# Exploiting a Wi-Fi Access Point to Fix Data Corruption A deep dive into debugging hardware-level DMA cache incoherency through kernel exploitation. - **Source:** [Hacker News (news.ycombinator.com)](https://brifing.si/source/13c923cd-6d99-442b-9b8b-1181f4d8cd91) - **Published:** 2026-10-13 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/e1a2ca2a-f297-42a2-8e26-d40a689d5d65 ## Persistent Data Corruption The user experienced persistent data corruption during large file transfers over a TP-Link EAP770 Wi-Fi 7 access point. SSH reported MAC errors, and TLS connections failed with decryption errors. Despite debugging rsync and SSH, the issue remained, suggesting a lower-level network path failure between the wired Ethernet and wireless client interfaces. ## Hardware and Firmware Constraints The device, an EAP770 v1.0 running Linux 5.4.164, was declared end-of-life by TP-Link, leaving it without firmware updates. The user could not access GUI settings to disable problematic hardware offloading features. Because the device was unmaintained, the user faced a choice: replace the hardware or find a way to modify the system. ## Isolating the Failure Point Testing revealed that corruption occurred only in the LAN-to-Wi-Fi direction with multiple concurrent TCP streams. Since the TCP checksums remained valid, the hardware was recalculating them after the corruption occurred. This pointed directly to the Qualcomm SFE/PPE offload engine, which handles packet acceleration and checksum recalculation within the access point's bridge. ## Exploitation Strategy To disable the faulty offload, the user needed root access to write to sysfs files. TP-Link's shell ran with limited privileges, necessitating a kernel exploit. The user utilized CVE-2022-0185, an integer underflow in legacy_parse_param, combined with pipe-buffer manipulation to achieve an arbitrary write primitive and elevate privileges within the restricted Linux environment. ## Development and Stability The exploit was developed using a QEMU harness based on EAP783 source code, as the v1 source was unavailable. Because the kernel lacked KASLR, addresses were consistent, but physical offsets differed from the QEMU environment. The final exploit provided a single-shot mechanism per boot, requiring careful iteration to ensure system stability. ## DMA Cache Incoherency The root cause was identified as a DMA cache maintenance bug in Qualcomm's out-of-tree NSS driver. The driver reused packet buffers without properly synchronizing CPU caches. Consequently, dirty cache lines were written back to DRAM after the NIC received new data, overwriting parts of the packet before the SFE engine recalculated the checksum. ## The Role of Fast Recycling The driver's fast-transmit path set a fast_recycled flag, which caused the receive path to skip necessary cache invalidation operations. This optimization assumed the buffer was clean, but it failed to account for dirty lines outside the specific range cleaned during transmit. This led to silent data corruption on the arm64 architecture. ## Performance Trade-offs Disabling the SFE/PPE offload engine successfully stopped the data corruption. This fix resulted in an approximately 8% reduction in total download throughput. However, the user prioritized data integrity over raw speed, as large file transfers now consistently succeed without the need for retries or manual intervention during the download process. ## Automating the Fix Since the offload settings reset after every reboot, the user implemented a watcher script on their NAS. This script polls the access point and re-runs the exploit if the offload is re-enabled. If the exploit fails, the script triggers a reboot via the management API, with a hard cap on attempts. ## Broader Implications The user discovered similar DMA cache maintenance issues in other Linux drivers, suggesting that this class of bug may be widespread in embedded systems. While the user successfully mitigated the issue on their specific device, they noted that the underlying Qualcomm code remains problematic for other hardware vendors using the same driver stack. ## AI Tool Limitations During the process, the user noted that Opus 5.5 frequently blocked sessions when discussing local privilege escalation or reading the technical article. In contrast, older versions like Opus 4.8 and other models like GPT-6 Astra handled the technical content without triggering the same security-related session termination guards, complicating the research workflow. ## Lessons in Hardware Ownership This case highlights the risks of purchasing non-certified, early-standard hardware from vendors with poor long-term support policies. When manufacturers abandon devices, users are forced to perform invasive kernel-level repairs to maintain basic functionality. It serves as a stark reminder that software-defined hardware is only as reliable as its ongoing maintenance cycle. ## Sources covering this story - https://blog.dfb.sh/blog/eap770-root-for-two-zeros/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._