TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A TP-Link EAP770 v1 owner traced corruption in large downloads to the access point’s Ethernet-to-Wi-Fi traffic path and suspected Qualcomm’s SFE/PPE offload. Because the vendor’s restricted shell could not change the two root-only settings he identified, he says he developed a kernel exploit for his own device; the supplied report ends before describing the exploit or confirming a vendor fix.
A TP-Link EAP770 v1 owner says he traced years of corrupted large downloads to the access point’s handling of traffic between Ethernet and Wi-Fi, then wrote a kernel exploit to change two settings that TP-Link’s restricted shell would not let him modify. The report points to Qualcomm’s SFE/PPE traffic offload as the likely source, but the supplied account does not include the exploit’s technical details or a confirmed vendor response.
The author said the problem first appeared in transfers of files larger than a few gigabytes, which sometimes failed with SSH message-authentication errors. Later, he observed failed HTTPS downloads and Git operations. In one March 5, 2026, NixOS ISO download, wget reported a TLS “bad record mac” error after receiving about 2.72 GB of a roughly 3.68 GB file. The author found that forcing HTTP/1.1 helped in some cases, but did not establish why.
To isolate the fault, he compared known data sent over raw TCP between a wired computer and a Wi-Fi laptop. He reported that corruption occurred with multiple simultaneous TCP streams travelling from the local network toward Wi-Fi. In a test involving 8,192 MiB, he found three damaged 64-byte blocks, each beginning with zeros. He also said the affected TCP segments had valid checksums, while the wireless frames’ CCMP message integrity checks remained intact. Those observations led him to place the fault inside the access point rather than on the client, the Ethernet cable or the radio link.
The author said that reviewing driver code suggested disabling two settings: /sys/sfe/l2_feature and /sys/sfe/ppe_rfs_feature. In his account, both are writable only by root, while the access point’s SSH shell runs with limited privileges and offers no corresponding setting in its web interface. He says he wrote an exploit to gain the access needed to change them. The source excerpt provided for this article cuts off before it explains how the exploit works, whether disabling the settings stopped the corruption, or whether TP-Link was notified.
A Firmware Gap Blocks a Workaround
The report describes a practical reliability problem: corrupted data can pass TCP checksum checks and then fail at a higher layer, leaving users to troubleshoot download clients, TLS or SSH instead of the network device. The author’s experience suggests that a flaw in an access point’s traffic path can be difficult to identify when ordinary network checks appear clean.
There is also a support concern. The author says TP-Link told him the EAP770 Version 1 was end-of-life and would receive no more firmware updates, despite the unit having shipped with its original firmware. If his diagnosis is correct, owners may have no official software update or user-accessible setting to address the issue. The account is one owner’s investigation, however; it does not establish how widespread the behavior is or whether other EAP770 units are affected.
Developing a kernel exploit for a device one owns can provide a way to test a workaround when the manufacturer’s interface blocks access. It also carries risks: changing low-level settings may disrupt networking or leave the device unusable, and the report excerpt does not say what safeguards or recovery options were available.
As an affiliate, we earn on qualifying purchases.
From Failed Transfers to Root Cause
The author said he bought the EAP770 v1 in August 2023. The device ran Linux 5.4.164 and firmware identified as version 1.0.0, Build 20230605 Rel. 71641. He reported seeing no firmware updates for the unit. When he contacted TP-Link support in June 2025, he said the company asked for photographs of the device and packaging before telling him that Version 1 was an end-of-life product. The report does not specify the day in June.
Early symptoms were intermittent, and some workarounds obscured the underlying issue. The author said transfers inside a Tailscale tunnel stopped requiring retries; he reasoned that WireGuard’s handling of failed authentication could cause packet loss and TCP retransmission. He also found that HTTP/1.1 downloads sometimes succeeded where HTTP/2 downloads failed, though he described the explanation as a guess. Separately, daily Wi-Fi dropouts that prompted renewed investigation were later attributed by the author to a different bug in the laptop’s closed-source Wi-Fi firmware, not to the access point’s suspected corruption issue.
In the account, the final suspect was Qualcomm’s Shortcut Forwarding Engine (SFE) and Packet Processing Engine (PPE), which can accelerate bridged traffic. The author reasoned that the 64-byte damage pattern was consistent with a cache or DMA problem and that offload could explain how a corrupted segment ended up with a valid checksum. These are the author’s interpretation of his tests, not an independently confirmed diagnosis from TP-Link or Qualcomm.
“The EAP770 Version 1 is an End-of-Life product. While it may still be available through some retailers, it is no longer supported with firmware updates.”
— TP-Link support, as quoted in the author’s report
As an affiliate, we earn on qualifying purchases.
Exploit Results Remain Unreported
The supplied source ends mid-sentence after the author describes rejecting a different model’s firmware and avoiding a direct flash-chip procedure. It does not provide the kernel exploit’s method, disclose whether it successfully changed the settings, or report test results after the change. There is also no confirmed statement from TP-Link or Qualcomm about the suspected offload issue.
It remains unclear whether the corruption affects other EAP770 v1 devices, which firmware versions may be involved, or whether the problem can be reproduced under conditions beyond the author’s tests. The author’s observations support a suspected fault in the access point’s bridged-traffic path, but they do not establish a confirmed root cause or a general security vulnerability affecting other users.
As an affiliate, we earn on qualifying purchases.
A Fix Needs Verification
The next useful step would be independent testing of the reported workaround: changing the two settings, then repeating the same known-data transfer tests and checking whether corruption stops. The report excerpt does not say whether that testing occurred, so no outcome should be assumed.
A vendor response, if one is issued, could clarify whether TP-Link can reproduce the fault, whether a firmware update or supported configuration option is possible, and whether the end-of-life decision leaves affected owners without an official remedy. Until that information is available, the reported diagnosis and exploit remain the account of one device owner rather than a confirmed manufacturer finding.
Ethernet to Wi-Fi traffic troubleshooting
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did the EAP770 owner report?
He said large transfers through a TP-Link EAP770 v1 were sometimes corrupted, and that tests pointed to traffic moving from Ethernet to Wi-Fi inside the access point.
Has Qualcomm’s SFE/PPE offload been confirmed as the cause?
No. The author identified it as the likely source based on his observations and review of driver code. The supplied account includes no independent confirmation from TP-Link or Qualcomm.
Why did he write a kernel exploit?
He said the two settings he wanted to test were root-only, while TP-Link’s SSH shell had limited privileges and its web interface offered no equivalent controls.
Did changing the settings fix the corrupted downloads?
The provided source excerpt does not report the result. It ends before saying whether the exploit changed the settings or whether the tests improved.
Is TP-Link issuing a firmware update?
No update is confirmed in the supplied material. The author says support described EAP770 Version 1 as end-of-life and no longer supported with firmware updates.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
