, and 11 people were injured in four of the five crashes, some seriously.

Comma.ai was the brainchild of George Hotz, who rose to prominence at the start of the last decade by jailbreaking iOS and hacking Sony PlayStations. In 2015, Hotz turned his attention to partially automated driver assists, which were gaining attention following Tesla’s exploits with its Autopilot system. Hotz first modified his own Acura to give it a more advanced driver assist that let him take his hands off the wheel, with the goal of selling his system to Tesla and replacing Mobileye as the company’s supplier.

(Mobileye dropped Tesla as a customer the following year after becoming unhappy with the way the car company was using Mobileye products in unintended ways.)

Comma’s first attempts to sell devices that owners could plug into their cars’ ODB port evaporated once NHTSA began asking questions in 2016. Instead, Comma decided to post its openpilot software, as well as its plans for hardware, to GitHub, allowing anyone to make the devices themselves. At first, the Comma Neo and OpenPilot supported a single Acura and single Honda model, but by 2020, the company’s software and $999 device were rated more highly by Consumer Reports than any OEM system.

Now, Comma says the Comma Four can add lane centering, adaptive cruise, and a cloud-based dash cam to more than 325 models of car across 27 different brands. More than 30,000 drivers are using openpilot, with more than 402 million miles (650 million km) driven.

But NHTSA isn’t sure that Comma’s systems are able to adequately detect a slow or stopped car in the path of travel. At least two of the five crashes involved a comma.ai-controlled car hitting a stopped vehicle; in one case, it was a first responder’s vehicle, and the resulting crash killed three. Another of the five crashes saw a comma.ai-controlled car hit a vehicle that was merging, hence this preliminary evaluation. NHTSA says it is also interested in which version of the software was running at the time of each crash—at least two involved forks of the main build, including the fatal crash, which was running a version called FrogPilot.