A Corrupted ISO Download Led One User to a Qualcomm Driver Bug in TP-Link's EAP770, Which Is End-of-Life

A user whose NixOS ISO download failed a TLS check on March 5, 2026 has traced the corruption to a DMA bug in the Qualcomm driver inside a TP-Link EAP770 access point, and says TP-Link will not fix it. The device is end-of-life, according to the support reply quoted in the blog post, published October 10 on the 0xdeafbeef blog.

The post does not name its author beyond the blog. Its claims about the device come from the author's own testing, and no second party has reproduced them in anything we found.

What the post says is broken

The unit is a TP-Link EAP770(EU) v1.0 Wi-Fi 7 access point with a Qualcomm IPQ9574 chip, bought in August 2023. It runs firmware 1.0.0 Build 20230605 Rel. 71641 on Linux 5.4.164.

The author says the qca-nss-dp driver reuses receive buffers without fully syncing the CPU cache, so dirty cache lines can be written back over newly arrived packets and corrupt 64-byte blocks. The hardware offload, called SFE and PPE in the post, then recalculates TCP checksums over the damaged data. TCP accepts the packet, and TLS or SSH catches it later as a bad message authentication code.

The corruption affects only bridged traffic going from a wired client to a Wi-Fi client, the post says. Disabling the offload stopped it, at a cost of about 8% download speed.

Why the author needed root

TP-Link's shell on the access point cannot write the two sysfs settings that turn the offload off. So the author wrote a local privilege escalation built on CVE-2022-0185, a public Linux kernel bug, plus known pipe-buffer techniques, and says it was developed in QEMU before it ran on the device.

The NVD record describes CVE-2022-0185 as a heap-based buffer overflow in legacy_parse_param, published 2022-02-11 with a CVSS 3.1 base score of 8.4. The affected ranges end before kernel releases 5.4.173, 5.10.93, 5.15.16 and 5.16.2. The access point's 5.4.164 sits below the first of those.

The NVD page also lists a CISA known-exploited addition date of 2024-08-21. The record says exploitation needs unprivileged user namespaces or the namespaced CAP_SYS_ADMIN privilege.

Item	Value in the sources
Device	TP-Link EAP770(EU) v1.0
Firmware	1.0.0 Build 20230605 Rel. 71641
Kernel	Linux 5.4.164
First fixed kernel in that branch	5.4.173 (NVD range for CVE-2022-0185)
Cost of disabling offload	about 8% download speed (author's figure)

What the author could not fix

The fix does not persist. The setting resets on reboot, so the access point has to be exploited again each time, the post says.

TP-Link support, contacted in June 2025, replied that v1 is end-of-life and "it is no longer supported with firmware updates." The post reports no response from Qualcomm. The author writes that Qualcomm could fix the driver or publish it somewhere more open, and says similar DMA issues in other Linux drivers are untested and that they do not know whom to report them to.

The post also describes a separate fault: Wi-Fi drops on a laptop with a Qualcomm WCN785x card, which the author attributes to closed firmware that stops sending data frames for 1 to 4 minutes. It is not the same bug.

What a reader with this access point can do

The post's only mitigation needs root and is lost at reboot, so it is not one for most owners.

No CVE has been assigned to the DMA bug in the post, and the author cites none. The kernel exploit used is a different, patched flaw: other vulnerabilities exploited before fixes shipped were zero-days, whereas this one is a 2022 bug on a device whose kernel predates the fix.

Vendors that do patch, such as Microsoft with its 1,411-flaw Patch Tuesday, at least publish a list. Qualcomm had not responded in the post as of October 10, and TP-Link has said no firmware is coming.