OpenWRT

Recent Commits

• Dharmik Parmar(23 Oct 26)

  uencrypt: return failure on OpenSSL errors OpenSSL returns zero when EVP_CipherUpdate() or EVP_CipherFinal_ex() fails. Returning that value from do_crypt() makes uencrypt exit successfully after an encryption or decryption error. Return EXIT_FAILURE from both error paths. Fixes: #26001 Signed-off-by: Dharmik Parmar <[email protected]> Link: https://github.com/openwrt/openwrt/pull/26140 Signed-off-by: Robert Marko <[email protected]>

• Markus Stockhausen(25 Oct 26)

  realtek: dsa: use regmap for PIE register accesses Replace sw_r32(), sw_w32() and sw_w32_mask() in pie.c with regmap_read(), regmap_write() and regmap_write_bits(), using the existing priv->map. Add temporary variables where register reads were used in expressions. Preserve the existing bit masks and polling loops. Keep table accesses, function signatures and error handling unchanged. Assisted-by: ChatGPT (OpenAI GPT-6 Astra) Link: https://github.com/openwrt/openwrt/pull/26174 Signed-off-by: Markus Stockhausen <[email protected]>

• Robert Marko(25 Oct 26)

  firewall4: update to Git HEAD (2026-10-25) 22afe51bed7c fw4: skip zones with duplicate names 500d30940e55 fw4: warn about ubus firewall specs of unknown type 2b55562cdfb2 fw4: accept a source rewrite range for ICMP d92213a9345e fw4: anchor per-interface ubus firewall specs by kind b263f8ccbda7 fw4: support zones in procd and netifd firewall data c2ae8c8940a8 fw4: support forwardings in procd and netifd firewall data a3296754c154 fw4: list lower devices for software flow offloading Signed-off-by: Robert Marko <[email protected]>

• Josef Schlehofer(18 Oct 26)

  mpc85xx: p2020: disable the SD controller of the WatchGuard XTM330 The WatchGuard XTM330 has no SD card slot, but its device tree inherits the enabled eSDHC node from p2020si-post.dtsi. Disable the controller, so that a kernel with the eSDHC driver does not poll for a card that cannot be there. Signed-off-by: Josef Schlehofer <[email protected]> Link: https://github.com/openwrt/openwrt/pull/25984 Signed-off-by: Robert Marko <[email protected]>

• Markus Stockhausen(24 Oct 26)

  realtek: dsa: convert QoS register accesses to regmap Convert the RTL838x, RTL839x, RTL930x and RTL931x QoS register accesses to priv->map, passing the private switch data through the local helpers. Also convert the RTL839x table-2 command helper used exclusively by QoS, including its completion polling, and update its declaration and callers. Use regmap_read() and regmap_write() for direct accesses. Use regmap_write_bits() for the old masked writes to retain unconditional writeback, including when the resulting register value is unchanged. The old sw_w32_mask(clear, set, reg) implements: (old & ~clear) | set Regmap instead applies the value only inside its mask. The general replacement is mask = clear | set, value = set. Where set is already contained in clear, retain the existing mask. For clear == 0, use set as both mask and value. Include the value in the mask for the unconstrained priority and group-selector arguments, preserving set bits outside the original clear mask as well. Keep the existing QoS settings and public rate/init interfaces. Initialize read destinations so a failed regmap read cannot expose uninitialized data. The table command helper retains busy polling without a timeout. Assisted-by: ChatGPT (OpenAI GPT-6 Astra) Link: https://github.com/openwrt/openwrt/pull/26158 Signed-off-by: Markus Stockhausen <[email protected]>

• Quinn O'Shea(22 Oct 26)

  realtek: dsa: rtl930x: offload TBF qdiscs An RTL930x port has an egress rate limiter for the whole port, which the egress police already uses, and one for each of its eight queues, which nothing uses. Offload a TBF qdisc at the root of a port to the limiter of the port, and a TBF qdisc on a band of the root ETS to the limiter of the queue of that band while the ETS is in the hardware. The limiter of the port has one owner: a root TBF is not offloaded while an egress police holds it and takes the limiter over when the police goes, and an egress police is not offloaded while there is a root TBF. The kernel keeps a child the driver refuses and puts the noop qdisc, which drops everything, in place of a deleted one, so a TBF stays out of the hardware once a child was grafted to it. The ETS takes a TBF on a band as a child the hardware runs, and leaves the hardware while that TBF cannot be offloaded. The rate and burst of a TBF on a band are kept, and its limiter is written again when the ETS above it returns to the hardware; the limiters of the queues are switched off when their ETS goes. As for the police, the burst is clamped to what leaves room for the largest frame in the 16 bit bucket, and it has to hold at least three of the tokens the limiters are refilled with. A TBF with an overhead, a minimum packet unit or the ATM link layer stays in software, as the limiters know none of them. The registers are written through regmap. RTL9303, two UDP flows of 200 Mbit/s each, one with DSCP 0 (queue 0) and one with EF (queue 5): 200 Mbit/s each without a qdisc, 47.7 and 47.3 Mbit/s with a root TBF of 100 Mbit/s, which gives one TCP flow 95.1 Mbit/s. With the port policed to 100 Mbit/s, eight equal ETS bands and a TBF of 20 Mbit/s on the band of queue 5: 77.4 and 19.4 Mbit/s. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Quinn O'Shea <[email protected]> Link: https://github.com/openwrt/openwrt/pull/26112 Signed-off-by: Markus Stockhausen <[email protected]>

• Paul Maruhn(20 Sept 26)

  ath79: support for TP-Link Festa F52-Outdoor v1 The TP-Link Festa F52-Outdoor v1 consists of the same hardware as the TP-Link EAP225-Outdoor v3. Only the device identifiers differ. Device specifications: * SoC: QCA9563 @ 775MHz * Memory: 128MiB DDR2 * Flash: 16MiB SPI-NOR * Wireless 2.4GHz (SoC): b/g/n 2x2 * Wireless 5GHz (QCA9886): a/n/ac 2x2 MU-MIMO * Ethernet (RTL8211FS): 1× 1GbE, PoE Flashing instructions: Can be flashed via WebUI: * Enable ssh via vendor WebUI * ssh into target device * run `cliclientd stopcs` on target device * upload factory image via web interface Signed-off-by: Paul Maruhn <[email protected]>

• Paul Maruhn(20 Sept 26)

  ath79: refactor eap225-outdoor-v3.dts for resuse Move dts file for the eap225-outdoor-v3 to its own .dtsi to reuse it for the identical f52-outdoor-v1. Signed-off-by: Paul Maruhn <[email protected]>

• Tyrel M. McQueen(22 Oct 26)

  dnsmasq: cherrypick upstream to fix CVEs/vulns Two days ago, upstream DNSMASQ added a series of patches that say "CVE-2026-XXXXXX may apply," specifically: CVE-2026-93008 CVE-2026-93007 CVE-2026-93006 CVE-2026-93009 CVE-2026-93011 There is also one that does not specify a CVE, but acknowledges "Michel Belleau for finding and characterising this vulnerability." This commit cherry picks those commits to apply on top of 2.93. I also include one from October 1 that does not have a CVE, but is listed as CNVD-C-2026-590208. These patches can be removed once DNSMASQ 2.94 is released. Signed-off-by: Tyrel M. McQueen <[email protected]> Link: https://github.com/openwrt/openwrt/pull/26124 Signed-off-by: Robert Marko <[email protected]>

• Michele Salerno(23 Oct 26)

  mvebu: wrt3200acm: fix wifi card resets described as LEDs On the WRT3200ACM the wlan_2g and wlan_5g LEDs of the upstream device tree are the PERST# lines of the two wifi cards: any LED trigger that turns one of them on holds that card in reset, and mwlwifi logs "adapter does not exist" until reboot. 950: backport of the patch sent upstream, which drops the two LEDs and describes the lines as reset-gpios of the PCIe ports. Link: https://lore.kernel.org/r/[email protected] 951: with 801-pci-mvebu-time-out-reset-on-link-up.patch the reset wait ended at once when the bootloader had already trained the link, and the 5GHz card was enumerated while still in reset. Keep PERST# asserted until the link is down (at most 100ms). Fixes: #9517 Signed-off-by: Michele Salerno <[email protected]> Link: https://github.com/openwrt/openwrt/pull/26138 Signed-off-by: Robert Marko <[email protected]>

• Koen van Mierlo(23 Oct 26)

  qualcommax: ipq60xx: rbx350: set ath11k memory mode The Netgear RBR350 and RBS350 share ipq6018-rbx350.dtsi. They are 512 MB boards and use the 55 MiB q6_region from ipq6018-512m.dtsi, but unlike the other ipq60xx boards they do not set qcom,ath11k-fw-memory-mode. Once the q6_region override is applied (see #25659 / #25952), the firmware runs its default memory profile in a region that is too small. This causes random failures once the radio is active, either a firmware assertion: ar_wal_peer.c:1761 Assertion 0 failed or a kernel oops in the RX path: Unable to handle kernel read from unreadable memory at 0x8 put_netmem+0x10/0xb0 ath11k_dp_rx_process_mon_status+0x2e8/0xd60 [ath11k] followed by a reboot. Set qcom,ath11k-fw-memory-mode = <1> as the other ipq60xx boards do. Tested on Netgear RBR350 (r37618) with phy0-sta0 associated: no firmware crash or oops over 10 cold boots and one run of 18h uptime. Not tested on RBS350. Assisted-by: Claude Sonnet 5.5 Signed-off-by: Koen van Mierlo <[email protected]> Link: https://github.com/openwrt/openwrt/pull/26142 Signed-off-by: Robert Marko <[email protected]>

• Jonas Jelonek(20 Oct 26)

  realtek: pcs: rtl93xx: refine RX calibration diagnostics The RTL931x calibration worker already reports numbered attempt results, and validation failures include the final receive-link status and symbol-error value. Per-path start banners and per-check traces add repetitive output. Remove the start banners and individual validation samples. Include the final symbol-error value in the successful validation summary alongside the check count, so both outcomes retain the decisive observation. Reword the batch-exhaustion warnings for both RTL930x and RTL931x to report an unsuccessful batch and the actual number of attempts. Preserve the RTL931x error code for diagnosis. Link: https://github.com/openwrt/openwrt/pull/26062 Signed-off-by: Jonas Jelonek <[email protected]>

• Jonas Jelonek(19 Oct 26)

  realtek: pcs: rtl931x: rate-limit RX link recovery An unstable link can repeatedly trigger full RX calibration requests, including when calibration passes briefly before link is lost again. Limit monitor-triggered recovery requests to one every 30 seconds per SerDes. Continue checking link status every 500 ms and allow the first confirmed loss to trigger recovery immediately. Do not clear the deadline on a brief link-up, so flapping cannot bypass the rate limit. Saturate the down counter at its debounce threshold while waiting and log debounce progress only when the count advances. Use a 64-bit jiffies deadline to handle long uptimes on 32-bit systems. Link: https://github.com/openwrt/openwrt/pull/26062 Signed-off-by: Jonas Jelonek <[email protected]>

• Jonas Jelonek(19 Oct 26)

  realtek: pcs: rtl931x: recalibrate RX after debounced link loss Calibrated 10GBase-R RX settings can prevent link reacquisition after the incoming signal disappears. Restoring the acquisition baseline recovers these links, but a new connection also needs fresh calibration. Add delayed link-monitor work per SerDes and arm it after a calibration request completes. Read current receive-link status every 500 ms and require three consecutive down samples before recovery. Reset the debounce count on link-up or register-access errors. On confirmed loss, reuse post_config to apply the baseline and start a fresh deferred calibration request. Keep monitoring inactive while RX_IDLE blocks calibration or attempts are retried, then resume monitoring when the request finishes. Restrict monitoring to 10GBase-R. Invalidate monitoring on mode changes and extend the shared RTL93xx cleanup handler to stop both workers. Check each work callback before cancelling so uninitialized optional work is skipped. Clear activity flags under the controller mutex and cancel synchronously outside it. Keep routine calibration and recovery diagnostics at debug level, retaining warnings for failed calibration and errors for register-access failures. Link: https://github.com/openwrt/openwrt/pull/26062 Signed-off-by: Jonas Jelonek <[email protected]>

• Jonas Jelonek(19 Oct 26)

  realtek: pcs: rtl931x: reject RX calibration with persistent errors Fiber calibration returns success when the receive link remains up even if every symbol-error check has failed. This can retain erroneous settings and bypass the worker's baseline rollback and retry handling. Require an observation to meet the existing link and symbol-error criteria. Return -EIO when link is up with excessive errors, or -ENOLINK when link is down, and propagate symbol-counter read failures immediately. Retain warnings for failed calibration and error-level diagnostics for register-access failures. Link: https://github.com/openwrt/openwrt/pull/26062 Signed-off-by: Jonas Jelonek <[email protected]>

• Jonas Jelonek(17 Oct 26)

  realtek: pcs: rtl931x: defer RX calibration until the receiver is ready Running RX calibration synchronously from post_config can attempt adaptation without an incoming signal and blocks configuration during the calibration delays. Keep the acquisition baseline in post_config and defer PHY and 10G-fiber calibration to one delayed work item per SerDes. Limit deferred calibration to 10GBase-R, USXGMII and XSGMII, retaining the XSGMII baseline exception. Use the shared RX_IDLE-based readiness check for all three modes. Avoid requiring an established XSGMII receive link before adaptation; the SDK's PHY-facing construction path calibrates before checking XSGMII link state. Poll until ready without consuming an attempt. Rate-limit readiness-access errors and keep the request pending for another poll so a transient bus error does not stop calibration. Select the media setting in the worker immediately before adaptation. Run one attempt per invocation and allow at most three attempts per request, restoring the baseline on failure except in XSGMII mode. Reuse the RTL930x polling and retry delays and define a shared initial delay for both variants. Register the shared managed-work cleanup so pending calibration is drained before the SerDes is released. Link: https://github.com/openwrt/openwrt/pull/26062 Signed-off-by: Jonas Jelonek <[email protected]>

• Jonas Jelonek(19 Oct 26)

  realtek: pcs: rtl93xx: preserve RX link-status read errors The shared 10G receive-link helper returns a boolean, hiding register-access errors as link-down. Return current status as 0/1 or a negative access error so callers can distinguish a missing link from a failed read. Update the RTL930x calibration validator to log and reject access errors. Propagate errors from RTL931x fiber calibration and the RTL930x loopback check, preserving loopback restoration before returning an error. This also provides the status interface needed by subsequent link monitoring. Link: https://github.com/openwrt/openwrt/pull/26062 Signed-off-by: Jonas Jelonek <[email protected]>

• Jonas Jelonek(19 Oct 26)

  realtek: pcs: rtl93xx: share RX calibration readiness checking Extract the RTL930x RX status selection, lane read, and readiness decision into a shared RTL93xx helper so RTL931x can reuse the same sequence. Return 1 when RX_IDLE is deasserted, 0 while idle, or a negative access error. Accept 10GBase-R, USXGMII and XSGMII, returning -EOPNOTSUPP for other modes before accessing the registers. Include the mode, RX_IDLE value, and readiness interpretation in debug diagnostics. RTL931x also uses RX-status selector 0x35 in the SDK's _phy_rtl9310_remoteFault_handle() and _phy_rtl9310_dac_chk(), independently of the chip-specific RX equalizer debug selectors. Convert the RTL930x worker to this positive-ready contract and remove its local inversion, keeping access-error policy in the worker. Give the shared RX-status selector a family-wide name. Link: https://github.com/openwrt/openwrt/pull/26062 Signed-off-by: Jonas Jelonek <[email protected]>

• Jonas Jelonek(08 Oct 26)

  realtek: pcs: rtl931x: delay LEQ coefficient readback The LEQ coefficient is exposed through a shared debug readback path whose source is selected immediately before the value is sampled. Wait 1-2 ms for the debug selection to settle before reading the coefficient. This matches the settling delay used by the other RX equalizer readbacks and avoids returning a stale value. Link: https://github.com/openwrt/openwrt/pull/26062 Signed-off-by: Jonas Jelonek <[email protected]>

• Jonas Jelonek(08 Oct 26)

  realtek: pcs: rtl931x: select media-specific RX calibration setting The vendor SDK programs the undocumented ANA_10G 0xe[13:11] field differently before media-specific 10GBase-R calibration, but does not name the field or describe its purpose. Name the field and its default, fiber and DAC values, documenting that the calibration-selection role is inferred from SDK usage. Initialize the field to 0 during attachment configuration and restore that default with the common LEQ/DFE baseline, matching the selector reset in the SDK's _phy_rtl9310_sds_init(). PHY-facing links retain the default. Select 1 in the attachment dispatcher before calling fiber adaptation. Handle selection-write failures through the common calibration rollback path before adaptation begins. Failed attempts restore the selector along with the coefficient baseline. Define the SDK's DAC value of 2 for future dedicated DAC calibration. Link: https://github.com/openwrt/openwrt/pull/26062 Signed-off-by: Jonas Jelonek <[email protected]>

• Jonas Jelonek(08 Oct 26)

  realtek: pcs: rtl931x: restore RX baseline after calibration failure Fiber calibration only reports link failure through a warning, so post-config cannot restore acquisition defaults after a failed attempt. Return a status from the attachment-specific calibration helpers and restore the common LEQ/DFE baseline from post-config on failure. Keep calibration failure non-fatal to PCS configuration. Link: https://github.com/openwrt/openwrt/pull/26062 Signed-off-by: Jonas Jelonek <[email protected]>

• Jonas Jelonek(08 Oct 26)

  realtek: pcs: rtl931x: move RX baseline to post-config Attachment setup runs before SerDes mode programming, power-up and autoneg configuration. Fiber calibration also reset LEQ and DFE a second time before doing any work. Apply the common LEQ/DFE baseline once from post-config, immediately before attachment-specific calibration. Preserve the existing XSGMII exception to common baseline initialization. Link: https://github.com/openwrt/openwrt/pull/26062 Signed-off-by: Jonas Jelonek <[email protected]>

• Rosen Penev(10 Oct 26)

  kernel: mips: use maddu and prefetch in csum_partial() Combine the maddu checksum loop from the realtek target with a 256-byte-ahead prefetch and move it to generic, so every MIPS32r1-r5 target gets it. The 32-byte maddu loop runs with a prefetch 256 bytes ahead until 256 bytes before the end of the buffer and finishes without it, so it only prefetches addresses the loop loads itself later and brings in no extra line on non-coherent systems. Asus RT-N16 (BCM4716, 74Kc, bgmac), iperf3 median of 3, mean of two rounds, in one boot: stock maddu prefetch both (Mbit/s) local rx / tx 218 / 191 224 / 191 246 / 211 253 / 216 routed up / down 166 / 135 168 / 139 191 / 151 195 / 154 routed, 4 streams 64 / 77 65 / 79 68 / 83 69 / 84 TP-Link Archer C7 v2 (QCA9558, 74Kc, ag71xx), same method, in separate boots: stock both (Mbit/s) local rx / tx 384 / 339 419 / 369 routed up / down 396 / 600 389 / 619 routed, 4 streams 388 / 545 378 / 553 Drop realtek's 309-mips-csum-partial-maddu.patch, which this replaces. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01NAXSRngjdfwSGghyt38DhF Signed-off-by: Rosen Penev <[email protected]> Link: https://github.com/openwrt/openwrt/pull/25846 Signed-off-by: Markus Stockhausen <[email protected]>

• Markus Stockhausen(22 Oct 26)

  realtek: dsa: convert L2 register accesses to regmap Use the existing per-device register map for all sw_r32(), sw_w32() and sw_w32_mask() accesses in l2.c. Pass priv through the affected callbacks, including the L2 hash-table writer used by RTL931x, and update their prototypes and callers. Preserve the old masked-write operation (old & ~clear) | set. Regmap masks the supplied value, so its mask must include clear | set. Keep the original mask where the value is guaranteed to be a subset; include the value for flood modes, shifted forwarding modes and ageing values. Use regmap_write_bits() to retain the unconditional write of the old macro. Replace the RTL931x 64-bit flooding-portmask helper calls with explicit regmap writes in the original high-word-first register order. Read each hash control register once for a consistent algorithm selection. Use regmap polling for the flush completion bits, retaining the existing zero-delay polling without a timeout. Return register-access errors from the integer ageing and flush callbacks, and propagate the ageing setter's result to DSA. Assisted-by: ChatGPT (OpenAI GPT-6 Astra) Link: https://github.com/openwrt/openwrt/pull/26111 Signed-off-by: Markus Stockhausen <[email protected]>

• Sander van Deijck(20 Oct 26)

  netfilter: drop entries for kernel symbols that no longer exist - NF_TABLES_SET, NFT_COUNTER, NFT_META, NFT_OBJREF: these are built into nf_tables.ko and are no longer separate options or modules - BRIDGE_EBT_NFQUEUE: there is no ebt_nfqueue module in the kernel - IP_NF_TARGET_ROUTE: commented out, the out-of-tree ROUTE target is long gone None of these produced a module, so the package contents do not change. Signed-off-by: Sander van Deijck <[email protected]> Link: https://github.com/openwrt/openwrt/pull/26067 Signed-off-by: Robert Marko <[email protected]>

• Sander van Deijck(20 Oct 26)

  netfilter: remove nf-log6 Since Linux 5.13, IPv4 and IPv6 packet logging are handled by nf_log_syslog, which is part of kmod-nf-log. nf_log_ipv4, nf_log_ipv6 and nf_log_common no longer exist, so kmod-nf-log6 is an empty package. Remove it, and drop the entries for the old modules from include/netfilter.mk. CONFIG_NF_LOG_IPV4 and CONFIG_NF_LOG_IPV6 are backwards-compatibility options that only select NF_LOG_SYSLOG, which kmod-nf-log already enables. CONFIG_NF_LOG_IPV6 was only configured through the KCONFIG of kmod-nf-log6. Add it to the generic config as not set, next to CONFIG_NF_LOG_IPV4, as it would otherwise be left unconfigured when nf_tables is enabled and abort the kernel configuration. It is still enabled when selected by NETFILTER_XT_TARGET_LOG for ip6tables. kmod-nf-ipt6 now depends on kmod-nf-log directly, which it previously got through kmod-nf-log6. Signed-off-by: Sander van Deijck <[email protected]> Link: https://github.com/openwrt/openwrt/pull/26067 Signed-off-by: Robert Marko <[email protected]>

• Sander van Deijck(21 Oct 26)

  ltq-adsl-app: stop checking for the ltq_ptm_ase module The AmazonSE PTM driver has been removed, so the ATM/PTM switch scripts no longer need to look for ltq_ptm_ase in /proc/modules. Signed-off-by: Sander van Deijck <[email protected]> Link: https://github.com/openwrt/openwrt/pull/26085 Signed-off-by: Robert Marko <[email protected]>

• Sander van Deijck(21 Oct 26)

  ltq-ptm: remove AmazonSE variant kmod-ltq-ptm-ase has been marked BROKEN since 2017 because it fails to compile (bd523d4573 "ltq-ptm: mark AmazonSE support as broken"), and nobody has fixed it since. No device selects it; AmazonSE devices use the ATM driver (kmod-ltq-atm-ase) for ADSL. Remove the package, its kbuild block, the AmazonSE-only sources and the CONFIG_AMAZON_SE branches in the shared code. The danube, ar9 and vr9 variants are built exactly as before, so PKG_RELEASE is left unchanged. Signed-off-by: Sander van Deijck <[email protected]> Link: https://github.com/openwrt/openwrt/pull/26085 Signed-off-by: Robert Marko <[email protected]>

• Sander van Deijck(21 Oct 26)

  kernel: gpio-nct5104d: drop code for kernels before 6.17 The gpio_chip set() callback returns int since Linux 6.17, and 6.18 is the only kernel left. Remove the version checks and keep only the int variant. Signed-off-by: Sander van Deijck <[email protected]> Link: https://github.com/openwrt/openwrt/pull/26086 Signed-off-by: Robert Marko <[email protected]>

• Gennaro Cimmino(22 Oct 26)

  realtek: l3: drop the separate host route trap otto_l3_fib_trap_v4() placed and wrote the trap row of a prefix by hand and handed a /32 to otto_l3_host_route_trap(), which built the same route and wrote it through otto_l3_route_install(). That function takes a host slot for a host route and places a row for a prefix route, so the one path does both: allocate the route by its kind and install it. Two error messages change. A trap route that finds no row is reported by otto_l3_route_install() ("no row for prefix route"), not as "no row to trap". A host /32 whose allocation fails now gets "no row to trap" too. The route is then freed rather than torn down: it has no row to clear, and a trap route holds no next hop, counter, egress interface or MAC entry, so both release the same. Tested on an HPE 1920-48G (RTL8393), main against main with this change, one boot each. Blackhole routes (/16, /24, /32) and a route with dev lo got a trap row each and the rt_trap flag; 24 of them were added and deleted in mixed orders, and one was replaced twice. The realtek_otto_l3/routes dump was the same on both images at every step, apart from the ULA prefix, which changes per boot. dmesg logged the same errors on both, only for the routes via lo: "lower interface lo not found" and "fib_add() failed". The path where no row is left was not exercised. RTL839x has no host table, so there every trap entry is a prefix row; the host slot path runs on RTL930x only and is compile-tested. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Gennaro Cimmino <[email protected]> Link: https://github.com/openwrt/openwrt/pull/26123 Signed-off-by: Markus Stockhausen <[email protected]>