diff --git a/build.sh b/build.sh
index 01f5fe6e8c..47ef395aec 100755
--- a/build.sh
+++ b/build.sh
@@ -26,15 +26,18 @@ set_version_variables()
 {
 
 	#openwrt branch
-	branch_name="24.10"
-	branch_id="openwrt-24.10"
-	packages_branch="openwrt-24.10"
+	branch_name="25.12"
+	branch_id="openwrt-25.12"
+	packages_branch="openwrt-25.12"
 
 
-	# set precise commit in repo to use 
-	# you can set this to an alternate commit 
+	# set precise commit in repo to use
+	# you can set this to an alternate commit
 	# or empty to checkout latest
-	openwrt_commit="95d0ca014c4ce5e225579f859c066dc74a20763b"
+	# pinned to the v25.12.5 tag's commit (not branch head) for
+	# reproducibility, same convention as the prior 24.10 pin -- see
+	# docs/openwrt-2512-bump-plan.md/-progress.md in gargoyle-tools
+	openwrt_commit="f0a60eee2fe051741c643ea6118718aae1ef17fb"
 	openwrt_abbrev_commit=$( echo "$openwrt_commit" | cut -b 1-7 )
 	
 
diff --git a/netfilter-match-modules/integrate_netfilter_modules.sh b/netfilter-match-modules/integrate_netfilter_modules.sh
index 3a36f8dffb..e07c3e4c3f 100644
--- a/netfilter-match-modules/integrate_netfilter_modules.sh
+++ b/netfilter-match-modules/integrate_netfilter_modules.sh
@@ -143,13 +143,13 @@ EOF
 	printf "$defines\n" >> nf-patch-build/linux-download-make
 
 	cat << 'EOF' >>nf-patch-build/linux-download-make
+GENERIC_PLATFORM_DIR := $(TOPDIR)/target/linux/generic
+PLATFORM_DIR:=$(TOPDIR)/target/linux/$(BOARD)
+
 include $(INCLUDE_DIR)/kernel-version.mk
 KERNEL_NAME:=$(shell echo "$(KERNEL)" | sed 's/ /\./g' |  sed 's/\.$$//g' )
 KERNEL_PATCHVER_NAME:=$(shell echo "$(KERNEL_PATCHVER)" | sed 's/ /\./g' |  sed 's/\.$$//g' )
 
-GENERIC_PLATFORM_DIR := $(TOPDIR)/target/linux/generic
-PLATFORM_DIR:=$(TOPDIR)/target/linux/$(BOARD)
-
 GENERIC_BACKPORT_PATCH_DIR := $(GENERIC_PLATFORM_DIR)/backport-$(KERNEL_NAME)
 GENERIC_PENDING_PATCH_DIR := $(GENERIC_PLATFORM_DIR)/pending-$(KERNEL_NAME)
 GENERIC_HACK_PATCH_DIR := $(GENERIC_PLATFORM_DIR)/hack-$(KERNEL_NAME)
@@ -473,6 +473,30 @@ for new_d in $new_nftables_module_dirs ; do
 			insert_lines_at "$insert_line_num" "$config_lines" "linux.new/net/netfilter/Kconfig" "1"
 		fi
 
+		#some custom nft_* expressions (e.g. bandwidth) declare more netlink attributes than
+		#upstream's NFT_EXPR_MAXATTR allows. Kernel 6.12 added nft_register_expr() ->
+		#WARN_ON_ONCE(type->maxattr > NFT_EXPR_MAXATTR), which fails registration (-ENOMEM)
+		#for any expr type declaring more attributes than the constant permits -- this check
+		#didn't exist before 6.12. A module signals it needs a higher ceiling by shipping an
+		#optional "maxattr" file (just the required integer) alongside its module/header/
+		#nftables dirs; if present, bump NFT_EXPR_MAXATTR here to at least that value.
+		#NFT_EXPR_MAXATTR is a kernel-internal sizing constant (bounds a fixed-size on-stack
+		#netlink attribute array in nf_tables_api.c/nft_inner.c), not part of the uAPI, so
+		#raising it carries no wire-format/ABI risk. This bump deliberately lives here rather
+		#than as a standalone generic kernel patch, so it stays next to the module that
+		#actually requires it -- a bare "16 -> 17" edit elsewhere would be meaningless
+		#without knowing which expression type forced it.
+		if [ -e "$new_d/maxattr" ] ; then
+			required_maxattr=$(cat "$new_d/maxattr")
+			nf_tables_h="linux.new/include/net/netfilter/nf_tables.h"
+			current_maxattr=$(cat "$nf_tables_h" | egrep "#define NFT_EXPR_MAXATTR" | egrep -o "[0-9]+")
+			if [ -n "$current_maxattr" ] && [ "$required_maxattr" -gt "$current_maxattr" ] ; then
+				echo "nftables $upper_name module declares $required_maxattr attributes, exceeding kernel's NFT_EXPR_MAXATTR=$current_maxattr -- raising it to $required_maxattr"
+				cat "$nf_tables_h" | sed "s/#define NFT_EXPR_MAXATTR.*/#define NFT_EXPR_MAXATTR $required_maxattr/" >.tmp.tmp
+				mv .tmp.tmp "$nf_tables_h"
+			fi
+		fi
+
 		#update files for nftables extension
 		if [ -e $new_d/nftables/meta ] ; then
 			while IFS=$'\n' read -r line;
@@ -606,7 +630,10 @@ if [ "$patch_kernel" = 1 ] ; then
 	cd linux.new
 	module_files=$(find net/netfilter)
 	include_files=$(find include/linux/netfilter)
-	test_files="$module_files $include_files"
+	#outside both dirs walked above -- included so an NFT_EXPR_MAXATTR bump (see the
+	#nftables module loop above) actually lands in the generated patch
+	nf_tables_h_file="include/net/netfilter/nf_tables.h"
+	test_files="$module_files $include_files $nf_tables_h_file"
 	cd ..
 	for t in $test_files ; do
 		if [ ! -d "linux.new/$t" ] ; then
diff --git a/netfilter-match-modules/iptables/bandwidth/extension/libxt_bandwidth.c b/netfilter-match-modules/iptables/bandwidth/extension/libxt_bandwidth.c
index e9f93241bc..3587efd8cf 100644
--- a/netfilter-match-modules/iptables/bandwidth/extension/libxt_bandwidth.c
+++ b/netfilter-match-modules/iptables/bandwidth/extension/libxt_bandwidth.c
@@ -41,15 +41,9 @@
 #include <linux/netfilter.h>
 #include <linux/netfilter/xt_bandwidth.h>
 
-typedef union
-{
-	struct in_addr ip4;
-	struct in6_addr ip6;
-} ipany;
-
 int get_minutes_west(void);
 void set_kernel_timezone(void);
-int parse_sub(char* subnet_string, ipany* subnet, ipany* subnet_mask, int family);
+int parse_sub(char* subnet_string, union xt_bandwidth_ipany* subnet, union xt_bandwidth_ipany* subnet_mask, int family);
 static void param_problem_exit_error(char* msg);
 char** split_on_separators(char* line, char* separators, int num_separators, int max_pieces, int include_remainder_at_max);
 char* trim_flanking_whitespace(char* str);
@@ -105,8 +99,8 @@ static int parse(	int c,
 	struct xt_bandwidth_info *info = (struct xt_bandwidth_info *)(*match)->data;
 	int valid_arg = 0;
 	long int num_read;
-	uint64_t read_64;
-	time_t read_time;
+	long long int read_64;
+	long long int read_time;
 
 	/* set defaults first time we get here */
 	if(*flags == 0)
@@ -424,11 +418,11 @@ static void print_bandwidth_args(struct xt_bandwidth_info* info, int family)
 		
 		if(info->cmp == BANDWIDTH_GT)
 		{
-			printf("--greater_than %lld ", info->bandwidth_cutoff);
+			printf("--greater_than %lld ", (long long)info->bandwidth_cutoff);
 		}
 		if(info->cmp == BANDWIDTH_LT)
 		{
-			printf("--less_than %lld ", info->bandwidth_cutoff);
+			printf("--less_than %lld ", (long long)info->bandwidth_cutoff);
 		}
 		if (info->type == BANDWIDTH_COMBINED) /* too much data to print for multi types, have to use socket to get/set data */
 		{
@@ -442,12 +436,12 @@ static void print_bandwidth_args(struct xt_bandwidth_info* info, int family)
 			}
 			else 
 			{
-				printf("--current_bandwidth %lld ", info->current_bandwidth);
+				printf("--current_bandwidth %lld ", (long long)info->current_bandwidth);
 			}
 		}
 		if(info->reset_is_constant_interval)
 		{
-			printf("--reset_interval %lld ", info->reset_interval);
+			printf("--reset_interval %lld ", (long long)info->reset_interval);
 		}
 		else
 		{
@@ -474,7 +468,7 @@ static void print_bandwidth_args(struct xt_bandwidth_info* info, int family)
 		}
 		if(info->reset_time > 0)
 		{
-			printf("--reset_time %lld ", info->reset_time);
+			printf("--reset_time %lld ", (long long)info->reset_time);
 		}
 		if(info->num_intervals_to_save > 0)
 		{
@@ -531,7 +525,7 @@ static void save_mt4(const void *ip, const struct xt_entry_match *match)
 	print_bandwidth_args(info, NFPROTO_IPV4);
 	
 	time(&now);
-	printf("--last_backup-time %lld ", now);
+	printf("--last_backup-time %lld ", (long long)now);
 }
 
 static void save_mt6(const void *ip, const struct xt_entry_match *match)
@@ -542,7 +536,7 @@ static void save_mt6(const void *ip, const struct xt_entry_match *match)
 	print_bandwidth_args(info, NFPROTO_IPV6);
 	
 	time(&now);
-	printf("--last_backup-time %lld ", now);
+	printf("--last_backup-time %lld ", (long long)now);
 }
 
 static struct xtables_match bandwidth_mt_reg[] = 
@@ -587,7 +581,7 @@ static void param_problem_exit_error(char* msg)
 	xtables_error(PARAMETER_PROBLEM, "%s", msg);
 }
 
-int parse_sub(char* subnet_string, ipany* subnet, ipany* subnet_mask, int family)
+int parse_sub(char* subnet_string, union xt_bandwidth_ipany* subnet, union xt_bandwidth_ipany* subnet_mask, int family)
 {
 	char** sub_parts = split_on_separators(subnet_string,"/",1,2,1);
 	char* substr = trim_flanking_whitespace(sub_parts[0]);
diff --git a/netfilter-match-modules/iptables/bandwidth/module/bandwidth_deps/tree_map.h b/netfilter-match-modules/iptables/bandwidth/module/bandwidth_deps/tree_map.h
index a1058194a8..ecbf3f1683 100644
--- a/netfilter-match-modules/iptables/bandwidth/module/bandwidth_deps/tree_map.h
+++ b/netfilter-match-modules/iptables/bandwidth/module/bandwidth_deps/tree_map.h
@@ -1089,5 +1089,3 @@ static unsigned long sdbm_string_hash(const char *key)
 	}
 	return hashed_key;
 }
-
-
diff --git a/netfilter-match-modules/iptables/webmon/extension/libxt_webmon.c b/netfilter-match-modules/iptables/webmon/extension/libxt_webmon.c
index 3084af19ff..b66a71ba09 100644
--- a/netfilter-match-modules/iptables/webmon/extension/libxt_webmon.c
+++ b/netfilter-match-modules/iptables/webmon/extension/libxt_webmon.c
@@ -25,6 +25,7 @@
 #include <string.h>
 #include <stdlib.h>
 #include <getopt.h>
+#include <unistd.h>
 
 #include <arpa/inet.h>
 
diff --git a/netfilter-match-modules/iptables/webmon/module/xt_webmon.c b/netfilter-match-modules/iptables/webmon/module/xt_webmon.c
index ad5c01dab7..5be8fb9125 100644
--- a/netfilter-match-modules/iptables/webmon/module/xt_webmon.c
+++ b/netfilter-match-modules/iptables/webmon/module/xt_webmon.c
@@ -103,6 +103,12 @@ static int max_search_queue_length   = 5;
 
 static spinlock_t webmon_lock = __SPIN_LOCK_UNLOCKED(webmon_lock);;
 
+void add_queue_node(int family, ipany src_ip, char* value, queue* full_queue, string_map* queue_index, char* queue_index_key, uint32_t max_queue_length);
+void destroy_queue(queue* q);
+int strnicmp(const char * cs,const char * ct,size_t count);
+char *strnistr(const char *s, const char *find, size_t slen);
+int within_edit_distance(char *s1, char *s2, int max_edit);
+char** split_on_separators(char* line, char* separators, int num_separators, int max_pieces, int include_remainder_at_max, unsigned long *num_pieces);
 
 static void update_queue_node_time(queue_node* update_node, queue* full_queue)
 {
@@ -131,7 +137,7 @@ static void update_queue_node_time(queue_node* update_node, queue* full_queue)
 	}
 }
 
-void add_queue_node(int family, ipany src_ip, char* value, queue* full_queue, string_map* queue_index, char* queue_index_key, uint32_t max_queue_length )
+void add_queue_node(int family, ipany src_ip, char* value, queue* full_queue, string_map* queue_index, char* queue_index_key, uint32_t max_queue_length)
 {
 
 	queue_node *new_node = (queue_node*)kmalloc(sizeof(queue_node), GFP_ATOMIC);
diff --git a/netfilter-match-modules/iptables/weburl/module/weburl_deps/regexp.c b/netfilter-match-modules/iptables/weburl/module/weburl_deps/regexp.c
index e60fce7fd8..062cbaadb9 100644
--- a/netfilter-match-modules/iptables/weburl/module/weburl_deps/regexp.c
+++ b/netfilter-match-modules/iptables/weburl/module/weburl_deps/regexp.c
@@ -83,7 +83,7 @@ void regerror(char * s)
  */
 
 /* definition	number	opnd?	meaning */
-#define	END	0	/* no	End of program. */
+#define	P_END	0	/* no	End of program. */
 #define	BOL	1	/* no	Match "" at beginning of line. */
 #define	EOL	2	/* no	Match "" at end of line. */
 #define	ANY	3	/* no	Match any one character. */
@@ -275,7 +275,7 @@ regcomp(char *exp,int *patternsize)
 	r->regmust = NULL;
 	r->regmlen = 0;
 	scan = r->program+1;			/* First BRANCH. */
-	if (OP(regnext(&g, scan)) == END) {		/* Only one top-level choice. */
+	if (OP(regnext(&g, scan)) == P_END) {		/* Only one top-level choice. */
 		scan = OPERAND(scan);
 
 		/* Starting-point info. */
@@ -361,7 +361,7 @@ reg(struct match_globals *g, int paren, int *flagp /* Parenthesized? */ )
 	}
 
 	/* Make a closing node, and hook it on the end. */
-	ender = regnode(g, (paren) ? CLOSE+parno : END);
+	ender = regnode(g, (paren) ? CLOSE+parno : P_END);
 	regtail(g, ret, ender);
 
 	/* Hook the tails of the branches to the closing node. */
@@ -978,7 +978,7 @@ regmatch(struct match_globals *g, char *prog)
 				return(0);
 			}
 			break;
-		case END:
+		case P_END:
 			return(1);	/* Success! */
 			break;
 		default:
@@ -991,7 +991,7 @@ regmatch(struct match_globals *g, char *prog)
 	}
 
 	/*
-	 * We get here only if there's trouble -- normally "case END" is
+	 * We get here only if there's trouble -- normally "case P_END" is
 	 * the terminating point.
 	 */
 	printk("<3>Regexp: corrupted pointers\n");
@@ -1075,13 +1075,13 @@ void
 regdump(regexp *r)
 {
 	register char *s;
-	register char op = EXACTLY;	/* Arbitrary non-END op. */
+	register char op = EXACTLY;	/* Arbitrary non-P_END op. */
 	register char *next;
 	/* extern char *strchr(); */
 
 
 	s = r->program + 1;
-	while (op != END) {	/* While that wasn't END last time... */
+	while (op != P_END) {	/* While that wasn't P_END last time... */
 		op = OP(s);
 		printf("%2d%s", s-r->program, regprop(s));	/* Where, what. */
 		next = regnext(s);
@@ -1151,7 +1151,7 @@ regprop(char *op)
 	case BACK:
 		p = "BACK";
 		break;
-	case END:
+	case P_END:
 		p = "END";
 		break;
 	case OPEN+1:
diff --git a/netfilter-match-modules/iptables/weburl/module/weburl_deps/regexp.h b/netfilter-match-modules/iptables/weburl/module/weburl_deps/regexp.h
index a72eba71fb..d2cf247c34 100644
--- a/netfilter-match-modules/iptables/weburl/module/weburl_deps/regexp.h
+++ b/netfilter-match-modules/iptables/weburl/module/weburl_deps/regexp.h
@@ -37,5 +37,6 @@ regexp * regcomp(char *exp, int *patternsize);
 int regexec(regexp *prog, char *string);
 void regsub(regexp *prog, char *source, char *dest);
 void regerror(char *s);
+__kernel_size_t my_strcspn(const char *s1,const char *s2);
 
 #endif
diff --git a/netfilter-match-modules/iptables/weburl/module/xt_weburl.c b/netfilter-match-modules/iptables/weburl/module/xt_weburl.c
index 0ce486db21..6d20da71ed 100644
--- a/netfilter-match-modules/iptables/weburl/module/xt_weburl.c
+++ b/netfilter-match-modules/iptables/weburl/module/xt_weburl.c
@@ -52,6 +52,12 @@ MODULE_ALIAS("ip6t_weburl");
 
 string_map* compiled_map = NULL;
 
+int strnicmp(const char * cs,const char * ct,size_t count);
+char *strnistr(const char *s, const char *find, size_t slen);
+int do_match_test(unsigned char match_type,  const char* reference, char* query);
+int http_match(const struct xt_weburl_info* info, const unsigned char* packet_data, int packet_length);
+int https_match(const struct xt_weburl_info* info, const unsigned char* packet_data, int packet_length);
+
 int strnicmp(const char * cs,const char * ct,size_t count)
 {
 	register signed char __res = 0;
diff --git a/netfilter-match-modules/nftables/bandwidth/maxattr b/netfilter-match-modules/nftables/bandwidth/maxattr
new file mode 100644
index 0000000000..98d9bcb75a
--- /dev/null
+++ b/netfilter-match-modules/nftables/bandwidth/maxattr
@@ -0,0 +1 @@
+17
diff --git a/netfilter-match-modules/nftables/bandwidth/module/nft_bandwidth.c b/netfilter-match-modules/nftables/bandwidth/module/nft_bandwidth.c
index 13e5b54b08..6ba0e8fc76 100644
--- a/netfilter-match-modules/nftables/bandwidth/module/nft_bandwidth.c
+++ b/netfilter-match-modules/nftables/bandwidth/module/nft_bandwidth.c
@@ -35,7 +35,7 @@
 
 #include <linux/semaphore.h> 
 
-#include "bandwidth_deps/tree_map.h"
+#include "nft_bandwidth_deps/tree_map.h"
 #include <linux/netfilter/nft_bandwidth.h>
 
 #include <linux/ip.h>
@@ -133,6 +133,10 @@ static ktime_t get_nominal_previous_reset_time(struct nft_bandwidth_info *info,
 
 static uint64_t* initialize_map_entries_for_ip(info_and_maps* iam, char* ip, uint64_t initial_bandwidth, uint32_t family);
 
+char** split_on_separators(char* line, char* separators, int num_separators, int max_pieces, int include_remainder_at_max, unsigned long *num_pieces);
+char* trim_flanking_whitespace(char* str);
+void parse_ips_and_ranges(char* addr_str, struct nft_bandwidth_info *priv);
+
 int free_null_terminated_string_array(char** strs);
 
 int free_null_terminated_string_array(char** strs)
@@ -3464,10 +3468,23 @@ static int __init init(void)
 	if(id_map == NULL) /* deal with kmalloc failure */
 	{
 		printk("id map is null, returning -1\n");
+		nf_unregister_sockopt(&nft_bandwidth_sockopts);
 		return -1;
 	}
 
-	return nft_register_expr(&nft_bandwidth_type);
+	{
+		int register_err = nft_register_expr(&nft_bandwidth_type);
+		if(register_err != 0)
+		{
+			/* registration failed (e.g. too many netlink attributes for
+			 * this kernel's NFT_EXPR_MAXATTR) -- undo the sockopt
+			 * registration above, otherwise the kernel's sockopt table
+			 * is left pointing at code that's about to be unloaded */
+			printk("nft_bandwidth: nft_register_expr failed (%d), unregistering sockopts\n", register_err);
+			nf_unregister_sockopt(&nft_bandwidth_sockopts);
+		}
+		return register_err;
+	}
 }
 
 static void __exit fini(void)
diff --git a/netfilter-match-modules/nftables/bandwidth/module/bandwidth_deps/tree_map.h b/netfilter-match-modules/nftables/bandwidth/module/nft_bandwidth_deps/tree_map.h
similarity index 100%
rename from netfilter-match-modules/nftables/bandwidth/module/bandwidth_deps/tree_map.h
rename to netfilter-match-modules/nftables/bandwidth/module/nft_bandwidth_deps/tree_map.h
diff --git a/netfilter-match-modules/nftables/bandwidth/nftables/meta b/netfilter-match-modules/nftables/bandwidth/nftables/meta
index 653fbaa906..77d5439fa7 100644
--- a/netfilter-match-modules/nftables/bandwidth/nftables/meta
+++ b/netfilter-match-modules/nftables/bandwidth/nftables/meta
@@ -21,3 +21,4 @@ src_statement.c.1||insert||after||0||include <rule.h>||src/statement.c
 src_statement.c.2||insert||before||2||static void reject_stmt_print||src/statement.c
 include_linux_netfilter_nftables.h.1||insert||after||0||#define NFTA_REJECT_MAX||include/linux/netfilter/nf_tables.h
 include_parser.h.1||insert||after||0||PARSER_SC_STMT_REJECT||include/parser.h
+src_statement.c.3||insert||after||0||case STMT_REJECT: return &reject_stmt_ops;||src/statement.c
diff --git a/netfilter-match-modules/nftables/bandwidth/nftables/src_statement.c.3 b/netfilter-match-modules/nftables/bandwidth/nftables/src_statement.c.3
new file mode 100644
index 0000000000..b7f4e9bdd5
--- /dev/null
+++ b/netfilter-match-modules/nftables/bandwidth/nftables/src_statement.c.3
@@ -0,0 +1 @@
+	case STMT_BANDWIDTH: return &bandwidth_stmt_ops;
diff --git a/netfilter-match-modules/nftables/timerange/nftables/meta b/netfilter-match-modules/nftables/timerange/nftables/meta
index b6a2e03275..72a14fbc49 100644
--- a/netfilter-match-modules/nftables/timerange/nftables/meta
+++ b/netfilter-match-modules/nftables/timerange/nftables/meta
@@ -20,3 +20,4 @@ src_scanner.l.2||insert||before||1||scanner_push_start_cond\(yyscanner, SCANSTAT
 src_statement.c.1||insert||before||2||static void reject_stmt_print||src/statement.c
 include_linux_netfilter_nftables.h.1||insert||after||0||#define NFTA_REJECT_MAX||include/linux/netfilter/nf_tables.h
 include_parser.h.1||insert||after||0||PARSER_SC_STMT_REJECT||include/parser.h
+src_statement.c.2||insert||after||0||case STMT_REJECT: return &reject_stmt_ops;||src/statement.c
diff --git a/netfilter-match-modules/nftables/timerange/nftables/src_statement.c.2 b/netfilter-match-modules/nftables/timerange/nftables/src_statement.c.2
new file mode 100644
index 0000000000..87e6fafd9e
--- /dev/null
+++ b/netfilter-match-modules/nftables/timerange/nftables/src_statement.c.2
@@ -0,0 +1 @@
+	case STMT_TIMERANGE: return &timerange_stmt_ops;
diff --git a/netfilter-match-modules/nftables/webmon/module/nft_webmon.c b/netfilter-match-modules/nftables/webmon/module/nft_webmon.c
index 50f99ec54e..a8f4450c13 100644
--- a/netfilter-match-modules/nftables/webmon/module/nft_webmon.c
+++ b/netfilter-match-modules/nftables/webmon/module/nft_webmon.c
@@ -42,7 +42,7 @@
 
 #include <linux/netfilter/nft_webmon.h>
 
-#include "webmon_deps/tree_map.h"
+#include "nft_webmon_deps/tree_map.h"
 
 #include <linux/ktime.h>
 
@@ -103,6 +103,15 @@ static const struct nla_policy nft_webmon_policy[NFTA_WEBMON_MAX + 1] = {
 	[NFTA_WEBMON_SEARCHLOADDATALEN]	= { .type = NLA_U32 },
 };
 
+void add_queue_node(int family, ipany src_ip, char* value, queue* full_queue, string_map* queue_index, char* queue_index_key, uint32_t max_queue_length);
+void destroy_queue(queue* q);
+int strnicmp(const char * cs,const char * ct,size_t count);
+char *strnistr(const char *s, const char *find, size_t slen);
+int within_edit_distance(char *s1, char *s2, int max_edit);
+char** split_on_separators(char* line, char* separators, int num_separators, int max_pieces, int include_remainder_at_max, unsigned long *num_pieces);
+char* trim_flanking_whitespace(char* str);
+void parse_ips_and_ranges(char* addr_str, struct nft_webmon_info *priv);
+
 static void update_queue_node_time(queue_node* update_node, queue* full_queue)
 {
 	struct timespec64 t;
@@ -130,7 +139,7 @@ static void update_queue_node_time(queue_node* update_node, queue* full_queue)
 	}
 }
 
-void add_queue_node(int family, ipany src_ip, char* value, queue* full_queue, string_map* queue_index, char* queue_index_key, uint32_t max_queue_length )
+void add_queue_node(int family, ipany src_ip, char* value, queue* full_queue, string_map* queue_index, char* queue_index_key, uint32_t max_queue_length)
 {
 
 	queue_node *new_node = (queue_node*)kmalloc(sizeof(queue_node), GFP_ATOMIC);
@@ -2164,6 +2173,8 @@ static struct nft_expr_type nft_webmon_type __read_mostly =  {
 
 static int __init init(void)
 {
+	int ret;
+
 	#ifdef CONFIG_PROC_FS
 	//struct proc_dir_entry *proc_webmon_recent_domains;
 	//struct proc_dir_entry *proc_webmon_recent_searches;
@@ -2189,7 +2200,22 @@ static int __init init(void)
 	#endif
 
 	spin_unlock_bh(&webmon_lock);
-	return nft_register_expr(&nft_webmon_type);
+
+	ret = nft_register_expr(&nft_webmon_type);
+	if(ret < 0)
+	{
+		/*
+		 * On nonzero init() return the kernel frees this module's image without ever
+		 * calling fini() -- if we leave these /proc entries registered, their file ops
+		 * keep pointing into memory that no longer exists, and the next read/write of
+		 * webmon_recent_domains or webmon_recent_searches jumps into freed memory.
+		 */
+		#ifdef CONFIG_PROC_FS
+		remove_proc_entry("webmon_recent_domains", NULL);
+		remove_proc_entry("webmon_recent_searches", NULL);
+		#endif
+	}
+	return ret;
 }
 
 static void __exit fini(void)
diff --git a/netfilter-match-modules/nftables/webmon/module/webmon_deps/tree_map.h b/netfilter-match-modules/nftables/webmon/module/nft_webmon_deps/tree_map.h
similarity index 100%
rename from netfilter-match-modules/nftables/webmon/module/webmon_deps/tree_map.h
rename to netfilter-match-modules/nftables/webmon/module/nft_webmon_deps/tree_map.h
diff --git a/netfilter-match-modules/nftables/webmon/nftables/meta b/netfilter-match-modules/nftables/webmon/nftables/meta
index b6a2e03275..72a14fbc49 100644
--- a/netfilter-match-modules/nftables/webmon/nftables/meta
+++ b/netfilter-match-modules/nftables/webmon/nftables/meta
@@ -20,3 +20,4 @@ src_scanner.l.2||insert||before||1||scanner_push_start_cond\(yyscanner, SCANSTAT
 src_statement.c.1||insert||before||2||static void reject_stmt_print||src/statement.c
 include_linux_netfilter_nftables.h.1||insert||after||0||#define NFTA_REJECT_MAX||include/linux/netfilter/nf_tables.h
 include_parser.h.1||insert||after||0||PARSER_SC_STMT_REJECT||include/parser.h
+src_statement.c.2||insert||after||0||case STMT_REJECT: return &reject_stmt_ops;||src/statement.c
diff --git a/netfilter-match-modules/nftables/webmon/nftables/src_statement.c.2 b/netfilter-match-modules/nftables/webmon/nftables/src_statement.c.2
new file mode 100644
index 0000000000..18d207f034
--- /dev/null
+++ b/netfilter-match-modules/nftables/webmon/nftables/src_statement.c.2
@@ -0,0 +1 @@
+	case STMT_WEBMON: return &webmon_stmt_ops;
diff --git a/netfilter-match-modules/nftables/weburl/module/nft_weburl.c b/netfilter-match-modules/nftables/weburl/module/nft_weburl.c
index 436c567201..b8a7115161 100644
--- a/netfilter-match-modules/nftables/weburl/module/nft_weburl.c
+++ b/netfilter-match-modules/nftables/weburl/module/nft_weburl.c
@@ -35,8 +35,8 @@
 #include <net/netfilter/nf_tables.h>
 #include <linux/netfilter/nft_weburl.h>
 
-#include "weburl_deps/regexp.c"
-#include "weburl_deps/tree_map.h"
+#include "nft_weburl_deps/regexp.c"
+#include "nft_weburl_deps/tree_map.h"
 
 
 #include <linux/ip.h>
@@ -55,6 +55,12 @@ static const struct nla_policy nft_weburl_policy[NFTA_WEBURL_MAX + 1] = {
 	[NFTA_WEBURL_MATCH]			= { .type = NLA_STRING, .len = WEBURL_TEXT_SIZE },
 };
 
+int strnicmp(const char * cs,const char * ct,size_t count);
+char *strnistr(const char *s, const char *find, size_t slen);
+int do_match_test(unsigned char match_type, const char* reference, char* query);
+int http_match(const struct nft_weburl_info* priv, const unsigned char* packet_data, int packet_length);
+int https_match(const struct nft_weburl_info* priv, const unsigned char* packet_data, int packet_length);
+
 int strnicmp(const char * cs,const char * ct,size_t count)
 {
 	register signed char __res = 0;
diff --git a/netfilter-match-modules/nftables/weburl/module/weburl_deps/regexp.c b/netfilter-match-modules/nftables/weburl/module/nft_weburl_deps/regexp.c
similarity index 100%
rename from netfilter-match-modules/nftables/weburl/module/weburl_deps/regexp.c
rename to netfilter-match-modules/nftables/weburl/module/nft_weburl_deps/regexp.c
diff --git a/netfilter-match-modules/nftables/weburl/module/weburl_deps/regexp.h b/netfilter-match-modules/nftables/weburl/module/nft_weburl_deps/regexp.h
similarity index 94%
rename from netfilter-match-modules/nftables/weburl/module/weburl_deps/regexp.h
rename to netfilter-match-modules/nftables/weburl/module/nft_weburl_deps/regexp.h
index a72eba71fb..d2cf247c34 100644
--- a/netfilter-match-modules/nftables/weburl/module/weburl_deps/regexp.h
+++ b/netfilter-match-modules/nftables/weburl/module/nft_weburl_deps/regexp.h
@@ -37,5 +37,6 @@ regexp * regcomp(char *exp, int *patternsize);
 int regexec(regexp *prog, char *string);
 void regsub(regexp *prog, char *source, char *dest);
 void regerror(char *s);
+__kernel_size_t my_strcspn(const char *s1,const char *s2);
 
 #endif
diff --git a/netfilter-match-modules/nftables/weburl/module/weburl_deps/regmagic.h b/netfilter-match-modules/nftables/weburl/module/nft_weburl_deps/regmagic.h
similarity index 100%
rename from netfilter-match-modules/nftables/weburl/module/weburl_deps/regmagic.h
rename to netfilter-match-modules/nftables/weburl/module/nft_weburl_deps/regmagic.h
diff --git a/netfilter-match-modules/nftables/weburl/module/weburl_deps/regsub.c b/netfilter-match-modules/nftables/weburl/module/nft_weburl_deps/regsub.c
similarity index 100%
rename from netfilter-match-modules/nftables/weburl/module/weburl_deps/regsub.c
rename to netfilter-match-modules/nftables/weburl/module/nft_weburl_deps/regsub.c
diff --git a/netfilter-match-modules/nftables/weburl/module/weburl_deps/tree_map.h b/netfilter-match-modules/nftables/weburl/module/nft_weburl_deps/tree_map.h
similarity index 100%
rename from netfilter-match-modules/nftables/weburl/module/weburl_deps/tree_map.h
rename to netfilter-match-modules/nftables/weburl/module/nft_weburl_deps/tree_map.h
diff --git a/netfilter-match-modules/nftables/weburl/nftables/meta b/netfilter-match-modules/nftables/weburl/nftables/meta
index b6a2e03275..72a14fbc49 100644
--- a/netfilter-match-modules/nftables/weburl/nftables/meta
+++ b/netfilter-match-modules/nftables/weburl/nftables/meta
@@ -20,3 +20,4 @@ src_scanner.l.2||insert||before||1||scanner_push_start_cond\(yyscanner, SCANSTAT
 src_statement.c.1||insert||before||2||static void reject_stmt_print||src/statement.c
 include_linux_netfilter_nftables.h.1||insert||after||0||#define NFTA_REJECT_MAX||include/linux/netfilter/nf_tables.h
 include_parser.h.1||insert||after||0||PARSER_SC_STMT_REJECT||include/parser.h
+src_statement.c.2||insert||after||0||case STMT_REJECT: return &reject_stmt_ops;||src/statement.c
diff --git a/netfilter-match-modules/nftables/weburl/nftables/src_statement.c.2 b/netfilter-match-modules/nftables/weburl/nftables/src_statement.c.2
new file mode 100644
index 0000000000..4220e24250
--- /dev/null
+++ b/netfilter-match-modules/nftables/weburl/nftables/src_statement.c.2
@@ -0,0 +1 @@
+	case STMT_WEBURL: return &weburl_stmt_ops;
diff --git a/package/gargoyle/src/gargoyle_header_footer.c b/package/gargoyle/src/gargoyle_header_footer.c
index f84e4f97b9..d6fc7b1ce4 100644
--- a/package/gargoyle/src/gargoyle_header_footer.c
+++ b/package/gargoyle/src/gargoyle_header_footer.c
@@ -66,8 +66,8 @@ char* ip6_combine_prefix_hostid(char* ip6, char* hostid);
 json_object* getInterfaceDump(void);
 json_object* getWirelessStatusDump(void);
 void get_ifstatus_ip6addrs(json_object* iface, list* ifstatus_ip6, list* ifstatus_mask6);
-void get_ifstatus_gateway(json_object* iface, char** ifstatus_gateway);
-void get_ifstatus_ipaddrs(json_object* iface, char** ifstatus_ip, char* ifstatus_mask);
+void get_ifstatus_gateway(json_object* iface, const char** ifstatus_gateway);
+void get_ifstatus_ipaddrs(json_object* iface, const char** ifstatus_ip, char* ifstatus_mask);
 
 
 int main(int argc, char **argv)
@@ -975,7 +975,7 @@ void get_ifstatus_ip6addrs(json_object* iface, list* ifstatus_ip6, list* ifstatu
 	}
 }
 
-void get_ifstatus_gateway(json_object* iface, char** ifstatus_gateway)
+void get_ifstatus_gateway(json_object* iface, const char** ifstatus_gateway)
 {
 	struct json_object* tmpobj = NULL;
 	struct json_object* routesarr = NULL;
@@ -1003,7 +1003,7 @@ void get_ifstatus_gateway(json_object* iface, char** ifstatus_gateway)
 	}
 }
 
-void get_ifstatus_ipaddrs(json_object* iface, char** ifstatus_ip, char* ifstatus_mask)
+void get_ifstatus_ipaddrs(json_object* iface, const char** ifstatus_ip, char* ifstatus_mask)
 {
 	struct json_object* tmpobj = NULL;
 	struct json_object* tmpobj2 = NULL;
@@ -1684,7 +1684,7 @@ char* get_interface_gateway(char* if_name, int family)
 									uint8_t* ipptr;
 									sscanf(split_line[2], "%X", &ip);
 									ip = htonl(ip);
-									ipptr = &ip;
+									ipptr = (uint8_t*)&ip;
 									gateway = (char*)malloc(20);
 									sprintf(gateway, "%u.%u.%u.%u", *(ipptr+3), *(ipptr+2), *(ipptr+1), *ipptr);
 								}
diff --git a/package/https-dns-proxy/Makefile b/package/https-dns-proxy/Makefile
index 199230952d..be980ba784 100644
--- a/package/https-dns-proxy/Makefile
+++ b/package/https-dns-proxy/Makefile
@@ -8,7 +8,7 @@ PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/aarond10/https_dns_proxy/
 PKG_SOURCE_DATE:=$(PKG_VERSION)
 PKG_SOURCE_VERSION:=977341a4e35a37ee454e97e82caf4276b1b4961a
-PKG_MIRROR_HASH:=8622846f1038ac05436a48d9b36a07c516cbb6504ce68e7ee8c5529788fac39b
+PKG_MIRROR_HASH:=7387a63120f627d81a75e6049ecb55c0d62f86f21863084a0b1fc473c43790e4
 
 PKG_MAINTAINER:=Michael Gray <support@lantisproject.com>
 PKG_LICENSE:=MIT
diff --git a/package/libbbtargz/Makefile b/package/libbbtargz/Makefile
index 96ce256261..12f014aa18 100644
--- a/package/libbbtargz/Makefile
+++ b/package/libbbtargz/Makefile
@@ -19,6 +19,18 @@ PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)
 
 include $(INCLUDE_DIR)/package.mk
 
+# unarchive.c calls seek_by_read() with no prior prototype (2007-era
+# code, extracted from busybox with the declaration left behind).
+# GCC <= 13 only warned; GCC 14 (first used by this toolchain as of
+# the OpenWrt 25.12 bump) makes implicit function declarations a hard
+# error by default, which breaks this package's build outright. Same
+# root cause and same fix already validated for the host-side gapk
+# dev-loop build (tests/gapk/build-host.sh in gargoyle-tools) --
+# applying the identical, already-proven workaround here rather than
+# attempting to source/restore the real prototype from upstream
+# busybox for 2007-era code neither of us has full context on.
+TARGET_CFLAGS += -std=gnu89 -Wno-implicit-function-declaration
+
 define Package/libbbtargz
 	SECTION:=libs
 	CATEGORY:=Libraries
diff --git a/package/libffi/Makefile b/package/libffi/Makefile
index aba83e22c8..c6bc67516c 100644
--- a/package/libffi/Makefile
+++ b/package/libffi/Makefile
@@ -19,7 +19,17 @@ PKG_LICENSE:=MIT
 PKG_LICENSE_FILES:=LICENSE
 PKG_CPE_ID:=cpe:/a:libffi_project:libffi
 
-PKG_FIXUP:=autoreconf
+# PKG_FIXUP:=autoreconf intentionally NOT set: re-running autoreconf with
+# this toolchain's newer host autoconf/automake (bumped alongside GCC/CMake
+# for the 25.12 base) regenerates libffi's build system with a build-vs-host
+# triplet mismatch (recurses into a "x86_64-pc-linux-musl"-named target that
+# was never actually configured, since the real cross build configured
+# "x86_64-openwrt-linux-gnu" instead) -- "No rule to make target
+# 'all-configured'". libffi 3.4.6's release tarball ships a working,
+# upstream-tested ./configure already; skipping autoreconf avoids the
+# regression entirely and needs no other changes since x86_64 is a
+# long-standard architecture (autoreconf's usual purpose -- refreshing
+# config.sub/config.guess for newer targets -- doesn't apply here).
 PKG_INSTALL:=1
 PKG_BUILD_PARALLEL:=1
 PKG_BUILD_FLAGS:=no-mips16
diff --git a/package/libnftbwctl/src/nft_bwctl.c b/package/libnftbwctl/src/nft_bwctl.c
index 73e6a81608..db1d5e2576 100644
--- a/package/libnftbwctl/src/nft_bwctl.c
+++ b/package/libnftbwctl/src/nft_bwctl.c
@@ -320,7 +320,7 @@ static void parse_returned_ip_data(	void *out_data,
 	*(ip + 1) = *( (uint32_t*)(in_buffer + (*in_index) + 8) );
 	*(ip + 2) = *( (uint32_t*)(in_buffer + (*in_index) + 12) );
 	*(ip + 3) = *( (uint32_t*)(in_buffer + (*in_index) + 16) );
-    ip_bw_kernel_data_item* ip_bw_data = (ip_bw_kernel_data*)(in_buffer + *in_index);
+    ip_bw_kernel_data_item* ip_bw_data = (ip_bw_kernel_data_item*)(in_buffer + *in_index);
 	if(get_history == 0)
 	{
 		(((ip_bw*)out_data)[*out_index]).family = family;
diff --git a/package/mbedtls-clu/Makefile b/package/mbedtls-clu/Makefile
index d57f4acacc..99bc0b9c2f 100644
--- a/package/mbedtls-clu/Makefile
+++ b/package/mbedtls-clu/Makefile
@@ -10,7 +10,7 @@ MAKE_PATH:=src
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=https://github.com/lantis1008/mbedtls-clu.git
-PKG_MIRROR_HASH:=79eef689b7fd1323c69a5c6a3f03e4829181f014c77cdacb5b5a904b42ee34c7
+PKG_MIRROR_HASH:=54875e65da5537088dcd2334381fef0d7111ad30842b16790b391ab66390574e
 
 # Set to 1 to dynamically link libericstools, or 0 to static compile
 DLINK_LIBERICSTOOLS:=1
diff --git a/package/plugin-gargoyle-stamgr/files/usr/lib/gargoyle/gargoyle_stamgr.sh b/package/plugin-gargoyle-stamgr/files/usr/lib/gargoyle/gargoyle_stamgr.sh
index de70eee060..79dece7017 100755
--- a/package/plugin-gargoyle-stamgr/files/usr/lib/gargoyle/gargoyle_stamgr.sh
+++ b/package/plugin-gargoyle-stamgr/files/usr/lib/gargoyle/gargoyle_stamgr.sh
@@ -127,12 +127,35 @@ check_sta()
 	else
 		sta_wlan="${phyname}-sta0"
 	fi
-	wireless_info="$(iwinfo $sta_wlan i 2>/dev/null)"
-	
-	
-	sta_connected="$(echo "$wireless_info" | awk '/ESSID:/ {print $3}; /Channel:/ {print $4};' | grep -v "unknown")"
-	[ -z "$sta_connected" ] && sta_connected=false || sta_connected=true
-	sta_quality="$(echo "$wireless_info" | awk -F "[ ]" '/Link Quality:/{split($NF,var0,"/");printf "%i\n",(var0[1]*100/var0[2])}')"
+	# `iwinfo <iface> info`'s ESSID field is stale under this OpenWrt base:
+	# confirmed live that after a real, verified disconnect (`iw link`
+	# correctly reports "Not connected.", and wpa_supplicant's own
+	# `wpa_cli status` already shows wpa_state=SCANNING), iwinfo info kept
+	# printing the last-associated ESSID unchanged for 150+ seconds, with
+	# only Channel/Signal/Bit Rate degrading to unknown/0 -- and the old
+	# "unknown" substring check below only ever inspected the ESSID and
+	# Channel fields specifically, neither of which actually contains the
+	# literal word "unknown" in this degraded-but-still-"connected"
+	# state (Channel's degraded value prints as "0", not "unknown"), so
+	# it never caught a real disconnect. Query wpa_supplicant's own
+	# kernel-backed link state directly instead -- confirmed reliable in
+	# both directions live (correctly flips to "Not connected." within
+	# one poll of a genuine AP loss, and reports full signal detail
+	# immediately on a fresh real association).
+	link_info="$(iw dev "$sta_wlan" link 2>/dev/null)"
+	if echo "$link_info" | grep -q "^Connected to" ; then
+		sta_connected=true
+		sta_dbm="$(echo "$link_info" | awk '/^[[:space:]]*signal:/ {print $2}')"
+		sta_quality="$(awk -v dbm="${sta_dbm:--110}" 'BEGIN {
+			q = dbm + 110
+			if (q > 70) q = 70
+			if (q < 0) q = 0
+			printf "%i", q * 100 / 70
+		}')"
+	else
+		sta_connected=false
+		sta_quality=0
+	fi
 	sta_ssid="$(uci_get "wireless" "$stacfgsec" "ssid")"
 	sta_bssid="$(uci_get "wireless" "$stacfgsec" "bssid")"
 	sta_encryption="$(uci_get "wireless" "$stacfgsec" "encryption")"
@@ -167,9 +190,72 @@ get_current_active_sta_section()
 get_scan_results()
 {
 	local radios="radio0 radio1"
+	local tmpif="stamgr-tmp0"
 	scan_results=""
 	for radio in $radios ; do
-		scan_list="$(iwinfo $radio s 2>/dev/null | awk -v var4="$radio" 'BEGIN{FS="[[:space:]]"}/Address:/{var1=$NF}/ESSID:/{var2="";for(i=12;i<=NF;i++)if(var2==""){var2=$i}else{var2=var2" "$i};gsub(/,/,".",var2)}/Quality:/{split($NF,var0,"/")}/Encryption:/{if($NF=="none"){var3="+"}else{var3="-"};printf "%i,%s,%s,%s,%s\n",(var0[1]*100/var0[2]),var1,var2,var3,var4}' | sort -rn)"
+		# Use the resolved phy directly, same reasoning and same pattern as
+		# check_sta(): UCI's own radio section name ("radio0") doesn't
+		# reliably match the kernel's actual phy number.
+		phyname="$(iwinfo nl80211 phyname $radio 2>&1)"
+		[ "$phyname" = "Phy not found" ] && continue
+
+		# `iwinfo <iface> scan` is broken outright under this OpenWrt base
+		# (confirmed: fails with "Netlink error while awaiting scan
+		# results: No event received" even on a real, already-up
+		# interface). Separately, when the STA config's own real interface
+		# exists, it's already owned by netifd's global wpa_supplicant
+		# daemon, which refuses a second, externally-triggered scan on the
+		# same vif ("Resource busy"). And when the STA config is
+		# `disabled`, no kernel interface exists for it at all any more
+		# (confirmed live: disabled=1 wifi-iface sections produce zero
+		# interface under this netifd, unlike 24.10) -- there's nothing
+		# for `iwinfo`/`iw` to scan against in the idle case either way.
+		#
+		# Work around all three by scanning through a short-lived,
+		# daemon-independent interface created directly on the phy with
+		# plain `iw`, instead of going through iwinfo or the STA config's
+		# own interface. Verified this works identically whether the phy
+		# is fully idle or already hosts a live, connected STA vif -- a
+		# second vif on the same phy scans without disturbing the first's
+		# association (mac80211/hwsim's own off-channel scan support, the
+		# same mechanism a real STA's background roam-scan already relies
+		# on; a phy already running an AP vif pays the same brief
+		# beacon-interruption cost during the scan that any single-radio
+		# AP+STA repeater setup already accepts today, not a new cost).
+		# Interface name must stay under Linux's 15-char IFNAMSIZ limit.
+		iw dev "$tmpif" del >/dev/null 2>&1
+		iw phy "$phyname" interface add "$tmpif" type station >/dev/null 2>&1 || continue
+		ip link set "$tmpif" up >/dev/null 2>&1
+		sleep 1
+		scan_list="$(iw dev "$tmpif" scan 2>/dev/null | awk -v radio="$radio" '
+			function flush() {
+				if (bssid != "") {
+					enc = has_rsn ? "-" : "+"
+					printf "%i,%s,\"%s\",%s,%s\n", quality, bssid, ssid, enc, radio
+				}
+			}
+			BEGIN { bssid=""; ssid=""; quality=0; has_rsn=0 }
+			/^BSS / {
+				flush()
+				bssid=$2; sub(/\(.*/, "", bssid)
+				ssid=""; quality=0; has_rsn=0
+			}
+			/^\tsignal:/ {
+				q = $2 + 110
+				if (q > 70) q = 70
+				if (q < 0) q = 0
+				quality = int(q * 100 / 70)
+			}
+			/^\tSSID:/ {
+				ssid=$0
+				sub(/^\tSSID: /, "", ssid)
+				gsub(/,/, ".", ssid)
+			}
+			/^\tRSN:/ || /^\tWPA:/ { has_rsn=1 }
+			END { flush() }
+		' | sort -rn)"
+		iw dev "$tmpif" del >/dev/null 2>&1
+
 		if [ -z "${scan_results}" ] ; then
 			scan_results="$scan_list"
 		else
diff --git a/package/qos-gargoyle/src/qosmon.c b/package/qos-gargoyle/src/qosmon.c
index 1207b48b89..a071ffde51 100644
--- a/package/qos-gargoyle/src/qosmon.c
+++ b/package/qos-gargoyle/src/qosmon.c
@@ -422,9 +422,13 @@ char pr_pack( void *buf, int cc, struct sockaddr_storage *from )
 
 }
 
-//These variables referenced but not used by the tc code we link to.
+//This variable is referenced but not used by the tc code we link to.
 int filter_ifindex;
-int use_iec = 0;
+//use_iec is also referenced by the tc code, but iproute2's own utils.c
+//(pulled in via libutil.a) already defines it -- GCC 14's default
+//-fno-common turns the previously-harmless duplicate tentative
+//definition into a hard "multiple definition" link error, so rely on
+//utils.h's extern declaration instead of redefining it here.
 
 
 int print_class(struct nlmsghdr *n, void *arg)
diff --git a/package/samba36/Makefile b/package/samba36/Makefile
index 1953d9dea1..72ef81a9ad 100644
--- a/package/samba36/Makefile
+++ b/package/samba36/Makefile
@@ -87,6 +87,7 @@ CONFIGURE_VARS += \
 	libreplace_cv_HAVE_C99_VSNPRINTF=yes \
 	libreplace_cv_HAVE_GETADDRINFO=yes \
 	libreplace_cv_HAVE_IFACE_IFCONF=yes \
+	libreplace_cv_mkdir_has_mode=yes \
 	$(if $(CONFIG_IPV6),,libreplace_cv_HAVE_IPV6=no libreplace_cv_HAVE_IPV6_V6ONLY=no) \
 	LINUX_LFS_SUPPORT=yes \
 	samba_cv_CC_NEGATIVE_ENUM_VALUES=yes \
diff --git a/package/samba36/patches/111-owrt_smbpasswd.patch b/package/samba36/patches/111-owrt_smbpasswd.patch
index 40b34e9a77..8a6e40f35e 100644
--- a/package/samba36/patches/111-owrt_smbpasswd.patch
+++ b/package/samba36/patches/111-owrt_smbpasswd.patch
@@ -29,7 +29,7 @@
  MULTICALL_O = $(sort $(SMBD_MULTI_O) $(NMBD_MULTI_O) $(SMBPASSWD_MULTI_O) $(MULTI_O))
 --- /dev/null
 +++ b/source3/utils/owrt_smbpasswd.c
-@@ -0,0 +1,249 @@
+@@ -0,0 +1,250 @@
 +/*
 + * Copyright (C) 2012 Felix Fietkau <nbd@nbd.name>
 + * Copyright (C) 2008 John Crispin <blogic@openwrt.org>
@@ -49,6 +49,7 @@
 + * Mass Ave, Cambridge, MA 02139, USA.  */
 +
 +#include "includes.h"
++#include "../lib/crypto/md4.h"
 +#include <endian.h>
 +#include <stdio.h>
 +
diff --git a/package/zip/Makefile b/package/zip/Makefile
index ed1c83f42c..21a2f961af 100644
--- a/package/zip/Makefile
+++ b/package/zip/Makefile
@@ -41,12 +41,40 @@ define Package/zip/description
 	but the methods differ.
 endef
 
-MAKE_FLAGS += \
-	-f unix/Makefile generic \
-		prefix="$(PKG_INSTALL_DIR)/usr" \
-		CFLAGS="$(TARGET_CFLAGS)" \
+# The stock "generic" target's unix/configure runs feature-detection
+# probes that try to compile+link+run tiny test programs -- impossible
+# under cross-compilation, so every probe silently assumes the worst
+# and falls back to a batch of "-DNO_*"/"-DZMEM" defines that select
+# zip's own bundled, K&R-style fallback implementations (of memset,
+# mktime, etc, each guarded by a hand-written prototype in zip.h/
+# timezone.c that assumes no real ANSI <string.h>/<time.h> exists).
+# musl provides working, ANSI-conformant versions of every one of these
+# (memset/memcpy/memcmp, rmdir, strchr/strrchr, rename, mktemp/mkstemp/
+# mktime, errno, dirent, valloc), so every one of these defines is, and
+# always has been, a false positive for this cross build -- GCC <= 13
+# only warned about the resulting prototype conflicts/incomplete-type
+# uses; GCC 14 (first used by this toolchain, 25.12) makes them hard
+# errors. Split configure and build into two steps so the generated
+# flags file can have the whole false-positive batch stripped in
+# between, instead of patching zip's own 2008-era unix/Makefile or
+# unix/configure, or whack-a-moling one -DNO_* at a time as each newly
+# becomes a hard error.
+define Build/Compile
+	$(MAKE) -C $(PKG_BUILD_DIR) \
+		-f unix/Makefile flags \
 		CC="$(TARGET_CC) $(TARGET_CFLAGS) -O $(TARGET_CPPFLAGS) -I. -DUNIX $(TARGET_LDFLAGS)" \
 		IZ_BZIP2="no"
+	sed -i -E 's/-D(NO_[A-Z0-9_]+|ZMEM)//g' $(PKG_BUILD_DIR)/flags
+	cd $(PKG_BUILD_DIR); eval $(MAKE) -f unix/Makefile zips `cat $(PKG_BUILD_DIR)/flags` \
+		prefix="$(PKG_INSTALL_DIR)/usr" \
+		IZ_BZIP2="no"
+endef
+
+define Build/Install
+	$(MAKE) -C $(PKG_BUILD_DIR) \
+		-f unix/Makefile install \
+		prefix="$(PKG_INSTALL_DIR)/usr"
+endef
 
 define Package/zip/install
 	$(INSTALL_DIR) $(1)/usr/bin/
diff --git a/patches-generic/004-fix_postinst_prerm_scripts.patch b/patches-generic/004-fix_postinst_prerm_scripts.patch
index 40e1d35ca6..a0bfcb101d 100644
--- a/patches-generic/004-fix_postinst_prerm_scripts.patch
+++ b/patches-generic/004-fix_postinst_prerm_scripts.patch
@@ -1,6 +1,6 @@
 --- a/package/base-files/files/lib/functions.sh
 +++ b/package/base-files/files/lib/functions.sh
-@@ -213,16 +213,19 @@ default_prerm() {
+@@ -220,6 +220,7 @@
  	local root="${IPKG_INSTROOT}"
  	[ -z "$pkgname" ] && local pkgname="$(basename ${1%.*})"
  	local ret=0
@@ -8,6 +8,10 @@
  	local filelist="${root}/usr/lib/opkg/info/${pkgname}.list"
  	[ -f "$root/lib/apk/packages/${pkgname}.list" ] && filelist="$root/lib/apk/packages/${pkgname}.list"
  
+@@ -227,13 +228,15 @@
+ 		update_alternatives remove "${pkgname}"
+ 	fi
+ 
 -	if [ -f "$root/usr/lib/opkg/info/${pkgname}.prerm-pkg" ]; then
 -		( . "$root/usr/lib/opkg/info/${pkgname}.prerm-pkg" )
 +	pkg_prerm="${1}-pkg"
@@ -23,7 +27,7 @@
  		if [ -n "$root" ]; then
  			${shell:-/bin/sh} "$root/etc/rc.common" "$root$i" disable
  		else
-@@ -238,7 +241,8 @@ default_prerm() {
+@@ -249,7 +252,8 @@
  
  add_group_and_user() {
  	[ -z "$pkgname" ] && local pkgname="$(basename ${1%.*})"
@@ -33,7 +37,7 @@
  	if [ -f "$root/lib/apk/packages/${pkgname}.rusers" ]; then
  		local rusers="$(cat $root/lib/apk/packages/${pkgname}.rusers)"
  	fi
-@@ -347,9 +351,18 @@ default_postinst() {
+@@ -358,9 +362,18 @@
  	[ -f "$root/lib/apk/packages/${pkgname}.list" ] && filelist="$root/lib/apk/packages/${pkgname}.list"
  	local ret=0
  
@@ -52,8 +56,8 @@
 +		add_group_and_user "${pkg_control}"
  	fi
  
- 	if [ -e "${root}/lib/apk/packages/${pkgname}.list" ]; then
-@@ -363,17 +376,17 @@ default_postinst() {
+ 	if [ -e "${root}/lib/apk/packages/${pkgname}.alternatives" ]; then
+@@ -373,17 +386,17 @@
  	fi
  
  	if [ -z "$root" ]; then
@@ -75,8 +79,8 @@
  				( [ -f "$i" ] && cd "$(dirname $i)" && . "$i" ) && rm -f "$i"
  			done
  			uci commit
-@@ -382,13 +395,13 @@ default_postinst() {
- 		rm -f /tmp/luci-indexcache
+@@ -392,13 +405,13 @@
+ 		rm -f /tmp/luci-indexcache.*
  	fi
  
 -	if [ -f "$root/usr/lib/opkg/info/${pkgname}.postinst-pkg" ]; then
diff --git a/patches-generic/023-nftables-remove-patch-files.patch b/patches-generic/023-nftables-remove-patch-files.patch
deleted file mode 100644
index 881db4abd3..0000000000
--- a/patches-generic/023-nftables-remove-patch-files.patch
+++ /dev/null
@@ -1,21 +0,0 @@
---- /dev/null
-+++ b/package/network/utils/nftables/patches/001-remove-patch-files.patch
-@@ -0,0 +1,18 @@
-+--- a/tests/shell/run-tests.sh.rej
-++++ /dev/null
-+@@ -1,15 +0,0 @@
-+---- run-tests.sh
-+-+++ run-tests.sh
-+-@@ -565,11 +565,8 @@ feature_probe()
-+- 	fi
-+- 
-+- 	if [ -x "$with_path.sh" ] ; then
-+--		echo $with_path
-+- 		NFT="$NFT_REAL" $NFT_TEST_UNSHARE_CMD "$with_path.sh" &>/dev/null
-+--		RET=$?
-+--		echo $?
-+--		return $RET
-+-+		return $?
-+- 	fi
-+- 
-+- 	return 1
diff --git a/patches-generic/024-backport_nftables_bitwise_mask_xor.patch b/patches-generic/024-backport_nftables_bitwise_mask_xor.patch
deleted file mode 100644
index 2d36b1c651..0000000000
--- a/patches-generic/024-backport_nftables_bitwise_mask_xor.patch
+++ /dev/null
@@ -1,1403 +0,0 @@
---- /dev/null
-+++ b/package/libs/libnftnl/patches/001-include_add_new_bitwise_bool_attr_to_nftables_h.patch
-@@ -0,0 +1,67 @@
-+From 12bd1aea5233da4f20c19e4c7e6c4ff961185ea1 Mon Sep 17 00:00:00 2001
-+From: Jeremy Sowden <jeremy@azazel.net>
-+Date: Wed, 13 Nov 2024 22:25:47 +0100
-+Subject: include: add new bitwise boolean attributes to nf_tables.h
-+
-+The kernel now has native support for AND, OR and XOR bitwise
-+operations.
-+
-+Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
-+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-+---
-+ include/linux/netfilter/nf_tables.h | 18 +++++++++++++++---
-+ 1 file changed, 15 insertions(+), 3 deletions(-)
-+
-+diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h
-+index 9e90793..49c944e 100644
-+--- a/include/linux/netfilter/nf_tables.h
-++++ b/include/linux/netfilter/nf_tables.h
-+@@ -564,16 +564,26 @@ enum nft_immediate_attributes {
-+ /**
-+  * enum nft_bitwise_ops - nf_tables bitwise operations
-+  *
-+- * @NFT_BITWISE_BOOL: mask-and-xor operation used to implement NOT, AND, OR and
-+- *                    XOR boolean operations
-++ * @NFT_BITWISE_MASK_XOR: mask-and-xor operation used to implement NOT, AND, OR
-++ *                        and XOR boolean operations
-+  * @NFT_BITWISE_LSHIFT: left-shift operation
-+  * @NFT_BITWISE_RSHIFT: right-shift operation
-++ * @NFT_BITWISE_AND: and operation
-++ * @NFT_BITWISE_OR: or operation
-++ * @NFT_BITWISE_XOR: xor operation
-+  */
-+ enum nft_bitwise_ops {
-+-	NFT_BITWISE_BOOL,
-++	NFT_BITWISE_MASK_XOR,
-+ 	NFT_BITWISE_LSHIFT,
-+ 	NFT_BITWISE_RSHIFT,
-++	NFT_BITWISE_AND,
-++	NFT_BITWISE_OR,
-++	NFT_BITWISE_XOR,
-+ };
-++/*
-++ * Old name for NFT_BITWISE_MASK_XOR.  Retained for backwards-compatibility.
-++ */
-++#define NFT_BITWISE_BOOL NFT_BITWISE_MASK_XOR
-+ 
-+ /**
-+  * enum nft_bitwise_attributes - nf_tables bitwise expression netlink attributes
-+@@ -586,6 +596,7 @@ enum nft_bitwise_ops {
-+  * @NFTA_BITWISE_OP: type of operation (NLA_U32: nft_bitwise_ops)
-+  * @NFTA_BITWISE_DATA: argument for non-boolean operations
-+  *                     (NLA_NESTED: nft_data_attributes)
-++ * @NFTA_BITWISE_SREG2: second source register (NLA_U32: nft_registers)
-+  *
-+  * The bitwise expression supports boolean and shift operations.  It implements
-+  * the boolean operations by performing the following operation:
-+@@ -609,6 +620,7 @@ enum nft_bitwise_attributes {
-+ 	NFTA_BITWISE_XOR,
-+ 	NFTA_BITWISE_OP,
-+ 	NFTA_BITWISE_DATA,
-++	NFTA_BITWISE_SREG2,
-+ 	__NFTA_BITWISE_MAX
-+ };
-+ #define NFTA_BITWISE_MAX	(__NFTA_BITWISE_MAX - 1)
-+-- 
-+cgit v1.2.3
-+
---- /dev/null
-+++ b/package/libs/libnftnl/patches/002-expr_bitwise_rename_boolean_ops_funcs.patch
-@@ -0,0 +1,153 @@
-+From 638b687979befc4e2b22b92c6830ccc9bdcf41fb Mon Sep 17 00:00:00 2001
-+From: Jeremy Sowden <jeremy@azazel.net>
-+Date: Wed, 13 Nov 2024 22:39:12 +0100
-+Subject: expr: bitwise: rename some boolean operation functions
-+
-+In the next patch we add support for doing AND, OR and XOR operations
-+directly in the kernel, so rename some functions and an enum constant
-+related to mask-and-xor boolean operations.
-+
-+Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
-+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-+---
-+ src/expr/bitwise.c            |  8 ++++----
-+ tests/nft-expr_bitwise-test.c | 34 +++++++++++++++++-----------------
-+ 2 files changed, 21 insertions(+), 21 deletions(-)
-+
-+diff --git a/src/expr/bitwise.c b/src/expr/bitwise.c
-+index 1a945e9..9385219 100644
-+--- a/src/expr/bitwise.c
-++++ b/src/expr/bitwise.c
-+@@ -198,8 +198,8 @@ nftnl_expr_bitwise_parse(struct nftnl_expr *e, struct nlattr *attr)
-+ }
-+ 
-+ static int
-+-nftnl_expr_bitwise_snprintf_bool(char *buf, size_t remain,
-+-				 const struct nftnl_expr_bitwise *bitwise)
-++nftnl_expr_bitwise_snprintf_mask_xor(char *buf, size_t remain,
-++				     const struct nftnl_expr_bitwise *bitwise)
-+ {
-+ 	int offset = 0, ret;
-+ 
-+@@ -248,8 +248,8 @@ nftnl_expr_bitwise_snprintf(char *buf, size_t size,
-+ 	int err = -1;
-+ 
-+ 	switch (bitwise->op) {
-+-	case NFT_BITWISE_BOOL:
-+-		err = nftnl_expr_bitwise_snprintf_bool(buf, size, bitwise);
-++	case NFT_BITWISE_MASK_XOR:
-++		err = nftnl_expr_bitwise_snprintf_mask_xor(buf, size, bitwise);
-+ 		break;
-+ 	case NFT_BITWISE_LSHIFT:
-+ 		err = nftnl_expr_bitwise_snprintf_shift(buf, size, "<<", bitwise);
-+diff --git a/tests/nft-expr_bitwise-test.c b/tests/nft-expr_bitwise-test.c
-+index d98569c..04bf95c 100644
-+--- a/tests/nft-expr_bitwise-test.c
-++++ b/tests/nft-expr_bitwise-test.c
-+@@ -22,32 +22,32 @@ static void print_err(const char *test, const char *msg)
-+ 	printf("\033[31mERROR:\e[0m [%s] %s\n", test, msg);
-+ }
-+ 
-+-static void cmp_nftnl_expr_bool(struct nftnl_expr *rule_a,
-+-				struct nftnl_expr *rule_b)
-++static void cmp_nftnl_expr_mask_xor(struct nftnl_expr *rule_a,
-++				    struct nftnl_expr *rule_b)
-+ {
-+ 	uint32_t maska, maskb;
-+ 	uint32_t xora, xorb;
-+ 
-+ 	if (nftnl_expr_get_u32(rule_a, NFTNL_EXPR_BITWISE_DREG) !=
-+ 	    nftnl_expr_get_u32(rule_b, NFTNL_EXPR_BITWISE_DREG))
-+-		print_err("bool", "Expr BITWISE_DREG mismatches");
-++		print_err("mask & xor", "Expr BITWISE_DREG mismatches");
-+ 	if (nftnl_expr_get_u32(rule_a, NFTNL_EXPR_BITWISE_SREG) !=
-+ 	    nftnl_expr_get_u32(rule_b, NFTNL_EXPR_BITWISE_SREG))
-+-		print_err("bool", "Expr BITWISE_SREG mismatches");
-++		print_err("mask & xor", "Expr BITWISE_SREG mismatches");
-+ 	if (nftnl_expr_get_u32(rule_a, NFTNL_EXPR_BITWISE_OP) !=
-+ 	    nftnl_expr_get_u32(rule_b, NFTNL_EXPR_BITWISE_OP))
-+-		print_err("bool", "Expr BITWISE_OP mismatches");
-++		print_err("mask & xor", "Expr BITWISE_OP mismatches");
-+ 	if (nftnl_expr_get_u16(rule_a, NFTNL_EXPR_BITWISE_LEN) !=
-+ 	    nftnl_expr_get_u16(rule_b, NFTNL_EXPR_BITWISE_LEN))
-+-		print_err("bool", "Expr BITWISE_LEN mismatches");
-++		print_err("mask & xor", "Expr BITWISE_LEN mismatches");
-+ 	nftnl_expr_get(rule_a, NFTNL_EXPR_BITWISE_MASK, &maska);
-+ 	nftnl_expr_get(rule_b, NFTNL_EXPR_BITWISE_MASK, &maskb);
-+ 	if (maska != maskb)
-+-		print_err("bool", "Size of BITWISE_MASK mismatches");
-++		print_err("mask & xor", "Size of BITWISE_MASK mismatches");
-+ 	nftnl_expr_get(rule_a, NFTNL_EXPR_BITWISE_XOR, &xora);
-+ 	nftnl_expr_get(rule_b, NFTNL_EXPR_BITWISE_XOR, &xorb);
-+ 	if (xora != xorb)
-+-		print_err("bool", "Size of BITWISE_XOR mismatches");
-++		print_err("mask & xor", "Size of BITWISE_XOR mismatches");
-+ }
-+ 
-+ static void cmp_nftnl_expr_lshift(struct nftnl_expr *rule_a,
-+@@ -96,7 +96,7 @@ static void cmp_nftnl_expr_rshift(struct nftnl_expr *rule_a,
-+ 		print_err("rshift", "Expr BITWISE_DATA mismatches");
-+ }
-+ 
-+-static void test_bool(void)
-++static void test_mask_xor(void)
-+ {
-+ 	struct nftnl_rule *a, *b = NULL;
-+ 	struct nftnl_expr *ex = NULL;
-+@@ -110,10 +110,10 @@ static void test_bool(void)
-+ 	a = nftnl_rule_alloc();
-+ 	b = nftnl_rule_alloc();
-+ 	if (a == NULL || b == NULL)
-+-		print_err("bool", "OOM");
-++		print_err("mask & xor", "OOM");
-+ 	ex = nftnl_expr_alloc("bitwise");
-+ 	if (ex == NULL)
-+-		print_err("bool", "OOM");
-++		print_err("mask & xor", "OOM");
-+ 
-+ 	nftnl_expr_set_u32(ex, NFTNL_EXPR_BITWISE_SREG, 0x12345678);
-+ 	nftnl_expr_set_u32(ex, NFTNL_EXPR_BITWISE_DREG, 0x78123456);
-+@@ -128,26 +128,26 @@ static void test_bool(void)
-+ 	nftnl_rule_nlmsg_build_payload(nlh, a);
-+ 
-+ 	if (nftnl_rule_nlmsg_parse(nlh, b) < 0)
-+-		print_err("bool", "parsing problems");
-++		print_err("mask & xor", "parsing problems");
-+ 
-+ 	iter_a = nftnl_expr_iter_create(a);
-+ 	iter_b = nftnl_expr_iter_create(b);
-+ 	if (iter_a == NULL || iter_b == NULL)
-+-		print_err("bool", "OOM");
-++		print_err("mask & xor", "OOM");
-+ 
-+ 	rule_a = nftnl_expr_iter_next(iter_a);
-+ 	rule_b = nftnl_expr_iter_next(iter_b);
-+ 	if (rule_a == NULL || rule_b == NULL)
-+-		print_err("bool", "OOM");
-++		print_err("mask & xor", "OOM");
-+ 
-+ 	if (nftnl_expr_iter_next(iter_a) != NULL ||
-+ 	    nftnl_expr_iter_next(iter_b) != NULL)
-+-		print_err("bool", "More 1 expr.");
-++		print_err("mask & xor", "More 1 expr.");
-+ 
-+ 	nftnl_expr_iter_destroy(iter_a);
-+ 	nftnl_expr_iter_destroy(iter_b);
-+ 
-+-	cmp_nftnl_expr_bool(rule_a,rule_b);
-++	cmp_nftnl_expr_mask_xor(rule_a,rule_b);
-+ 
-+ 	nftnl_rule_free(a);
-+ 	nftnl_rule_free(b);
-+@@ -263,7 +263,7 @@ static void test_rshift(void)
-+ 
-+ int main(int argc, char *argv[])
-+ {
-+-	test_bool();
-++	test_mask_xor();
-+ 	if (!test_ok)
-+ 		exit(EXIT_FAILURE);
-+ 
-+-- 
-+cgit v1.2.3
-+
---- /dev/null
-+++ b/package/libs/libnftnl/patches/003-expr_bitwise_add_support_kernel_and_or_xor_ops.patch
-@@ -0,0 +1,158 @@
-+From f683f636a0aa8b121a9153c96cf5ca3f8e76faa5 Mon Sep 17 00:00:00 2001
-+From: Jeremy Sowden <jeremy@azazel.net>
-+Date: Wed, 13 Nov 2024 22:27:08 +0100
-+Subject: expr: bitwise: add support for kernel space AND, OR and XOR
-+ operations
-+
-+Hitherto, the kernel has only supported boolean operations of the form:
-+
-+  dst = (src & mask) ^ xor
-+
-+where `src` is held in a register, and `mask` and `xor` are immediate
-+values.  User space has converted AND, OR and XOR operations to this
-+form, and so one operand has had to be immediate.  The kernel now
-+supports performing AND, OR and XOR operations directly, on one register
-+and an immediate value or on two registers, so we make that support
-+available to user space.
-+
-+Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
-+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-+---
-+ include/libnftnl/expr.h |  1 +
-+ src/expr/bitwise.c      | 57 +++++++++++++++++++++++++++++++++++++++++++++++--
-+ 2 files changed, 56 insertions(+), 2 deletions(-)
-+
-+diff --git a/include/libnftnl/expr.h b/include/libnftnl/expr.h
-+index fba1210..1c07b54 100644
-+--- a/include/libnftnl/expr.h
-++++ b/include/libnftnl/expr.h
-+@@ -139,6 +139,7 @@ enum {
-+ 	NFTNL_EXPR_BITWISE_XOR,
-+ 	NFTNL_EXPR_BITWISE_OP,
-+ 	NFTNL_EXPR_BITWISE_DATA,
-++	NFTNL_EXPR_BITWISE_SREG2,
-+ 	__NFTNL_EXPR_BITWISE_MAX
-+ };
-+ 
-+diff --git a/src/expr/bitwise.c b/src/expr/bitwise.c
-+index 9385219..cac47a5 100644
-+--- a/src/expr/bitwise.c
-++++ b/src/expr/bitwise.c
-+@@ -19,6 +19,7 @@
-+ 
-+ struct nftnl_expr_bitwise {
-+ 	enum nft_registers	sreg;
-++	enum nft_registers	sreg2;
-+ 	enum nft_registers	dreg;
-+ 	enum nft_bitwise_ops	op;
-+ 	unsigned int		len;
-+@@ -37,6 +38,9 @@ nftnl_expr_bitwise_set(struct nftnl_expr *e, uint16_t type,
-+ 	case NFTNL_EXPR_BITWISE_SREG:
-+ 		memcpy(&bitwise->sreg, data, data_len);
-+ 		break;
-++	case NFTNL_EXPR_BITWISE_SREG2:
-++		memcpy(&bitwise->sreg2, data, sizeof(bitwise->sreg2));
-++		break;
-+ 	case NFTNL_EXPR_BITWISE_DREG:
-+ 		memcpy(&bitwise->dreg, data, data_len);
-+ 		break;
-+@@ -66,6 +70,9 @@ nftnl_expr_bitwise_get(const struct nftnl_expr *e, uint16_t type,
-+ 	case NFTNL_EXPR_BITWISE_SREG:
-+ 		*data_len = sizeof(bitwise->sreg);
-+ 		return &bitwise->sreg;
-++	case NFTNL_EXPR_BITWISE_SREG2:
-++		*data_len = sizeof(bitwise->sreg2);
-++		return &bitwise->sreg2;
-+ 	case NFTNL_EXPR_BITWISE_DREG:
-+ 		*data_len = sizeof(bitwise->dreg);
-+ 		return &bitwise->dreg;
-+@@ -98,6 +105,7 @@ static int nftnl_expr_bitwise_cb(const struct nlattr *attr, void *data)
-+ 
-+ 	switch(type) {
-+ 	case NFTA_BITWISE_SREG:
-++	case NFTA_BITWISE_SREG2:
-+ 	case NFTA_BITWISE_DREG:
-+ 	case NFTA_BITWISE_OP:
-+ 	case NFTA_BITWISE_LEN:
-+@@ -123,6 +131,8 @@ nftnl_expr_bitwise_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
-+ 
-+ 	if (e->flags & (1 << NFTNL_EXPR_BITWISE_SREG))
-+ 		mnl_attr_put_u32(nlh, NFTA_BITWISE_SREG, htonl(bitwise->sreg));
-++	if (e->flags & (1 << NFTNL_EXPR_BITWISE_SREG2))
-++		mnl_attr_put_u32(nlh, NFTA_BITWISE_SREG2, htonl(bitwise->sreg2));
-+ 	if (e->flags & (1 << NFTNL_EXPR_BITWISE_DREG))
-+ 		mnl_attr_put_u32(nlh, NFTA_BITWISE_DREG, htonl(bitwise->dreg));
-+ 	if (e->flags & (1 << NFTNL_EXPR_BITWISE_OP))
-+@@ -169,6 +179,10 @@ nftnl_expr_bitwise_parse(struct nftnl_expr *e, struct nlattr *attr)
-+ 		bitwise->sreg = ntohl(mnl_attr_get_u32(tb[NFTA_BITWISE_SREG]));
-+ 		e->flags |= (1 << NFTNL_EXPR_BITWISE_SREG);
-+ 	}
-++	if (tb[NFTA_BITWISE_SREG2]) {
-++		bitwise->sreg2 = ntohl(mnl_attr_get_u32(tb[NFTA_BITWISE_SREG2]));
-++		e->flags |= (1 << NFTNL_EXPR_BITWISE_SREG2);
-++	}
-+ 	if (tb[NFTA_BITWISE_DREG]) {
-+ 		bitwise->dreg = ntohl(mnl_attr_get_u32(tb[NFTA_BITWISE_DREG]));
-+ 		e->flags |= (1 << NFTNL_EXPR_BITWISE_DREG);
-+@@ -240,6 +254,31 @@ nftnl_expr_bitwise_snprintf_shift(char *buf, size_t remain, const char *op,
-+ 	return offset;
-+ }
-+ 
-++static int
-++nftnl_expr_bitwise_snprintf_bool(char *buf, size_t remain, const char *op,
-++				 const struct nftnl_expr *e,
-++				 const struct nftnl_expr_bitwise *bitwise)
-++{
-++	int offset = 0, ret;
-++
-++	ret = snprintf(buf, remain, "reg %u = ( reg %u %s ",
-++		       bitwise->dreg, bitwise->sreg, op);
-++	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
-++
-++	if (e->flags & (1 << NFTNL_EXPR_BITWISE_SREG2))
-++		ret = snprintf(buf + offset, remain, "reg %u ", bitwise->sreg2);
-++	else
-++		ret = nftnl_data_reg_snprintf(buf + offset, remain,
-++					      &bitwise->data,
-++					      0, DATA_VALUE);
-++	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
-++
-++	ret = snprintf(buf + offset, remain, ") ");
-++	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
-++
-++	return offset;
-++}
-++
-+ static int
-+ nftnl_expr_bitwise_snprintf(char *buf, size_t size,
-+ 			    uint32_t flags, const struct nftnl_expr *e)
-+@@ -252,10 +291,24 @@ nftnl_expr_bitwise_snprintf(char *buf, size_t size,
-+ 		err = nftnl_expr_bitwise_snprintf_mask_xor(buf, size, bitwise);
-+ 		break;
-+ 	case NFT_BITWISE_LSHIFT:
-+-		err = nftnl_expr_bitwise_snprintf_shift(buf, size, "<<", bitwise);
-++		err = nftnl_expr_bitwise_snprintf_shift(buf, size, "<<",
-++							bitwise);
-+ 		break;
-+ 	case NFT_BITWISE_RSHIFT:
-+-		err = nftnl_expr_bitwise_snprintf_shift(buf, size, ">>", bitwise);
-++		err = nftnl_expr_bitwise_snprintf_shift(buf, size, ">>",
-++							bitwise);
-++		break;
-++	case NFT_BITWISE_AND:
-++		err = nftnl_expr_bitwise_snprintf_bool(buf, size, "&", e,
-++						       bitwise);
-++		break;
-++	case NFT_BITWISE_OR:
-++		err = nftnl_expr_bitwise_snprintf_bool(buf, size, "|", e,
-++						       bitwise);
-++		break;
-++	case NFT_BITWISE_XOR:
-++		err = nftnl_expr_bitwise_snprintf_bool(buf, size, "^", e,
-++						       bitwise);
-+ 		break;
-+ 	}
-+ 
-+-- 
-+cgit v1.2.3
-+
---- /dev/null
-+++ b/package/network/utils/nftables/patches/002-allow_binop_expr_variable_rhs_operands.patch
-@@ -0,0 +1,1013 @@
-+From 54bfc38c522babe709e951f1fd128ff725b36704 Mon Sep 17 00:00:00 2001
-+From: Jeremy Sowden <jeremy@azazel.net>
-+Date: Tue, 19 Nov 2024 00:18:28 +0100
-+Subject: src: allow binop expressions with variable right-hand operands
-+
-+Hitherto, the kernel has required constant values for the `xor` and
-+`mask` attributes of boolean bitwise expressions.  This has meant that
-+the right-hand operand of a boolean binop must be constant.  Now the
-+kernel has support for AND, OR and XOR operations with right-hand
-+operands passed via registers, we can relax this restriction.  Allow
-+non-constant right-hand operands if the left-hand operand is not
-+constant, e.g.:
-+
-+  ct mark & 0xffff0000 | meta mark & 0xffff
-+
-+The kernel now supports performing AND, OR and XOR operations directly,
-+on one register and an immediate value or on two registers, so we need
-+to be able to generate and parse bitwise boolean expressions of this
-+form.
-+
-+If a boolean operation has a constant RHS, we continue to send a
-+mask-and-xor expression to the kernel.
-+
-+Add tests for {ct,meta} mark with variable RHS operands.
-+
-+JSON support is also included.
-+
-+This requires Linux kernel >= 6.13-rc.
-+
-+[ Originally posted as patch 1/8 and 6/8 which has been collapsed and
-+  simplified to focus on initial {ct,meta} mark support. Tests have
-+  been extracted from 8/8 including a tests/py fix to payload output
-+  due to incorrect output in original patchset. JSON support has been
-+  extracted from patch 7/8 --pablo]
-+
-+Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
-+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-+---
-+ include/linux/netfilter/nf_tables.h                | 19 ++++++-
-+ src/evaluate.c                                     | 52 ++++++++++++------
-+ src/netlink_delinearize.c                          | 64 +++++++++++++++++-----
-+ src/netlink_linearize.c                            | 61 +++++++++++++++++----
-+ src/parser_json.c                                  |  4 +-
-+ tests/py/any/ct.t                                  |  3 +
-+ tests/py/any/ct.t.json                             | 60 ++++++++++++++++++++
-+ tests/py/any/ct.t.payload                          | 15 +++++
-+ tests/py/inet/meta.t                               |  2 +
-+ tests/py/inet/meta.t.json                          | 37 +++++++++++++
-+ tests/py/inet/meta.t.payload                       |  9 +++
-+ tests/py/ip/ct.t                                   |  2 +
-+ tests/py/ip/ct.t.json                              | 32 +++++++++++
-+ tests/py/ip/ct.t.payload                           | 11 ++++
-+ tests/py/ip6/ct.t                                  |  1 +
-+ tests/py/ip6/ct.t.json                             | 32 +++++++++++
-+ tests/py/ip6/ct.t.payload                          | 12 ++++
-+ tests/shell/features/bitwise_multireg.nft          |  5 ++
-+ tests/shell/testcases/bitwise/0040mark_binop_10    | 13 +++++
-+ tests/shell/testcases/bitwise/0040mark_binop_11    | 13 +++++
-+ tests/shell/testcases/bitwise/0040mark_binop_12    | 13 +++++
-+ tests/shell/testcases/bitwise/0040mark_binop_13    | 13 +++++
-+ tests/shell/testcases/bitwise/0044payload_binop_2  | 13 +++++
-+ tests/shell/testcases/bitwise/0044payload_binop_5  | 13 +++++
-+ .../testcases/bitwise/dumps/0040mark_binop_10.nft  |  6 ++
-+ .../testcases/bitwise/dumps/0040mark_binop_11.nft  |  6 ++
-+ .../testcases/bitwise/dumps/0040mark_binop_12.nft  |  6 ++
-+ .../testcases/bitwise/dumps/0040mark_binop_13.nft  |  6 ++
-+ .../bitwise/dumps/0044payload_binop_2.nft          |  6 ++
-+ .../bitwise/dumps/0044payload_binop_5.nft          |  6 ++
-+ 30 files changed, 489 insertions(+), 46 deletions(-)
-+ create mode 100644 tests/shell/features/bitwise_multireg.nft
-+ create mode 100755 tests/shell/testcases/bitwise/0040mark_binop_10
-+ create mode 100755 tests/shell/testcases/bitwise/0040mark_binop_11
-+ create mode 100755 tests/shell/testcases/bitwise/0040mark_binop_12
-+ create mode 100755 tests/shell/testcases/bitwise/0040mark_binop_13
-+ create mode 100755 tests/shell/testcases/bitwise/0044payload_binop_2
-+ create mode 100755 tests/shell/testcases/bitwise/0044payload_binop_5
-+ create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_10.nft
-+ create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_11.nft
-+ create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_12.nft
-+ create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_13.nft
-+ create mode 100644 tests/shell/testcases/bitwise/dumps/0044payload_binop_2.nft
-+ create mode 100644 tests/shell/testcases/bitwise/dumps/0044payload_binop_5.nft
-+
-+diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h
-+index c62e6ac5..f57963e8 100644
-+--- a/include/linux/netfilter/nf_tables.h
-++++ b/include/linux/netfilter/nf_tables.h
-+@@ -557,16 +557,27 @@ enum nft_immediate_attributes {
-+ /**
-+  * enum nft_bitwise_ops - nf_tables bitwise operations
-+  *
-+- * @NFT_BITWISE_BOOL: mask-and-xor operation used to implement NOT, AND, OR and
-+- *                    XOR boolean operations
-++ * @NFT_BITWISE_MASK_XOR: mask-and-xor operation used to implement NOT, AND, OR
-++ *                        and XOR boolean operations
-+  * @NFT_BITWISE_LSHIFT: left-shift operation
-+  * @NFT_BITWISE_RSHIFT: right-shift operation
-++ * @NFT_BITWISE_AND: and operation
-++ * @NFT_BITWISE_OR: or operation
-++ * @NFT_BITWISE_XOR: xor operation
-+  */
-+ enum nft_bitwise_ops {
-+-	NFT_BITWISE_BOOL,
-++	NFT_BITWISE_MASK_XOR,
-+ 	NFT_BITWISE_LSHIFT,
-+ 	NFT_BITWISE_RSHIFT,
-++	NFT_BITWISE_AND,
-++	NFT_BITWISE_OR,
-++	NFT_BITWISE_XOR,
-+ };
-++/*
-++ * Old name for NFT_BITWISE_MASK_XOR, predating the addition of NFT_BITWISE_AND,
-++ * NFT_BITWISE_OR and NFT_BITWISE_XOR.  Retained for backwards-compatibility.
-++ */
-++#define NFT_BITWISE_BOOL NFT_BITWISE_MASK_XOR
-+ 
-+ /**
-+  * enum nft_bitwise_attributes - nf_tables bitwise expression netlink attributes
-+@@ -579,6 +590,7 @@ enum nft_bitwise_ops {
-+  * @NFTA_BITWISE_OP: type of operation (NLA_U32: nft_bitwise_ops)
-+  * @NFTA_BITWISE_DATA: argument for non-boolean operations
-+  *                     (NLA_NESTED: nft_data_attributes)
-++ * @NFTA_BITWISE_SREG2: second source register (NLA_U32: nft_registers)
-+  *
-+  * The bitwise expression supports boolean and shift operations.  It implements
-+  * the boolean operations by performing the following operation:
-+@@ -602,6 +614,7 @@ enum nft_bitwise_attributes {
-+ 	NFTA_BITWISE_XOR,
-+ 	NFTA_BITWISE_OP,
-+ 	NFTA_BITWISE_DATA,
-++	NFTA_BITWISE_SREG2,
-+ 	__NFTA_BITWISE_MAX
-+ };
-+ #define NFTA_BITWISE_MAX	(__NFTA_BITWISE_MAX - 1)
-+diff --git a/src/evaluate.c b/src/evaluate.c
-+index 593a0140..cd3619a2 100644
-+--- a/src/evaluate.c
-++++ b/src/evaluate.c
-+@@ -1487,16 +1487,18 @@ static int expr_evaluate_bitwise(struct eval_ctx *ctx, struct expr **expr)
-+ 	op->byteorder = byteorder;
-+ 	op->len	      = max_len;
-+ 
-+-	if (expr_is_constant(left))
-++	if (expr_is_constant(left) && expr_is_constant(op->right))
-+ 		return constant_binop_simplify(ctx, expr);
-+ 	return 0;
-+ }
-+ 
-+ /*
-+- * Binop expression: both sides must be of integer base type. The left
-+- * hand side may be either constant or non-constant; in case its constant
-+- * it must be a singleton. The ride hand side must always be a constant
-+- * singleton.
-++ * Binop expression: both sides must be of integer base type. The left-hand side
-++ * may be either constant or non-constant; if it is constant, it must be a
-++ * singleton.  For bitwise operations, the right-hand side must be constant if
-++ * the left-hand side is constant; the right-hand side may be constant or
-++ * non-constant, if the left-hand side is non-constant; for shifts, the
-++ * right-hand side must be constant; if it is constant, it must be a singleton.
-+  */
-+ static int expr_evaluate_binop(struct eval_ctx *ctx, struct expr **expr)
-+ {
-+@@ -1527,6 +1529,13 @@ static int expr_evaluate_binop(struct eval_ctx *ctx, struct expr **expr)
-+ 		return -1;
-+ 	right = op->right;
-+ 
-++	/* evaluation expects constant to the right hand side. */
-++	if (expr_is_constant(left) && !expr_is_constant(right)) {
-++		range_expr_swap_values(op);
-++		left = op->left;
-++		right = op->right;
-++	}
-++
-+ 	switch (expr_basetype(left)->type) {
-+ 	case TYPE_INTEGER:
-+ 	case TYPE_STRING:
-+@@ -1544,17 +1553,6 @@ static int expr_evaluate_binop(struct eval_ctx *ctx, struct expr **expr)
-+ 					 "for %s expressions",
-+ 					 sym, expr_name(left));
-+ 
-+-	if (!expr_is_constant(right))
-+-		return expr_binary_error(ctx->msgs, right, op,
-+-					 "Right hand side of binary operation "
-+-					 "(%s) must be constant", sym);
-+-
-+-	if (!expr_is_singleton(right))
-+-		return expr_binary_error(ctx->msgs, left, op,
-+-					 "Binary operation (%s) is undefined "
-+-					 "for %s expressions",
-+-					 sym, expr_name(right));
-+-
-+ 	if (!datatype_equal(expr_basetype(left), expr_basetype(right)))
-+ 		return expr_binary_error(ctx->msgs, left, op,
-+ 					 "Binary operation (%s) with different base types "
-+@@ -1564,11 +1562,33 @@ static int expr_evaluate_binop(struct eval_ctx *ctx, struct expr **expr)
-+ 	switch (op->op) {
-+ 	case OP_LSHIFT:
-+ 	case OP_RSHIFT:
-++		if (!expr_is_constant(right))
-++			return expr_binary_error(ctx->msgs, right, op,
-++						 "Right hand side of binary operation "
-++						 "(%s) must be constant", sym);
-++
-++		if (!expr_is_singleton(right))
-++			return expr_binary_error(ctx->msgs, left, op,
-++						 "Binary operation (%s) is undefined "
-++						 "for %s expressions",
-++						 sym, expr_name(right));
-++
-+ 		ret = expr_evaluate_shift(ctx, expr);
-+ 		break;
-+ 	case OP_AND:
-+ 	case OP_XOR:
-+ 	case OP_OR:
-++		if (expr_is_constant(left) && !expr_is_constant(right))
-++			return expr_binary_error(ctx->msgs, right, op,
-++						 "Right hand side of binary operation "
-++						 "(%s) must be constant", sym);
-++
-++		if (expr_is_constant(right) && !expr_is_singleton(right))
-++			return expr_binary_error(ctx->msgs, left, op,
-++						 "Binary operation (%s) is undefined "
-++						 "for %s expressions",
-++						 sym, expr_name(right));
-++
-+ 		ret = expr_evaluate_bitwise(ctx, expr);
-+ 		break;
-+ 	default:
-+diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c
-+index e3d9cfbb..db8b6bbe 100644
-+--- a/src/netlink_delinearize.c
-++++ b/src/netlink_delinearize.c
-+@@ -455,12 +455,12 @@ static void netlink_parse_lookup(struct netlink_parse_ctx *ctx,
-+ 	ctx->stmt = expr_stmt_alloc(loc, expr);
-+ }
-+ 
-+-static struct expr *netlink_parse_bitwise_bool(struct netlink_parse_ctx *ctx,
-+-					       const struct location *loc,
-+-					       const struct nftnl_expr *nle,
-+-					       enum nft_registers sreg,
-+-					       struct expr *left)
-+-
-++static struct expr *
-++netlink_parse_bitwise_mask_xor(struct netlink_parse_ctx *ctx,
-++			       const struct location *loc,
-++			       const struct nftnl_expr *nle,
-++			       enum nft_registers sreg,
-++			       struct expr *left)
-+ {
-+ 	struct nft_data_delinearize nld;
-+ 	struct expr *expr, *mask, *xor, *or;
-+@@ -520,10 +520,39 @@ static struct expr *netlink_parse_bitwise_bool(struct netlink_parse_ctx *ctx,
-+ 	return expr;
-+ }
-+ 
-++static struct expr *netlink_parse_bitwise_bool(struct netlink_parse_ctx *ctx,
-++					       const struct location *loc,
-++					       const struct nftnl_expr *nle,
-++					       enum nft_bitwise_ops op,
-++					       enum nft_registers sreg,
-++					       struct expr *left)
-++{
-++	enum nft_registers sreg2;
-++	struct expr *right, *expr;
-++
-++	sreg2 = netlink_parse_register(nle, NFTNL_EXPR_BITWISE_SREG2);
-++	right = netlink_get_register(ctx, loc, sreg2);
-++	if (right == NULL) {
-++		netlink_error(ctx, loc,
-++			      "Bitwise expression has no right-hand expression");
-++		return NULL;
-++	}
-++
-++	expr = binop_expr_alloc(loc,
-++				op == NFT_BITWISE_XOR ? OP_XOR :
-++				op == NFT_BITWISE_AND ? OP_AND : OP_OR,
-++				left, right);
-++
-++	if (left->len > 0)
-++		expr->len = left->len;
-++
-++	return expr;
-++}
-++
-+ static struct expr *netlink_parse_bitwise_shift(struct netlink_parse_ctx *ctx,
-+ 						const struct location *loc,
-+ 						const struct nftnl_expr *nle,
-+-						enum ops op,
-++						enum nft_bitwise_ops op,
-+ 						enum nft_registers sreg,
-+ 						struct expr *left)
-+ {
-+@@ -534,7 +563,9 @@ static struct expr *netlink_parse_bitwise_shift(struct netlink_parse_ctx *ctx,
-+ 	right = netlink_alloc_value(loc, &nld);
-+ 	right->byteorder = BYTEORDER_HOST_ENDIAN;
-+ 
-+-	expr = binop_expr_alloc(loc, op, left, right);
-++	expr = binop_expr_alloc(loc,
-++				op == NFT_BITWISE_LSHIFT ? OP_LSHIFT : OP_RSHIFT,
-++				left, right);
-+ 	expr->len = nftnl_expr_get_u32(nle, NFTNL_EXPR_BITWISE_LEN) * BITS_PER_BYTE;
-+ 
-+ 	return expr;
-+@@ -558,16 +589,19 @@ static void netlink_parse_bitwise(struct netlink_parse_ctx *ctx,
-+ 	op = nftnl_expr_get_u32(nle, NFTNL_EXPR_BITWISE_OP);
-+ 
-+ 	switch (op) {
-+-	case NFT_BITWISE_BOOL:
-+-		expr = netlink_parse_bitwise_bool(ctx, loc, nle, sreg,
-+-						  left);
-++	case NFT_BITWISE_MASK_XOR:
-++		expr = netlink_parse_bitwise_mask_xor(ctx, loc, nle, sreg,
-++						      left);
-+ 		break;
-+-	case NFT_BITWISE_LSHIFT:
-+-		expr = netlink_parse_bitwise_shift(ctx, loc, nle, OP_LSHIFT,
-+-						   sreg, left);
-++	case NFT_BITWISE_XOR:
-++	case NFT_BITWISE_AND:
-++	case NFT_BITWISE_OR:
-++		expr = netlink_parse_bitwise_bool(ctx, loc, nle, op,
-++						  sreg, left);
-+ 		break;
-++	case NFT_BITWISE_LSHIFT:
-+ 	case NFT_BITWISE_RSHIFT:
-+-		expr = netlink_parse_bitwise_shift(ctx, loc, nle, OP_RSHIFT,
-++		expr = netlink_parse_bitwise_shift(ctx, loc, nle, op,
-+ 						   sreg, left);
-+ 		break;
-+ 	default:
-+diff --git a/src/netlink_linearize.c b/src/netlink_linearize.c
-+index 77bc5149..42310115 100644
-+--- a/src/netlink_linearize.c
-++++ b/src/netlink_linearize.c
-+@@ -664,9 +664,9 @@ static void combine_binop(mpz_t mask, mpz_t xor, const mpz_t m, const mpz_t x)
-+ 	mpz_and(mask, mask, m);
-+ }
-+ 
-+-static void netlink_gen_shift(struct netlink_linearize_ctx *ctx,
-+-			      const struct expr *expr,
-+-			      enum nft_registers dreg)
-++static void netlink_gen_bitwise_shift(struct netlink_linearize_ctx *ctx,
-++				      const struct expr *expr,
-++				      enum nft_registers dreg)
-+ {
-+ 	enum nft_bitwise_ops op = expr->op == OP_LSHIFT ?
-+ 		NFT_BITWISE_LSHIFT : NFT_BITWISE_RSHIFT;
-+@@ -691,9 +691,9 @@ static void netlink_gen_shift(struct netlink_linearize_ctx *ctx,
-+ 	nft_rule_add_expr(ctx, nle, &expr->location);
-+ }
-+ 
-+-static void netlink_gen_bitwise(struct netlink_linearize_ctx *ctx,
-+-				const struct expr *expr,
-+-				enum nft_registers dreg)
-++static void netlink_gen_bitwise_mask_xor(struct netlink_linearize_ctx *ctx,
-++					 const struct expr *expr,
-++					 enum nft_registers dreg)
-+ {
-+ 	struct expr *binops[NFT_MAX_EXPR_RECURSION];
-+ 	struct nftnl_expr *nle;
-+@@ -709,7 +709,7 @@ static void netlink_gen_bitwise(struct netlink_linearize_ctx *ctx,
-+ 	mpz_init(tmp);
-+ 
-+ 	binops[n++] = left = (struct expr *) expr;
-+-	while (left->etype == EXPR_BINOP && left->left != NULL &&
-++	while (left->etype == EXPR_BINOP && left->left != NULL && expr_is_constant(left->right) &&
-+ 	       (left->op == OP_AND || left->op == OP_OR || left->op == OP_XOR)) {
-+ 		if (n == array_size(binops))
-+ 			BUG("NFT_MAX_EXPR_RECURSION limit reached");
-+@@ -747,7 +747,7 @@ static void netlink_gen_bitwise(struct netlink_linearize_ctx *ctx,
-+ 	nle = alloc_nft_expr("bitwise");
-+ 	netlink_put_register(nle, NFTNL_EXPR_BITWISE_SREG, dreg);
-+ 	netlink_put_register(nle, NFTNL_EXPR_BITWISE_DREG, dreg);
-+-	nftnl_expr_set_u32(nle, NFTNL_EXPR_BITWISE_OP, NFT_BITWISE_BOOL);
-++	nftnl_expr_set_u32(nle, NFTNL_EXPR_BITWISE_OP, NFT_BITWISE_MASK_XOR);
-+ 	nftnl_expr_set_u32(nle, NFTNL_EXPR_BITWISE_LEN, len);
-+ 
-+ 	netlink_gen_raw_data(mask, expr->byteorder, len, &nld);
-+@@ -763,6 +763,44 @@ static void netlink_gen_bitwise(struct netlink_linearize_ctx *ctx,
-+ 	nft_rule_add_expr(ctx, nle, &expr->location);
-+ }
-+ 
-++static void netlink_gen_bitwise_bool(struct netlink_linearize_ctx *ctx,
-++				     const struct expr *expr,
-++				     enum nft_registers dreg)
-++{
-++	enum nft_registers sreg2;
-++	struct nftnl_expr *nle;
-++	unsigned int len;
-++
-++	nle = alloc_nft_expr("bitwise");
-++
-++	switch (expr->op) {
-++	case OP_XOR:
-++		nftnl_expr_set_u32(nle, NFTNL_EXPR_BITWISE_OP, NFT_BITWISE_XOR);
-++		break;
-++	case OP_AND:
-++		nftnl_expr_set_u32(nle, NFTNL_EXPR_BITWISE_OP, NFT_BITWISE_AND);
-++		break;
-++	case OP_OR:
-++		nftnl_expr_set_u32(nle, NFTNL_EXPR_BITWISE_OP, NFT_BITWISE_OR);
-++		break;
-++	default:
-++		BUG("invalid binary operation %u\n", expr->op);
-++	}
-++
-++	netlink_gen_expr(ctx, expr->left, dreg);
-++	netlink_put_register(nle, NFTNL_EXPR_BITWISE_SREG, dreg);
-++	netlink_put_register(nle, NFTNL_EXPR_BITWISE_DREG, dreg);
-++
-++	sreg2 = get_register(ctx, expr->right);
-++	netlink_gen_expr(ctx, expr->right, sreg2);
-++	netlink_put_register(nle, NFTNL_EXPR_BITWISE_SREG2, sreg2);
-++
-++	len = div_round_up(expr->len, BITS_PER_BYTE);
-++	nftnl_expr_set_u32(nle, NFTNL_EXPR_BITWISE_LEN, len);
-++
-++	nftnl_rule_add_expr(ctx->nlr, nle);
-++}
-++
-+ static void netlink_gen_binop(struct netlink_linearize_ctx *ctx,
-+ 			      const struct expr *expr,
-+ 			      enum nft_registers dreg)
-+@@ -770,10 +808,13 @@ static void netlink_gen_binop(struct netlink_linearize_ctx *ctx,
-+ 	switch(expr->op) {
-+ 	case OP_LSHIFT:
-+ 	case OP_RSHIFT:
-+-		netlink_gen_shift(ctx, expr, dreg);
-++		netlink_gen_bitwise_shift(ctx, expr, dreg);
-+ 		break;
-+ 	default:
-+-		netlink_gen_bitwise(ctx, expr, dreg);
-++		if (expr_is_constant(expr->right))
-++			netlink_gen_bitwise_mask_xor(ctx, expr, dreg);
-++		else
-++			netlink_gen_bitwise_bool(ctx, expr, dreg);
-+ 		break;
-+ 	}
-+ }
-+diff --git a/src/parser_json.c b/src/parser_json.c
-+index bae2c3c0..5ac5f027 100644
-+--- a/src/parser_json.c
-++++ b/src/parser_json.c
-+@@ -1557,12 +1557,12 @@ static struct expr *json_parse_expr(struct json_ctx *ctx, json_t *root)
-+ 		{ "ip option", json_parse_ip_option_expr, CTX_F_PRIMARY | CTX_F_SET_RHS | CTX_F_MANGLE | CTX_F_SES | CTX_F_CONCAT },
-+ 		{ "sctp chunk", json_parse_sctp_chunk_expr, CTX_F_PRIMARY | CTX_F_SET_RHS | CTX_F_MANGLE | CTX_F_SES | CTX_F_CONCAT },
-+ 		{ "dccp option", json_parse_dccp_option_expr, CTX_F_PRIMARY },
-+-		{ "meta", json_parse_meta_expr, CTX_F_STMT | CTX_F_PRIMARY | CTX_F_SET_RHS | CTX_F_MANGLE | CTX_F_SES | CTX_F_MAP | CTX_F_CONCAT },
-++		{ "meta", json_parse_meta_expr, CTX_F_RHS | CTX_F_STMT | CTX_F_PRIMARY | CTX_F_SET_RHS | CTX_F_MANGLE | CTX_F_SES | CTX_F_MAP | CTX_F_CONCAT },
-+ 		{ "osf", json_parse_osf_expr, CTX_F_STMT | CTX_F_PRIMARY | CTX_F_MAP | CTX_F_CONCAT },
-+ 		{ "ipsec", json_parse_xfrm_expr, CTX_F_PRIMARY | CTX_F_MAP | CTX_F_CONCAT },
-+ 		{ "socket", json_parse_socket_expr, CTX_F_PRIMARY | CTX_F_CONCAT },
-+ 		{ "rt", json_parse_rt_expr, CTX_F_STMT | CTX_F_PRIMARY | CTX_F_SET_RHS | CTX_F_SES | CTX_F_MAP | CTX_F_CONCAT },
-+-		{ "ct", json_parse_ct_expr, CTX_F_STMT | CTX_F_PRIMARY | CTX_F_SET_RHS | CTX_F_MANGLE | CTX_F_SES | CTX_F_MAP | CTX_F_CONCAT },
-++		{ "ct", json_parse_ct_expr, CTX_F_RHS | CTX_F_STMT | CTX_F_PRIMARY | CTX_F_SET_RHS | CTX_F_MANGLE | CTX_F_SES | CTX_F_MAP | CTX_F_CONCAT },
-+ 		{ "numgen", json_parse_numgen_expr, CTX_F_STMT | CTX_F_PRIMARY | CTX_F_SET_RHS | CTX_F_SES | CTX_F_MAP | CTX_F_CONCAT },
-+ 		/* below two are hash expr */
-+ 		{ "jhash", json_parse_hash_expr, CTX_F_STMT | CTX_F_PRIMARY | CTX_F_SET_RHS | CTX_F_SES | CTX_F_MAP | CTX_F_CONCAT },
-+diff --git a/tests/py/any/ct.t b/tests/py/any/ct.t
-+index f73fa4e7..0059e49c 100644
-+--- a/tests/py/any/ct.t
-++++ b/tests/py/any/ct.t
-+@@ -40,7 +40,9 @@ ct mark and 0x23 == 0x11;ok;ct mark & 0x00000023 == 0x00000011
-+ ct mark and 0x3 != 0x1;ok;ct mark & 0x00000003 != 0x00000001
-+ ct mark xor 0x23 == 0x11;ok;ct mark 0x00000032
-+ ct mark xor 0x3 != 0x1;ok;ct mark != 0x00000002
-++
-+ ct mark set ct mark or 0x00000001;ok;ct mark set ct mark | 0x00000001
-++ct mark set 0x00000001 or ct mark;ok;ct mark set ct mark | 0x00000001
-+ 
-+ ct mark 0x00000032;ok
-+ ct mark != 0x00000032;ok
-+@@ -61,6 +63,7 @@ ct mark set 0x11;ok;ct mark set 0x00000011
-+ ct mark set mark;ok;ct mark set meta mark
-+ ct mark set (meta mark | 0x10) << 8;ok;ct mark set (meta mark | 0x00000010) << 8
-+ ct mark set mark map { 1 : 10, 2 : 20, 3 : 30 };ok;ct mark set meta mark map { 0x00000003 : 0x0000001e, 0x00000002 : 0x00000014, 0x00000001 : 0x0000000a}
-++ct mark set ct mark and 0xffff0000 or meta mark and 0xffff;ok;ct mark set ct mark & 0xffff0000 | meta mark & 0x0000ffff
-+ 
-+ ct mark set {0x11333, 0x11};fail
-+ ct zone set {123, 127};fail
-+diff --git a/tests/py/any/ct.t.json b/tests/py/any/ct.t.json
-+index a2a06025..ef350000 100644
-+--- a/tests/py/any/ct.t.json
-++++ b/tests/py/any/ct.t.json
-+@@ -560,6 +560,29 @@
-+     }
-+ ]
-+ 
-++# ct mark set 0x00000001 or ct mark
-++[
-++    {
-++        "mangle": {
-++            "key": {
-++                "ct": {
-++                    "key": "mark"
-++                }
-++            },
-++            "value": {
-++                "|": [
-++                    {
-++                        "ct": {
-++                            "key": "mark"
-++                        }
-++                    },
-++                    1
-++                ]
-++            }
-++        }
-++    }
-++]
-++
-+ # ct mark 0x00000032
-+ [
-+     {
-+@@ -817,6 +840,43 @@
-+     }
-+ ]
-+ 
-++# ct mark set ct mark and 0xffff0000 or meta mark and 0xffff
-++[
-++    {
-++        "mangle": {
-++            "key": {
-++                "ct": {
-++                    "key": "mark"
-++                }
-++            },
-++            "value": {
-++                "|": [
-++                    {
-++                        "&": [
-++                            {
-++                                "ct": {
-++                                    "key": "mark"
-++                                }
-++                            },
-++                            4294901760
-++                        ]
-++                    },
-++                    {
-++                        "&": [
-++                            {
-++                                "meta": {
-++                                    "key": "mark"
-++                                }
-++                            },
-++                            65535
-++                        ]
-++                    }
-++                ]
-++            }
-++        }
-++    }
-++]
-++
-+ # ct expiration 30s
-+ [
-+     {
-+diff --git a/tests/py/any/ct.t.payload b/tests/py/any/ct.t.payload
-+index ed868e53..14385cf7 100644
-+--- a/tests/py/any/ct.t.payload
-++++ b/tests/py/any/ct.t.payload
-+@@ -336,6 +336,15 @@ ip test-ip4 output
-+   [ lookup reg 1 set __map%d dreg 1 ]
-+   [ ct set mark with reg 1 ]
-+ 
-++# ct mark set ct mark and 0xffff0000 or meta mark and 0xffff
-++ip
-++  [ ct load mark => reg 1 ]
-++  [ bitwise reg 1 = ( reg 1 & 0xffff0000 ) ^ 0x00000000 ]
-++  [ meta load mark => reg 2 ]
-++  [ bitwise reg 2 = ( reg 2 & 0x0000ffff ) ^ 0x00000000 ]
-++  [ bitwise reg 1 = ( reg 1 | reg 2 ) ]
-++  [ ct set mark with reg 1 ]
-++
-+ # ct original bytes > 100000
-+ ip test-ip4 output
-+   [ ct load bytes => reg 1 , dir original ]
-+@@ -497,6 +506,12 @@ ip test-ip4 output
-+   [ bitwise reg 1 = ( reg 1 & 0xfffffffe ) ^ 0x00000001 ]
-+   [ ct set mark with reg 1 ]
-+ 
-++# ct mark set 0x00000001 or ct mark
-++ip test-ip4 output
-++  [ ct load mark => reg 1 ]
-++  [ bitwise reg 1 = ( reg 1 & 0xfffffffe ) ^ 0x00000001 ]
-++  [ ct set mark with reg 1 ]
-++
-+ # ct id 12345
-+ ip test-ip4 output
-+   [ ct load unknown => reg 1 ]
-+diff --git a/tests/py/inet/meta.t b/tests/py/inet/meta.t
-+index 7d2515c9..5c5c11d4 100644
-+--- a/tests/py/inet/meta.t
-++++ b/tests/py/inet/meta.t
-+@@ -31,3 +31,5 @@ meta mark set ip dscp;ok
-+ meta mark set ip dscp | 0x40;ok
-+ meta mark set ip6 dscp;ok
-+ meta mark set ip6 dscp | 0x40;ok
-++
-++meta mark set ct mark and 0xffff0000 or meta mark and 0xffff;ok;meta mark set ct mark & 0xffff0000 | meta mark & 0x0000ffff
-+diff --git a/tests/py/inet/meta.t.json b/tests/py/inet/meta.t.json
-+index 0fee165f..4352b963 100644
-+--- a/tests/py/inet/meta.t.json
-++++ b/tests/py/inet/meta.t.json
-+@@ -236,6 +236,43 @@
-+     }
-+ ]
-+ 
-++# meta mark set ct mark and 0xffff0000 or meta mark and 0xffff
-++[
-++    {
-++        "mangle": {
-++            "key": {
-++                "meta": {
-++                    "key": "mark"
-++                }
-++            },
-++            "value": {
-++                "|": [
-++                    {
-++                        "&": [
-++                            {
-++                                "ct": {
-++                                    "key": "mark"
-++                                }
-++                            },
-++                            4294901760
-++                        ]
-++                    },
-++                    {
-++                        "&": [
-++                            {
-++                                "meta": {
-++                                    "key": "mark"
-++                                }
-++                            },
-++                            65535
-++                        ]
-++                    }
-++                ]
-++            }
-++        }
-++    }
-++]
-++
-+ # meta protocol ip udp dport 67
-+ [
-+     {
-+diff --git a/tests/py/inet/meta.t.payload b/tests/py/inet/meta.t.payload
-+index 7184fa0c..04dfbd8f 100644
-+--- a/tests/py/inet/meta.t.payload
-++++ b/tests/py/inet/meta.t.payload
-+@@ -80,6 +80,15 @@ inet test-inet input
-+   [ bitwise reg 1 = ( reg 1 >> 0x00000008 ) ]
-+   [ meta set mark with reg 1 ]
-+ 
-++# meta mark set ct mark and 0xffff0000 or meta mark and 0xffff
-++inet test-inet input
-++  [ ct load mark => reg 1 ]
-++  [ bitwise reg 1 = ( reg 1 & 0xffff0000 ) ^ 0x00000000 ]
-++  [ meta load mark => reg 2 ]
-++  [ bitwise reg 2 = ( reg 2 & 0x0000ffff ) ^ 0x00000000 ]
-++  [ bitwise reg 1 = ( reg 1 | reg 2 ) ]
-++  [ meta set mark with reg 1 ]
-++
-+ # meta protocol ip udp dport 67
-+ inet test-inet input
-+   [ meta load protocol => reg 1 ]
-+diff --git a/tests/py/ip/ct.t b/tests/py/ip/ct.t
-+index a0a22289..523d0244 100644
-+--- a/tests/py/ip/ct.t
-++++ b/tests/py/ip/ct.t
-+@@ -28,9 +28,11 @@ meta mark set ct original saddr . meta mark map { 1.1.1.1 . 0x00000014 : 0x00000
-+ meta mark set ct original ip saddr . meta mark map { 1.1.1.1 . 0x00000014 : 0x0000001e };ok
-+ ct original saddr . meta mark { 1.1.1.1 . 0x00000014 };fail
-+ ct original ip saddr . meta mark { 1.1.1.1 . 0x00000014 };ok
-++
-+ ct mark set ip dscp << 2 | 0x10;ok
-+ ct mark set ip dscp << 26 | 0x10;ok
-+ ct mark set ip dscp & 0x0f << 1;ok;ct mark set ip dscp & af33
-+ ct mark set ip dscp & 0x0f << 2;ok;ct mark set ip dscp & 0x3c
-+ ct mark set ip dscp | 0x04;ok
-+ ct mark set ip dscp | 1 << 20;ok;ct mark set ip dscp | 0x100000
-++ct mark set ct mark | ip dscp | 0x200 counter;ok;ct mark set ct mark | ip dscp | 0x00000200 counter
-+diff --git a/tests/py/ip/ct.t.json b/tests/py/ip/ct.t.json
-+index 915632ae..9e60f7e2 100644
-+--- a/tests/py/ip/ct.t.json
-++++ b/tests/py/ip/ct.t.json
-+@@ -479,3 +479,35 @@
-+         }
-+     }
-+ ]
-++
-++# ct mark set ct mark | ip dscp | 0x200 counter
-++[
-++    {
-++        "mangle": {
-++            "key": {
-++                "ct": {
-++                    "key": "mark"
-++                }
-++            },
-++            "value": {
-++                "|": [
-++                  {
-++                    "ct": {
-++                      "key": "mark"
-++                    }
-++                  },
-++                  {
-++                    "payload": {
-++                      "protocol": "ip",
-++                      "field": "dscp"
-++                    }
-++                  },
-++                  512
-++                ]
-++            }
-++        }
-++    },
-++    {
-++        "counter": null
-++    }
-++]
-+diff --git a/tests/py/ip/ct.t.payload b/tests/py/ip/ct.t.payload
-+index 692011d0..823de597 100644
-+--- a/tests/py/ip/ct.t.payload
-++++ b/tests/py/ip/ct.t.payload
-+@@ -134,3 +134,14 @@ ip test-ip4 output
-+   [ bitwise reg 1 = ( reg 1 >> 0x00000002 ) ]
-+   [ bitwise reg 1 = ( reg 1 & 0xffefffff ) ^ 0x00100000 ]
-+   [ ct set mark with reg 1 ]
-++
-++# ct mark set ct mark | ip dscp | 0x200 counter
-++ip test-ip4 output
-++  [ ct load mark => reg 1 ]
-++  [ payload load 1b @ network header + 1 => reg 2 ]
-++  [ bitwise reg 2 = ( reg 2 & 0x000000fc ) ^ 0x00000000 ]
-++  [ bitwise reg 2 = ( reg 2 >> 0x00000002 ) ]
-++  [ bitwise reg 1 = ( reg 1 | reg 2 ) ]
-++  [ bitwise reg 1 = ( reg 1 & 0xfffffdff ) ^ 0x00000200 ]
-++  [ ct set mark with reg 1 ]
-++  [ counter pkts 0 bytes 0 ]
-+diff --git a/tests/py/ip6/ct.t b/tests/py/ip6/ct.t
-+index c06fd6a0..1617c68b 100644
-+--- a/tests/py/ip6/ct.t
-++++ b/tests/py/ip6/ct.t
-+@@ -7,3 +7,4 @@ ct mark set ip6 dscp << 26 | 0x10;ok
-+ ct mark set ip6 dscp | 0x04;ok
-+ ct mark set ip6 dscp | 0xff000000;ok
-+ ct mark set ip6 dscp & 0x0f << 2;ok;ct mark set ip6 dscp & 0x3c
-++ct mark set ct mark | ip6 dscp | 0x200 counter;ok;ct mark set ct mark | ip6 dscp | 0x00000200 counter
-+diff --git a/tests/py/ip6/ct.t.json b/tests/py/ip6/ct.t.json
-+index 7d8c88bb..2633c2b9 100644
-+--- a/tests/py/ip6/ct.t.json
-++++ b/tests/py/ip6/ct.t.json
-+@@ -291,3 +291,35 @@
-+         }
-+     }
-+ ]
-++
-++# ct mark set ct mark | ip6 dscp | 0x200 counter
-++[
-++    {
-++        "mangle": {
-++            "key": {
-++                "ct": {
-++                    "key": "mark"
-++                }
-++            },
-++            "value": {
-++                "|": [
-++                  {
-++                    "ct": {
-++                      "key": "mark"
-++                    }
-++                  },
-++                  {
-++                    "payload": {
-++                      "protocol": "ip6",
-++                      "field": "dscp"
-++                    }
-++                  },
-++                  512
-++                ]
-++            }
-++        }
-++    },
-++    {
-++        "counter": null
-++    }
-++]
-+diff --git a/tests/py/ip6/ct.t.payload b/tests/py/ip6/ct.t.payload
-+index 944208f2..a7a56d4b 100644
-+--- a/tests/py/ip6/ct.t.payload
-++++ b/tests/py/ip6/ct.t.payload
-+@@ -44,3 +44,15 @@ ip6 test-ip6 output
-+   [ bitwise reg 1 = ( reg 1 >> 0x00000006 ) ]
-+   [ bitwise reg 1 = ( reg 1 & 0x0000003c ) ^ 0x00000000 ]
-+   [ ct set mark with reg 1 ]
-++
-++# ct mark set ct mark | ip6 dscp | 0x200 counter
-++ip6 test-ip6 output
-++  [ ct load mark => reg 1 ]
-++  [ payload load 2b @ network header + 0 => reg 2 ]
-++  [ bitwise reg 2 = ( reg 2 & 0x0000c00f ) ^ 0x00000000 ]
-++  [ byteorder reg 2 = ntoh(reg 2, 2, 2) ]
-++  [ bitwise reg 2 = ( reg 2 >> 0x00000006 ) ]
-++  [ bitwise reg 1 = ( reg 1 | reg 2 ) ]
-++  [ bitwise reg 1 = ( reg 1 & 0xfffffdff ) ^ 0x00000200 ]
-++  [ ct set mark with reg 1 ]
-++  [ counter pkts 0 bytes 0 ]
-+diff --git a/tests/shell/features/bitwise_multireg.nft b/tests/shell/features/bitwise_multireg.nft
-+new file mode 100644
-+index 00000000..cfce5a39
-+--- /dev/null
-++++ b/tests/shell/features/bitwise_multireg.nft
-+@@ -0,0 +1,5 @@
-++table inet test {
-++	chain y {
-++		ct mark set ct mark | meta mark
-++	}
-++}
-+diff --git a/tests/shell/testcases/bitwise/0040mark_binop_10 b/tests/shell/testcases/bitwise/0040mark_binop_10
-+new file mode 100755
-+index 00000000..f523bd73
-+--- /dev/null
-++++ b/tests/shell/testcases/bitwise/0040mark_binop_10
-+@@ -0,0 +1,13 @@
-++#!/bin/bash
-++
-++# NFT_TEST_REQUIRES(NFT_TEST_HAVE_bitwise_multireg)
-++
-++set -e
-++
-++RULESET="
-++  add table t
-++  add chain t c { type filter hook output priority filter; }
-++  add rule t c ct mark set ct mark and 0xffff0000 or meta mark and 0xffff
-++"
-++
-++$NFT -f - <<< "$RULESET"
-+diff --git a/tests/shell/testcases/bitwise/0040mark_binop_11 b/tests/shell/testcases/bitwise/0040mark_binop_11
-+new file mode 100755
-+index 00000000..d6dfb3b8
-+--- /dev/null
-++++ b/tests/shell/testcases/bitwise/0040mark_binop_11
-+@@ -0,0 +1,13 @@
-++#!/bin/bash
-++
-++# NFT_TEST_REQUIRES(NFT_TEST_HAVE_bitwise_multireg)
-++
-++set -e
-++
-++RULESET="
-++  add table t
-++  add chain t c { type filter hook input priority filter; }
-++  add rule t c meta mark set ct mark and 0xffff0000 or meta mark and 0xffff
-++"
-++
-++$NFT -f - <<< "$RULESET"
-+diff --git a/tests/shell/testcases/bitwise/0040mark_binop_12 b/tests/shell/testcases/bitwise/0040mark_binop_12
-+new file mode 100755
-+index 00000000..bbddb55b
-+--- /dev/null
-++++ b/tests/shell/testcases/bitwise/0040mark_binop_12
-+@@ -0,0 +1,13 @@
-++#!/bin/bash
-++
-++# NFT_TEST_REQUIRES(NFT_TEST_HAVE_bitwise_multireg)
-++
-++set -e
-++
-++RULESET="
-++  add table ip6 t
-++  add chain ip6 t c { type filter hook output priority filter; }
-++  add rule ip6 t c ct mark set ct mark and 0xffff0000 or meta mark and 0xffff
-++"
-++
-++$NFT -f - <<< "$RULESET"
-+diff --git a/tests/shell/testcases/bitwise/0040mark_binop_13 b/tests/shell/testcases/bitwise/0040mark_binop_13
-+new file mode 100755
-+index 00000000..769acb63
-+--- /dev/null
-++++ b/tests/shell/testcases/bitwise/0040mark_binop_13
-+@@ -0,0 +1,13 @@
-++#!/bin/bash
-++
-++# NFT_TEST_REQUIRES(NFT_TEST_HAVE_bitwise_multireg)
-++
-++set -e
-++
-++RULESET="
-++  add table ip6 t
-++  add chain ip6 t c { type filter hook input priority filter; }
-++  add rule ip6 t c meta mark set ct mark and 0xffff0000 or meta mark and 0xffff
-++"
-++
-++$NFT -f - <<< "$RULESET"
-+diff --git a/tests/shell/testcases/bitwise/0044payload_binop_2 b/tests/shell/testcases/bitwise/0044payload_binop_2
-+new file mode 100755
-+index 00000000..13c4acef
-+--- /dev/null
-++++ b/tests/shell/testcases/bitwise/0044payload_binop_2
-+@@ -0,0 +1,13 @@
-++#!/bin/bash
-++
-++# NFT_TEST_REQUIRES(NFT_TEST_HAVE_bitwise_multireg)
-++
-++set -e
-++
-++RULESET="
-++  add table t
-++  add chain t c { type filter hook output priority filter; }
-++  add rule t c ct mark set ct mark | ip dscp | 0x200 counter
-++"
-++
-++$NFT -f - <<< "$RULESET"
-+diff --git a/tests/shell/testcases/bitwise/0044payload_binop_5 b/tests/shell/testcases/bitwise/0044payload_binop_5
-+new file mode 100755
-+index 00000000..7e8095c8
-+--- /dev/null
-++++ b/tests/shell/testcases/bitwise/0044payload_binop_5
-+@@ -0,0 +1,13 @@
-++#!/bin/bash
-++
-++# NFT_TEST_REQUIRES(NFT_TEST_HAVE_bitwise_multireg)
-++
-++set -e
-++
-++RULESET="
-++  add table ip6 t
-++  add chain ip6 t c { type filter hook output priority filter; }
-++  add rule ip6 t c ct mark set ct mark | ip6 dscp | 0x200 counter
-++"
-++
-++$NFT -f - <<< "$RULESET"
-+diff --git a/tests/shell/testcases/bitwise/dumps/0040mark_binop_10.nft b/tests/shell/testcases/bitwise/dumps/0040mark_binop_10.nft
-+new file mode 100644
-+index 00000000..5566f729
-+--- /dev/null
-++++ b/tests/shell/testcases/bitwise/dumps/0040mark_binop_10.nft
-+@@ -0,0 +1,6 @@
-++table ip t {
-++	chain c {
-++		type filter hook output priority filter; policy accept;
-++		ct mark set ct mark & 0xffff0000 | meta mark & 0x0000ffff
-++	}
-++}
-+diff --git a/tests/shell/testcases/bitwise/dumps/0040mark_binop_11.nft b/tests/shell/testcases/bitwise/dumps/0040mark_binop_11.nft
-+new file mode 100644
-+index 00000000..719980d5
-+--- /dev/null
-++++ b/tests/shell/testcases/bitwise/dumps/0040mark_binop_11.nft
-+@@ -0,0 +1,6 @@
-++table ip t {
-++	chain c {
-++		type filter hook input priority filter; policy accept;
-++		meta mark set ct mark & 0xffff0000 | meta mark & 0x0000ffff
-++	}
-++}
-+diff --git a/tests/shell/testcases/bitwise/dumps/0040mark_binop_12.nft b/tests/shell/testcases/bitwise/dumps/0040mark_binop_12.nft
-+new file mode 100644
-+index 00000000..bd589fe5
-+--- /dev/null
-++++ b/tests/shell/testcases/bitwise/dumps/0040mark_binop_12.nft
-+@@ -0,0 +1,6 @@
-++table ip6 t {
-++	chain c {
-++		type filter hook output priority filter; policy accept;
-++		ct mark set ct mark & 0xffff0000 | meta mark & 0x0000ffff
-++	}
-++}
-+diff --git a/tests/shell/testcases/bitwise/dumps/0040mark_binop_13.nft b/tests/shell/testcases/bitwise/dumps/0040mark_binop_13.nft
-+new file mode 100644
-+index 00000000..2b046b12
-+--- /dev/null
-++++ b/tests/shell/testcases/bitwise/dumps/0040mark_binop_13.nft
-+@@ -0,0 +1,6 @@
-++table ip6 t {
-++	chain c {
-++		type filter hook input priority filter; policy accept;
-++		meta mark set ct mark & 0xffff0000 | meta mark & 0x0000ffff
-++	}
-++}
-+diff --git a/tests/shell/testcases/bitwise/dumps/0044payload_binop_2.nft b/tests/shell/testcases/bitwise/dumps/0044payload_binop_2.nft
-+new file mode 100644
-+index 00000000..ed347bb2
-+--- /dev/null
-++++ b/tests/shell/testcases/bitwise/dumps/0044payload_binop_2.nft
-+@@ -0,0 +1,6 @@
-++table ip t {
-++	chain c {
-++		type filter hook output priority filter; policy accept;
-++		ct mark set ct mark | ip dscp | 0x00000200 counter packets 0 bytes 0
-++	}
-++}
-+diff --git a/tests/shell/testcases/bitwise/dumps/0044payload_binop_5.nft b/tests/shell/testcases/bitwise/dumps/0044payload_binop_5.nft
-+new file mode 100644
-+index 00000000..ccdb93d7
-+--- /dev/null
-++++ b/tests/shell/testcases/bitwise/dumps/0044payload_binop_5.nft
-+@@ -0,0 +1,6 @@
-++table ip6 t {
-++	chain c {
-++		type filter hook output priority filter; policy accept;
-++		ct mark set ct mark | ip6 dscp | 0x00000200 counter packets 0 bytes 0
-++	}
-++}
-+-- 
-+cgit v1.2.3
-+
diff --git a/patches-generic/027-wireguard_tools_bump_1.0.20260223.patch b/patches-generic/027-wireguard_tools_bump_1.0.20260223.patch
index fcdfcc9d8f..87d9d5ed1d 100644
--- a/patches-generic/027-wireguard_tools_bump_1.0.20260223.patch
+++ b/patches-generic/027-wireguard_tools_bump_1.0.20260223.patch
@@ -4,14 +4,13 @@
  
  PKG_NAME:=wireguard-tools
  
--PKG_VERSION:=1.0.20210914
--PKG_RELEASE:=4
+-PKG_VERSION:=1.0.20250521
 +PKG_VERSION:=1.0.20260223
-+PKG_RELEASE:=1
+ PKG_RELEASE:=1
  
  PKG_SOURCE:=wireguard-tools-$(PKG_VERSION).tar.xz
  PKG_SOURCE_URL:=https://git.zx2c4.com/wireguard-tools/snapshot/
--PKG_HASH:=97ff31489217bb265b7ae850d3d0f335ab07d2652ba1feec88b734bc96bd05ac
+-PKG_HASH:=b6f2628b85b1b23cc06517ec9c74f82d52c4cdbd020f3dd2f00c972a1782950e
 +PKG_HASH:=af459827b80bfd31b83b08077f4b5843acb7d18ad9a33a2ef532d3090f291fbf
  
  PKG_LICENSE:=GPL-2.0
diff --git a/patches-generic/029-cmake_policy_version_minimum.patch b/patches-generic/029-cmake_policy_version_minimum.patch
new file mode 100644
index 0000000000..ba2f364276
--- /dev/null
+++ b/patches-generic/029-cmake_policy_version_minimum.patch
@@ -0,0 +1,18 @@
+--- a/include/cmake.mk
++++ b/include/cmake.mk
+@@ -94,6 +94,7 @@
+ 		LDFLAGS="$(TARGET_LDFLAGS) $(EXTRA_LDFLAGS)" \
+ 		cmake \
+ 			--no-warn-unused-cli \
++			-DCMAKE_POLICY_VERSION_MINIMUM=3.5 \
+ 			-DCMAKE_SYSTEM_NAME=Linux \
+ 			-DCMAKE_SYSTEM_VERSION=1 \
+ 			-DCMAKE_SYSTEM_PROCESSOR=$(ARCH) \
+@@ -147,6 +148,7 @@
+ 		LDFLAGS="$(HOST_LDFLAGS)" \
+ 		cmake \
+ 			--no-warn-unused-cli \
++			-DCMAKE_POLICY_VERSION_MINIMUM=3.5 \
+ 			-DCMAKE_BUILD_TYPE=Release \
+ 			-DCMAKE_C_COMPILER_LAUNCHER="$(CMAKE_C_COMPILER_LAUNCHER)" \
+ 			-DCMAKE_C_COMPILER="$(CMAKE_HOST_C_COMPILER)" \
diff --git a/patches-generic/030-generic_ip6_nf_filter.patch b/patches-generic/030-generic_ip6_nf_filter.patch
new file mode 100644
index 0000000000..85735f713a
--- /dev/null
+++ b/patches-generic/030-generic_ip6_nf_filter.patch
@@ -0,0 +1,25 @@
+kernel 6.12 split the legacy iptables/ip6tables code behind hidden
+select-only symbols (IP_NF_IPTABLES_LEGACY / IP6_NF_IPTABLES_LEGACY).
+CONFIG_IP6_NF_IPTABLES=m alone (all that kmod-nf-ipt6 sets via
+include/netfilter.mk) no longer builds ip6_tables.ko, because nothing
+selects the legacy symbol -- so kmod-nf-ipt6 fails to package on every
+target. The IPv4 twin only works by accident: kmod-ipt-core's
+CONFIG_IP_NF_FILTER=m selects IP_NF_IPTABLES_LEGACY, and that package
+is in Gargoyle's set; there is no IPv6 equivalent selected.
+
+Enable IP6_NF_FILTER=m in the GENERIC kernel config (it selects
+IP6_NF_IPTABLES_LEGACY), fixing every target at once. Replaces the
+earlier x86-only version of this patch, which fixed the same issue via
+target/linux/x86/config-6.12 before mediatek hit it too.
+
+--- a/target/linux/generic/config-6.12
++++ b/target/linux/generic/config-6.12
+@@ -2850,7 +2850,7 @@
+ CONFIG_IO_WQ=y
+ # CONFIG_IP17XX_PHY is not set
+ # CONFIG_IP5XXX_POWER is not set
+-# CONFIG_IP6_NF_FILTER is not set
++CONFIG_IP6_NF_FILTER=m
+ # CONFIG_IP6_NF_IPTABLES is not set
+ # CONFIG_IP6_NF_MANGLE is not set
+ # CONFIG_IP6_NF_MATCH_AH is not set
diff --git a/patches-generic/031-wifi_scripts_fix_country00_ieee80211d.patch b/patches-generic/031-wifi_scripts_fix_country00_ieee80211d.patch
new file mode 100644
index 0000000000..3282935eb1
--- /dev/null
+++ b/patches-generic/031-wifi_scripts_fix_country00_ieee80211d.patch
@@ -0,0 +1,23 @@
+--- a/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/hostapd.uc
++++ b/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/hostapd.uc
+@@ -72,7 +72,19 @@
+ 		config.country_code = radio.config.country;
+ 	}
+
+-	if (!exists(config, 'country_code'))
++	/* '00' is cfg80211's generic/"world" regulatory-domain placeholder,
++	 * not a real ISO 3166-1 alpha2 code. hostapd has rejected any
++	 * country_code with characters outside A-Z at config-parse time
++	 * since 2.10 (2022), independent of ieee80211d -- one bad line
++	 * fails the whole config load. What is new in this release is the
++	 * generation side: radios left at their out-of-the-box default end
++	 * up with country '00' in UCI, and the schema
++	 * (wireless.wifi-device.json) aliases 'country' straight onto
++	 * 'country_code', so this function hands hostapd a config it
++	 * refuses. netifd's global hostapd daemon surfaces that as a
++	 * silently half-configured AP (no channel, no beacons) instead of
++	 * a startup error. Treat the placeholder the same as unset. */
++	if (!exists(config, 'country_code') || config.country_code == '00')
+ 		return;
+
+ 	if (config.hw_mode != 'a')
diff --git a/patches-generic/101-gargoyle_ssid_override.patch b/patches-generic/101-gargoyle_ssid_override.patch
index dda816138e..563e0a1ce1 100644
--- a/patches-generic/101-gargoyle_ssid_override.patch
+++ b/patches-generic/101-gargoyle_ssid_override.patch
@@ -1,11 +1,12 @@
 --- a/package/network/config/wifi-scripts/files/lib/wifi/mac80211.uc
 +++ b/package/network/config/wifi-scripts/files/lib/wifi/mac80211.uc
-@@ -104,7 +104,7 @@
+@@ -109,7 +109,7 @@
  set ${si}.device='${name}'
  set ${si}.network='lan'
  set ${si}.mode='ap'
 -set ${si}.ssid='${defaults?.ssid || "OpenWrt"}'
 +set ${si}.ssid='${defaults?.ssid || "Gargoyle"}'
- set ${si}.encryption='${defaults?.encryption || "none"}'
+ set ${si}.encryption='${defaults?.encryption || encryption}'
  set ${si}.key='${defaults?.key || ""}'
- 
+ set ${si}.disabled='${defaults ? 0 : 1}'
+
diff --git a/targets/ath79/profiles/default/config b/targets/ath79/profiles/default/config
index 7b9169d060..f8e8ac4c87 100644
--- a/targets/ath79/profiles/default/config
+++ b/targets/ath79/profiles/default/config
@@ -246,6 +246,7 @@ CONFIG_PACKAGE_uboot-envtools=m
 CONFIG_PACKAGE_wpad-basic-mbedtls=m
 CONFIG_PACKAGE_wpad-openssl=m
 CONFIG_TARGET_SQUASHFS_BLOCK_SIZE=1024
+# CONFIG_USE_APK is not set
 # CONFIG_USE_FS_ACL_ATTR is not set
 CONFIG_GARGOYLE_SMB_KSMBD=y
 # CONFIG_GARGOYLE_SMB_SAMBA is not set
diff --git a/targets/ath79/profiles/nand/config b/targets/ath79/profiles/nand/config
index 48dd06019a..3d0d841eb3 100644
--- a/targets/ath79/profiles/nand/config
+++ b/targets/ath79/profiles/nand/config
@@ -150,6 +150,7 @@ CONFIG_PACKAGE_wpad-openssl=m
 CONFIG_PACKAGE_wwan=y
 CONFIG_PACKAGE_zlib=y
 CONFIG_TARGET_SQUASHFS_BLOCK_SIZE=512
+# CONFIG_USE_APK is not set
 # CONFIG_USE_FS_ACL_ATTR is not set
 CONFIG_GARGOYLE_SMB_KSMBD=y
 # CONFIG_GARGOYLE_SMB_SAMBA is not set
diff --git a/targets/ipq40xx/profiles/default/config b/targets/ipq40xx/profiles/default/config
index b215f740f6..1e00fb9a9b 100644
--- a/targets/ipq40xx/profiles/default/config
+++ b/targets/ipq40xx/profiles/default/config
@@ -132,6 +132,7 @@ CONFIG_PACKAGE_wpad-basic-mbedtls=m
 CONFIG_PACKAGE_wpad-openssl=m
 CONFIG_PACKAGE_wwan=y
 CONFIG_PACKAGE_zlib=y
+# CONFIG_USE_APK is not set
 # CONFIG_USE_FS_ACL_ATTR is not set
 CONFIG_GARGOYLE_SMB_KSMBD=y
 # CONFIG_GARGOYLE_SMB_SAMBA is not set
diff --git a/targets/mediatek/patches/001-uboot-mediatek_serial_rx_buffer_size.patch b/targets/mediatek/patches/001-uboot-mediatek_serial_rx_buffer_size.patch
index 6b5fe6de07..ddb71481f4 100644
--- a/targets/mediatek/patches/001-uboot-mediatek_serial_rx_buffer_size.patch
+++ b/targets/mediatek/patches/001-uboot-mediatek_serial_rx_buffer_size.patch
@@ -1,12 +1,13 @@
 --- a/package/boot/uboot-mediatek/Makefile
 +++ b/package/boot/uboot-mediatek/Makefile
-@@ -911,7 +911,8 @@ UBOOT_CUSTOMIZE_CONFIG := \
+@@ -1311,7 +1311,9 @@
+ UBOOT_CUSTOMIZE_CONFIG := \
  	--disable TOOLS_KWBIMAGE \
  	--disable TOOLS_LIBCRYPTO \
- 	--disable TOOLS_MKEFICAPSULE \
--	--enable SERIAL_RX_BUFFER
+-	--disable TOOLS_MKEFICAPSULE
++	--disable TOOLS_MKEFICAPSULE \
 +	--enable SERIAL_RX_BUFFER \
 +	--set-val SERIAL_RX_BUFFER_SIZE 256
- 
+
  ifdef CONFIG_TARGET_mediatek
  UBOOT_MAKE_FLAGS += $(UBOOT_IMAGE:.fip=.bin)
diff --git a/targets/mediatek/profiles/default/config b/targets/mediatek/profiles/default/config
index 092471f016..e77758eedf 100644
--- a/targets/mediatek/profiles/default/config
+++ b/targets/mediatek/profiles/default/config
@@ -101,6 +101,7 @@ CONFIG_PACKAGE_wpad-openssl=m
 CONFIG_TARGET_INITRAMFS_COMPRESSION_NONE=y
 # CONFIG_TARGET_INITRAMFS_COMPRESSION_XZ is not set
 CONFIG_TARGET_ROOTFS_PARTSIZE=104
+# CONFIG_USE_APK is not set
 # CONFIG_USE_FS_ACL_ATTR is not set
 # CONFIG_ATH9K_HWRNG is not set
 CONFIG_GARGOYLE_SMB_KSMBD=y
diff --git a/targets/mediatek/profiles/filogic/config b/targets/mediatek/profiles/filogic/config
index 1148045570..7fd292fe0b 100644
--- a/targets/mediatek/profiles/filogic/config
+++ b/targets/mediatek/profiles/filogic/config
@@ -148,6 +148,7 @@ CONFIG_PACKAGE_wpad-openssl=m
 CONFIG_TARGET_INITRAMFS_COMPRESSION_NONE=y
 # CONFIG_TARGET_INITRAMFS_COMPRESSION_XZ is not set
 CONFIG_TARGET_ROOTFS_PARTSIZE=104
+# CONFIG_USE_APK is not set
 # CONFIG_USE_FS_ACL_ATTR is not set
 # CONFIG_ATH9K_HWRNG is not set
 CONFIG_GARGOYLE_SMB_KSMBD=y
diff --git a/targets/x86/profiles/alix/config b/targets/x86/profiles/alix/config
index 340fd94083..49292a400f 100644
--- a/targets/x86/profiles/alix/config
+++ b/targets/x86/profiles/alix/config
@@ -17,6 +17,7 @@ CONFIG_GRUB_TITLE="Gargoyle"
 # CONFIG_KERNEL_BTRFS_FS_POSIX_ACL is not set
 # CONFIG_KERNEL_CGROUPS is not set
 # CONFIG_KERNEL_CIFS_ACL is not set
+# CONFIG_KERNEL_EROFS_FS_POSIX_ACL is not set
 # CONFIG_KERNEL_EXT4_FS_POSIX_ACL is not set
 # CONFIG_KERNEL_EXT4_FS_SECURITY is not set
 # CONFIG_KERNEL_F2FS_FS_POSIX_ACL is not set
@@ -44,6 +45,7 @@ CONFIG_KERNEL_IO_URING=y
 # CONFIG_OPENSSL_WITH_SEED is not set
 CONFIG_OPENSSL_WITH_SSE2=y
 # CONFIG_OPENSSL_WITH_WHIRLPOOL is not set
+# CONFIG_PACKAGE_apk-mbedtls is not set
 CONFIG_PACKAGE_e100-firmware=y
 # CONFIG_PACKAGE_gargoyle-large is not set
 CONFIG_PACKAGE_hostapd-common=m
@@ -55,6 +57,7 @@ CONFIG_PACKAGE_kmod-e100=y
 CONFIG_PACKAGE_kmod-e1000=y
 CONFIG_PACKAGE_kmod-gre=y
 CONFIG_PACKAGE_kmod-hwmon-core=y
+CONFIG_PACKAGE_kmod-i2c-core=y
 CONFIG_PACKAGE_kmod-iptunnel=y
 # CONFIG_PACKAGE_kmod-ledtrig-gpio is not set
 CONFIG_PACKAGE_kmod-lib-zlib-deflate=y
@@ -101,6 +104,7 @@ CONFIG_PACKAGE_r8169-firmware=y
 # CONFIG_PACKAGE_wpad-mbedtls is not set
 # CONFIG_TARGET_EXT4_JOURNAL is not set
 CONFIG_TARGET_ROOTFS_PARTSIZE=256
+# CONFIG_USE_APK is not set
 # CONFIG_USE_FS_ACL_ATTR is not set
 CONFIG_GARGOYLE_SMB_KSMBD=y
 # CONFIG_GARGOYLE_SMB_SAMBA is not set
@@ -238,10 +242,7 @@ CONFIG_PACKAGE_kmod-usb-storage=y
 CONFIG_PACKAGE_kmod-usb-storage-extras=y
 CONFIG_PACKAGE_kmod-usb-storage-uas=y
 CONFIG_PACKAGE_kmod-usb-wdm=y
-# CONFIG_PACKAGE_kmod-video-async is not set
 CONFIG_PACKAGE_kmod-video-core=y
-# CONFIG_PACKAGE_kmod-video-cpia2 is not set
-# CONFIG_PACKAGE_kmod-video-fwnode is not set
 # CONFIG_PACKAGE_kmod-video-gspca-conex is not set
 CONFIG_PACKAGE_kmod-video-gspca-core=y
 # CONFIG_PACKAGE_kmod-video-gspca-etoms is not set
@@ -341,7 +342,6 @@ CONFIG_PACKAGE_tc-tiny=y
 CONFIG_PACKAGE_terminfo=y
 CONFIG_PACKAGE_ucode-mod-nl80211=y
 CONFIG_PACKAGE_ucode-mod-rtnl=y
-CONFIG_PACKAGE_ucode-mod-uloop=y
 CONFIG_PACKAGE_umbim=y
 CONFIG_PACKAGE_uqmi=y
 CONFIG_PACKAGE_usb-modeswitch=y
diff --git a/targets/x86/profiles/default/config b/targets/x86/profiles/default/config
index dfe9cc843c..64bca89996 100644
--- a/targets/x86/profiles/default/config
+++ b/targets/x86/profiles/default/config
@@ -16,6 +16,7 @@ CONFIG_GRUB_TITLE="Gargoyle"
 # CONFIG_KERNEL_BTRFS_FS_POSIX_ACL is not set
 # CONFIG_KERNEL_CGROUPS is not set
 # CONFIG_KERNEL_CIFS_ACL is not set
+# CONFIG_KERNEL_EROFS_FS_POSIX_ACL is not set
 # CONFIG_KERNEL_EXT4_FS_POSIX_ACL is not set
 # CONFIG_KERNEL_EXT4_FS_SECURITY is not set
 # CONFIG_KERNEL_F2FS_FS_POSIX_ACL is not set
@@ -42,6 +43,7 @@ CONFIG_KERNEL_IO_URING=y
 # CONFIG_OPENSSL_WITH_MDC2 is not set
 # CONFIG_OPENSSL_WITH_SEED is not set
 # CONFIG_OPENSSL_WITH_WHIRLPOOL is not set
+# CONFIG_PACKAGE_apk-mbedtls is not set
 # CONFIG_PACKAGE_gargoyle-large is not set
 CONFIG_PACKAGE_hostapd-common=m
 CONFIG_PACKAGE_kmod-crypto-md4=y
@@ -72,6 +74,7 @@ CONFIG_PACKAGE_plugin-gargoyle-upnp=y
 # CONFIG_PACKAGE_wpad-mbedtls is not set
 # CONFIG_TARGET_EXT4_JOURNAL is not set
 CONFIG_TARGET_ROOTFS_PARTSIZE=256
+# CONFIG_USE_APK is not set
 # CONFIG_USE_FS_ACL_ATTR is not set
 CONFIG_GARGOYLE_SMB_KSMBD=y
 # CONFIG_GARGOYLE_SMB_SAMBA is not set
@@ -213,10 +216,7 @@ CONFIG_PACKAGE_kmod-usb-storage=y
 CONFIG_PACKAGE_kmod-usb-storage-extras=y
 CONFIG_PACKAGE_kmod-usb-storage-uas=y
 CONFIG_PACKAGE_kmod-usb-wdm=y
-# CONFIG_PACKAGE_kmod-video-async is not set
 CONFIG_PACKAGE_kmod-video-core=y
-# CONFIG_PACKAGE_kmod-video-cpia2 is not set
-# CONFIG_PACKAGE_kmod-video-fwnode is not set
 # CONFIG_PACKAGE_kmod-video-gspca-conex is not set
 CONFIG_PACKAGE_kmod-video-gspca-core=y
 # CONFIG_PACKAGE_kmod-video-gspca-etoms is not set
@@ -317,7 +317,6 @@ CONFIG_PACKAGE_tc-tiny=y
 CONFIG_PACKAGE_terminfo=y
 CONFIG_PACKAGE_ucode-mod-nl80211=y
 CONFIG_PACKAGE_ucode-mod-rtnl=y
-CONFIG_PACKAGE_ucode-mod-uloop=y
 CONFIG_PACKAGE_umbim=y
 CONFIG_PACKAGE_uqmi=y
 CONFIG_PACKAGE_usb-modeswitch=y
diff --git a/targets/x86/profiles/vnet-wifi/config b/targets/x86/profiles/vnet-wifi/config
index 2782f066cb..2811a6927c 100644
--- a/targets/x86/profiles/vnet-wifi/config
+++ b/targets/x86/profiles/vnet-wifi/config
@@ -19,6 +19,7 @@ CONFIG_GRUB_TITLE="Gargoyle"
 # CONFIG_KERNEL_BTRFS_FS_POSIX_ACL is not set
 # CONFIG_KERNEL_CGROUPS is not set
 # CONFIG_KERNEL_CIFS_ACL is not set
+# CONFIG_KERNEL_EROFS_FS_POSIX_ACL is not set
 # CONFIG_KERNEL_EXT4_FS_POSIX_ACL is not set
 # CONFIG_KERNEL_EXT4_FS_SECURITY is not set
 # CONFIG_KERNEL_F2FS_FS_POSIX_ACL is not set
@@ -45,6 +46,7 @@ CONFIG_KERNEL_IO_URING=y
 # CONFIG_OPENSSL_WITH_MDC2 is not set
 # CONFIG_OPENSSL_WITH_SEED is not set
 # CONFIG_OPENSSL_WITH_WHIRLPOOL is not set
+# CONFIG_PACKAGE_apk-mbedtls is not set
 # CONFIG_PACKAGE_gargoyle-large is not set
 CONFIG_PACKAGE_iw=y
 CONFIG_PACKAGE_iwinfo=y
@@ -80,11 +82,13 @@ CONFIG_PACKAGE_plugin-gargoyle-captive-portal=y
 CONFIG_PACKAGE_plugin-gargoyle-qr-code=y
 CONFIG_PACKAGE_plugin-gargoyle-stamgr=y
 CONFIG_PACKAGE_plugin-gargoyle-upnp=y
+CONFIG_PACKAGE_ucode-mod-digest=y
 CONFIG_PACKAGE_wifi-scripts=y
 CONFIG_PACKAGE_wireless-regdb=y
 CONFIG_PACKAGE_wpa-cli=y
 # CONFIG_TARGET_EXT4_JOURNAL is not set
 CONFIG_TARGET_ROOTFS_PARTSIZE=256
+# CONFIG_USE_APK is not set
 # CONFIG_USE_FS_ACL_ATTR is not set
 CONFIG_GARGOYLE_SMB_KSMBD=y
 # CONFIG_GARGOYLE_SMB_SAMBA is not set
@@ -212,10 +216,7 @@ CONFIG_PACKAGE_kmod-usb-storage=y
 CONFIG_PACKAGE_kmod-usb-storage-extras=y
 CONFIG_PACKAGE_kmod-usb-storage-uas=y
 CONFIG_PACKAGE_kmod-usb-wdm=y
-# CONFIG_PACKAGE_kmod-video-async is not set
 CONFIG_PACKAGE_kmod-video-core=y
-# CONFIG_PACKAGE_kmod-video-cpia2 is not set
-# CONFIG_PACKAGE_kmod-video-fwnode is not set
 # CONFIG_PACKAGE_kmod-video-gspca-conex is not set
 CONFIG_PACKAGE_kmod-video-gspca-core=y
 # CONFIG_PACKAGE_kmod-video-gspca-etoms is not set
@@ -314,7 +315,6 @@ CONFIG_PACKAGE_rpcbind=y
 CONFIG_PACKAGE_share-users=y
 CONFIG_PACKAGE_tc-tiny=y
 CONFIG_PACKAGE_terminfo=y
-CONFIG_PACKAGE_ucode-mod-uloop=y
 CONFIG_PACKAGE_umbim=y
 CONFIG_PACKAGE_uqmi=y
 CONFIG_PACKAGE_usb-modeswitch=y
diff --git a/targets/x86/profiles/x64-wifi/config b/targets/x86/profiles/x64-wifi/config
index a5841da62a..5de1ab8fb9 100644
--- a/targets/x86/profiles/x64-wifi/config
+++ b/targets/x86/profiles/x64-wifi/config
@@ -20,6 +20,7 @@ CONFIG_GRUB_TITLE="Gargoyle"
 # CONFIG_KERNEL_BTRFS_FS_POSIX_ACL is not set
 # CONFIG_KERNEL_CGROUPS is not set
 # CONFIG_KERNEL_CIFS_ACL is not set
+# CONFIG_KERNEL_EROFS_FS_POSIX_ACL is not set
 # CONFIG_KERNEL_EXT4_FS_POSIX_ACL is not set
 # CONFIG_KERNEL_EXT4_FS_SECURITY is not set
 # CONFIG_KERNEL_F2FS_FS_POSIX_ACL is not set
@@ -47,6 +48,7 @@ CONFIG_OPENSSL_PREFER_CHACHA_OVER_GCM=y
 # CONFIG_OPENSSL_WITH_SEED is not set
 # CONFIG_OPENSSL_WITH_WHIRLPOOL is not set
 CONFIG_OPENVPN_gargoyle_mbedtls_ENABLE_LZO=y
+# CONFIG_PACKAGE_apk-mbedtls is not set
 CONFIG_PACKAGE_bnx2-firmware=m
 # CONFIG_PACKAGE_gargoyle-large is not set
 CONFIG_PACKAGE_iw=y
@@ -84,11 +86,13 @@ CONFIG_PACKAGE_plugin-gargoyle-captive-portal=y
 CONFIG_PACKAGE_plugin-gargoyle-qr-code=y
 CONFIG_PACKAGE_plugin-gargoyle-stamgr=y
 CONFIG_PACKAGE_plugin-gargoyle-upnp=y
+CONFIG_PACKAGE_ucode-mod-digest=y
 CONFIG_PACKAGE_wifi-scripts=y
 CONFIG_PACKAGE_wireless-regdb=y
 CONFIG_PACKAGE_wpa-cli=y
 # CONFIG_TARGET_EXT4_JOURNAL is not set
 CONFIG_TARGET_ROOTFS_PARTSIZE=256
+# CONFIG_USE_APK is not set
 # CONFIG_USE_FS_ACL_ATTR is not set
 CONFIG_GARGOYLE_SMB_KSMBD=y
 # CONFIG_GARGOYLE_SMB_SAMBA is not set
@@ -216,10 +220,7 @@ CONFIG_PACKAGE_kmod-usb-storage=y
 CONFIG_PACKAGE_kmod-usb-storage-extras=y
 CONFIG_PACKAGE_kmod-usb-storage-uas=y
 CONFIG_PACKAGE_kmod-usb-wdm=y
-# CONFIG_PACKAGE_kmod-video-async is not set
 CONFIG_PACKAGE_kmod-video-core=y
-# CONFIG_PACKAGE_kmod-video-cpia2 is not set
-# CONFIG_PACKAGE_kmod-video-fwnode is not set
 # CONFIG_PACKAGE_kmod-video-gspca-conex is not set
 CONFIG_PACKAGE_kmod-video-gspca-core=y
 # CONFIG_PACKAGE_kmod-video-gspca-etoms is not set
@@ -318,7 +319,6 @@ CONFIG_PACKAGE_rpcbind=y
 CONFIG_PACKAGE_share-users=y
 CONFIG_PACKAGE_tc-tiny=y
 CONFIG_PACKAGE_terminfo=y
-CONFIG_PACKAGE_ucode-mod-uloop=y
 CONFIG_PACKAGE_umbim=y
 CONFIG_PACKAGE_uqmi=y
 CONFIG_PACKAGE_usb-modeswitch=y
diff --git a/targets/x86/profiles/x64/config b/targets/x86/profiles/x64/config
index e4926f274a..26beb01703 100644
--- a/targets/x86/profiles/x64/config
+++ b/targets/x86/profiles/x64/config
@@ -17,6 +17,7 @@ CONFIG_GRUB_TITLE="Gargoyle"
 # CONFIG_KERNEL_BTRFS_FS_POSIX_ACL is not set
 # CONFIG_KERNEL_CGROUPS is not set
 # CONFIG_KERNEL_CIFS_ACL is not set
+# CONFIG_KERNEL_EROFS_FS_POSIX_ACL is not set
 # CONFIG_KERNEL_EXT4_FS_POSIX_ACL is not set
 # CONFIG_KERNEL_EXT4_FS_SECURITY is not set
 # CONFIG_KERNEL_F2FS_FS_POSIX_ACL is not set
@@ -44,6 +45,7 @@ CONFIG_OPENSSL_PREFER_CHACHA_OVER_GCM=y
 # CONFIG_OPENSSL_WITH_SEED is not set
 # CONFIG_OPENSSL_WITH_WHIRLPOOL is not set
 CONFIG_OPENVPN_gargoyle_mbedtls_ENABLE_LZO=y
+# CONFIG_PACKAGE_apk-mbedtls is not set
 CONFIG_PACKAGE_bnx2-firmware=m
 # CONFIG_PACKAGE_gargoyle-large is not set
 CONFIG_PACKAGE_hostapd-common=m
@@ -73,10 +75,10 @@ CONFIG_PACKAGE_miniupnpd-nftables=y
 CONFIG_PACKAGE_openssl-util=m
 CONFIG_PACKAGE_plugin-gargoyle-qr-code=y
 CONFIG_PACKAGE_plugin-gargoyle-upnp=y
-# CONFIG_PACKAGE_ucode-mod-uloop is not set
 # CONFIG_PACKAGE_wpad-mbedtls is not set
 # CONFIG_TARGET_EXT4_JOURNAL is not set
 CONFIG_TARGET_ROOTFS_PARTSIZE=256
+# CONFIG_USE_APK is not set
 # CONFIG_USE_FS_ACL_ATTR is not set
 CONFIG_GARGOYLE_SMB_KSMBD=y
 # CONFIG_GARGOYLE_SMB_SAMBA is not set
@@ -218,10 +220,7 @@ CONFIG_PACKAGE_kmod-usb-storage=y
 CONFIG_PACKAGE_kmod-usb-storage-extras=y
 CONFIG_PACKAGE_kmod-usb-storage-uas=y
 CONFIG_PACKAGE_kmod-usb-wdm=y
-# CONFIG_PACKAGE_kmod-video-async is not set
 CONFIG_PACKAGE_kmod-video-core=y
-# CONFIG_PACKAGE_kmod-video-cpia2 is not set
-# CONFIG_PACKAGE_kmod-video-fwnode is not set
 # CONFIG_PACKAGE_kmod-video-gspca-conex is not set
 CONFIG_PACKAGE_kmod-video-gspca-core=y
 # CONFIG_PACKAGE_kmod-video-gspca-etoms is not set