Should that investigation reveal a reproducible behaviour, a recall or general suspension of vehicles running that particular software version would seem like a reasonable response. Otherwise suspending just that one car could be an option.
It's uncharted territory both in terms of the legal system and w.r.t accountability so I guess no one has an answer to that yet.