We've had a few upgrades from 11,2 to 11.3-U2.1 lead to repeated failovers after the upgrade had finished.
The failover happens a couple minutes into having both controllers back up after the previous failover,
We think, but we're not sure, that a manual sync-to-peer was what stopped the failovers in each case.
It kinda seems like both nodes come up assuming master, and the second one to boot forces a fenced panic event on the first one to boot.
Support will attempt to reproduce in house with our systems, but we're kinda low on available HA hardware right now.