A user discovered a significant hardware-level bug in their TP-Link EAP770 v1 Wi-Fi 7 access point that caused data corruption during large file transfers. The issue manifested as 'bad record mac' errors during HTTPS downloads and failed `rsync` transfers, even though the TCP checksums appeared valid. Through packet analysis and driver inspection, the user identified the culprit as a DMA cache coherency bug in Qualcomm's `qca-nss-dp` driver. Specifically, the driver's fast transmit path fails to synchronize the CPU cache for the entire receive buffer before handing it back to the Network Interface Card (NIC). This allows 'dirty' cache lines from previous operations to be written back into the DRAM, overwriting 64-byte blocks of the new packet data.
The corruption is exacerbated by the device's SFE/PPE (Switch Fabric Engine / Packet Process Engine) offload features. These features accelerate bridged traffic by recalculating TCP checksums after the data has already been corrupted in memory. Because the checksums are recalculated over the corrupted payload, the TCP layer accepts the segments as valid, leaving the end-to-end integrity checks in TLS and SSH to catch the errors. The user determined that the fix required disabling two specific sysfs settings: `l2_feature` and `ppe_rfs_feature`. However, TP-Link classified the v1 hardware as 'End-of-Life' and refused to provide a firmware update, and the device's default SSH shell provided no permissions to modify these settings.
To bypass these restrictions, the user developed a kernel exploit to gain root privileges. The exploit leveraged CVE-2022-0185, an integer underflow in the Linux kernel's `legacy_parse_param()` function, which allows an unprivileged user to trigger a write overflow in a 4 KiB slab object. By grooming the kernel memory and manipulating pipe buffers, the user was able to achieve an arbitrary write, eventually overwriting the `modprobe_path` to execute a shell with global root privileges. This allowed them to manually disable the faulty offload features, successfully stopping the data corruption without needing a manufacturer-provided patch. The user noted that while the system was well-hardened against common exploits, the lack of maintenance on older hardware forced the use of kernel-level primitives to resolve a fundamental driver flaw.
The user's process of identifying a DMA cache coherency bug and eventually developing a kernel exploit to bypass hardware limitations.