staging/stintel/package, branch master

ucode: update to Git HEAD (2026-07-09)

2026-07-16T09:50:22Z

20a2ae469089 io: support older linux ioctls 16929698e2d3 fs: implement ioctl for macOS 395bb888bd69 io: implement ioctl for macOS 8d7d15ee1a08 compiler: add support for shorthand method declarations 7d9febd13305 nl80211: add mesh peer link enum macros to constants list e851bb64df91 lib: avoid allocating print buffer before NULL check in uc_error_message_indent 5f3a7b87d962 compiler: prevent unbounded recompilation on failed module imports e2493b577250 compiler: scope named function expression names to their own body c3f0d27d812e tests: add regression test for named function expression scoping 738b55299966 vm: release owned value when property assignment fails 1ffd7c5a1011 vm: fix out-of-bounds read in single-name module import a255256db106 vm: fix SIGFPE on INT64_MIN division and modulo by -1 3f4b313d7d78 vm: do not assign to undeclared variables in strict mode e523682670a2 vm: release upvalue reference when resolving it on stack push 6a837090bea3 vm: release module scope reference in dynamic import 395a0a16b4f9 vm: guard error context capture against empty callframe stack 04f103bb2270 vm: respect exponent parity in integer exponentiation bd814a4b2ae3 vm: use UC_ARRAY instead of json_type_array in object spread 5a79aa56c15e vm: release resource type prototypes after the final GC 9c5f16c8e33a lexer: do not treat /*/ as a complete block comment a018067fd12e lexer: preserve NUL bytes in regular expression literals 65d41a1929de lexer: do not consume a sign into hexadecimal number literals 05f9bf9e5d53 lexer: fix source position of ternary question mark token 7bca646e5f88 lib: preserve embedded NUL bytes in reverse() 6fc93bf5bd95 lib: preserve embedded NUL bytes in lc() and uc() a51f4843bce5 lib: avoid passing a signed char to isxdigit() in hex() e8af70e4375c compiler: fix use-after-free of shorthand method name 467fb4406a47 compiler: declare leading variable in counting for loop initializer d256e153799b rtnl: fix stack buffer overflow parsing IFLA_LINKINFO f741ac0a144c rtnl: fix stack buffer overflow parsing RTA_MULTIPATH nexthops c41310f7c2df rtnl: fix inverted address check in multipath nexthop parsing Signed-off-by: Felix Fietkau

wifi-scripts: don't swap handler config under a running setup script

2026-07-16T09:50:22Z

A reload during an in-flight setup ran wdev_config_init() immediately, replacing handler_config/handler_data while the script was still running, so its set_data notifications resolved against the new (renumbered) interface table and link up/down calls became asymmetric. Defer the re-init in check() while a handler run is in progress and re-apply from the setup and teardown callbacks once it completes. Signed-off-by: Felix Fietkau

wifi-scripts: only manage wdev interfaces recorded in the statefile

2026-07-16T09:50:22Z

wdev.uc adopted every operstate-down netdev on the phy and then removed any not in its new config. hostapd BSS netdevs are legitimately operstate-down while stopped (co-located STA down, or start_disabled), so a reload deleted them and hostapd, seeing an unchanged config, never recreated them. Drop the adopt-existing step; the statefile already tracks the interfaces wdev.uc owns. Signed-off-by: Felix Fietkau

wifi-scripts: give the OWE-transition BSS its own MAC address

2026-07-16T09:50:22Z

The transition BSS is a copy of the main BSS with the MAC already set, so iface.prepare() was a no-op and both BSSes emitted the same bssid; with a fixed or random MAC the duplicate was never reassigned and the second interface failed to come up. Clear the address (and stale flags) and prepare a fresh one, plumbing the phy/num_global/macaddr_base through iface_setup(). Signed-off-by: Felix Fietkau

wifi-scripts: emit per-line hostapd options correctly

2026-07-16T09:50:22Z

append() space-joins list options into one line, which breaks hostapd options that are parsed one entry per line: anqp_elem, nai_realm, venue_name, venue_url, hs20_conn_capab and the radius req_attr lists (a parse error there fails the whole phy). Add append_list() to emit one line per element and route those options through it. vendor_elements is instead a single concatenated hex blob (join ''), and iface_interworking() no longer overwrites domain_name with the 3GPP cell-net data (and uses ';'). Signed-off-by: Felix Fietkau

wifi-scripts: use country_code for iw reg set in setup_phy

2026-07-16T09:50:22Z

validate() converts the country alias to country_code and deletes country before setup_phy() runs, so the iw reg set branch tested a null config.country and never ran, leaving wdev-only radios (adhoc/mesh/monitor) on the world regdomain. Use config.country_code. Signed-off-by: Felix Fietkau

hostapd: ucode: keep comment lines out of the config comparison data

2026-07-16T09:50:22Z

The generator emits a '# Setup interface: ' comment before each interface, so the first one landed in config.radio.data and made the radio comparison depend on the first BSS's ifname: renaming it forced a full radio restart instead of the rename path. Skip comment lines when parsing radio.data/bss.data. Signed-off-by: Felix Fietkau

hostapd: ucode: filter MLD loops by phy in phy_set_state/phy_status

2026-07-16T09:50:22Z

The per-wiphy radio-mask loops iterated all MLDs without checking the phy, so a stop/start or status query for one wiphy touched MLDs on another wiphy with the same radio index (clearing present bits, tearing links down, or reporting a foreign MLD). Skip MLDs that do not belong to the phy, matching mld_update_phy(). Signed-off-by: Felix Fietkau

wifi-scripts: quote dpp_connector in the station config

2026-07-16T09:50:22Z

dpp_connector was emitted unquoted, but wpa_supplicant parses it as a string and hex-decodes an unquoted value; a base64url connector then failed to parse and the network block was rejected. Emit it via the quoted-string list. dpp_csign/dpp_netaccesskey stay raw, as they are hex. Signed-off-by: Felix Fietkau

hostapd: ucode: unregister ucode/ubus objects when deleting an unstarted BSS

2026-07-16T09:50:22Z

hostapd_free_hapd_data() skips hostapd_ucode_free_bss()/hostapd_ubus_free_bss() for a bss that never started, so bss.delete() on such a bss freed hapd while the ucode registry entry and ubus object still referenced it. Call both explicitly before os_free(); they are idempotent for the started case. Signed-off-by: Felix Fietkau