Exploiting a Wi-Fi Access Point to Fix Data Corruption
A deep dive into debugging hardware-level DMA cache incoherency through kernel exploitation.
1Persistent Data Corruption
The user experienced persistent data corruption during large file transfers over a TP-Link EAP770 Wi-Fi 7 access point. SSH reported MAC errors, and TLS connections failed with decryption errors. Despite debugging rsync and SSH, the issue remained, suggesting a lower-level network path failure between the wired Ethernet and wireless client interfaces.
2Hardware and Firmware Constraints
The device, an EAP770 v1.0 running Linux 5.4.164, was declared end-of-life by TP-Link, leaving it without firmware updates. The user could not access GUI settings to disable problematic hardware offloading features. Because the device was unmaintained, the user faced a choice: replace the hardware or find a way to modify the system.
3Isolating the Failure Point
Testing revealed that corruption occurred only in the LAN-to-Wi-Fi direction with multiple concurrent TCP streams. Since the TCP checksums remained valid, the hardware was recalculating them after the corruption occurred. This pointed directly to the Qualcomm SFE/PPE offload engine, which handles packet acceleration and checksum recalculation within the access point's bridge.
4Exploitation Strategy
To disable the faulty offload, the user needed root access to write to sysfs files. TP-Link's shell ran with limited privileges, necessitating a kernel exploit. The user utilized CVE-2022-0185, an integer underflow in legacy_parse_param, combined with pipe-buffer manipulation to achieve an arbitrary write primitive and elevate privileges within the restricted Linux environment.
5Development and Stability
The exploit was developed using a QEMU harness based on EAP783 source code, as the v1 source was unavailable. Because the kernel lacked KASLR, addresses were consistent, but physical offsets differed from the QEMU environment. The final exploit provided a single-shot mechanism per boot, requiring careful iteration to ensure system stability.
6DMA Cache Incoherency
The root cause was identified as a DMA cache maintenance bug in Qualcomm's out-of-tree NSS driver. The driver reused packet buffers without properly synchronizing CPU caches. Consequently, dirty cache lines were written back to DRAM after the NIC received new data, overwriting parts of the packet before the SFE engine recalculated the checksum.
7The Role of Fast Recycling
The driver's fast-transmit path set a fast_recycled flag, which caused the receive path to skip necessary cache invalidation operations. This optimization assumed the buffer was clean, but it failed to account for dirty lines outside the specific range cleaned during transmit. This led to silent data corruption on the arm64 architecture.
8Performance Trade-offs
Disabling the SFE/PPE offload engine successfully stopped the data corruption. This fix resulted in an approximately 8% reduction in total download throughput. However, the user prioritized data integrity over raw speed, as large file transfers now consistently succeed without the need for retries or manual intervention during the download process.
9Automating the Fix
Since the offload settings reset after every reboot, the user implemented a watcher script on their NAS. This script polls the access point and re-runs the exploit if the offload is re-enabled. If the exploit fails, the script triggers a reboot via the management API, with a hard cap on attempts.
10Broader Implications
The user discovered similar DMA cache maintenance issues in other Linux drivers, suggesting that this class of bug may be widespread in embedded systems. While the user successfully mitigated the issue on their specific device, they noted that the underlying Qualcomm code remains problematic for other hardware vendors using the same driver stack.
11AI Tool Limitations
During the process, the user noted that Opus 5.5 frequently blocked sessions when discussing local privilege escalation or reading the technical article. In contrast, older versions like Opus 4.8 and other models like GPT-6 Astra handled the technical content without triggering the same security-related session termination guards, complicating the research workflow.
12Lessons in Hardware Ownership
This case highlights the risks of purchasing non-certified, early-standard hardware from vendors with poor long-term support policies. When manufacturers abandon devices, users are forced to perform invasive kernel-level repairs to maintain basic functionality. It serves as a stark reminder that software-defined hardware is only as reliable as its ongoing maintenance cycle.