Reaper v3.4.6-beta — GT-BE98

v3.4.6 — the channel picker follows the AiMesh nodes, portal passcodes, WAN link reset, Merlin 3006.102.10 carries

Everything in v3.4.5 is included.

• AiMesh: the 5 GHz channel picker stays on channels every node can use. Field (owner RT-BE96U with an
  RT-AX92U node, MLO on): after a failed DFS check the radio's own fall-back parked it on a channel the node
  could not follow, inside the mesh controller's exclusion list, for two hours. The main router now reads the
  per-node channel lists the AiMesh controller already collects, fits each radio to the block every node can
  use, and hands those exclusions to the picker. When the exclusions in force leave the nodes nothing but DFS
  channels, the stock Auto-width exclusions every node can use (149–161 at 80 MHz, in the US) are allowed
  again and written through to the running picker; a radio found outside the plan for a minute is moved to a
  channel the nodes can use, and the controller holds still while a node is joining. On by default and inert
  until a node is registered; switch on the Wireless page, status in Diagnostics (node fit:). Logged as
  reaper_bwfloor: wlN: channels fitted to N AiMesh node(s) .... Host test test_mesh_chanfit.py.
• Guest network portal: a passcode of 16 or more characters failed every sign-in. The portal only uses the
  first 16 characters of what the visitor types, and the stored passcode is compared whole. The passcode field
  now stops at 15 characters, a longer value is refused on save, and a profile that already holds a longer one
  shows a hint; the stored value is left untouched.
• 10G fibre ONTs that drop packets (Nokia ONTs reported): the ONT does not complete the Energy-Efficient
  Ethernet handshake. EEE was already switched off on every port at boot; the WAN port is now also power-
  cycled at switch init on every model, so the link renegotiates before EEE goes off. The fix is ASUS's own
  (GPL 102_40585) as merged by Eric "Merlin" Sauvageau in Asuswrt-Merlin 3006.102.10; the LAN-port bounce
  and the external-PHY reset that come with it are not taken. Verified on the owner's 10G WAN; the ONT case
  itself needs a reporter with that ONT.
• Hardening carried from Eric "Merlin" Sauvageau's Asuswrt-Merlin 3006.102.10: wanduck's socket cleanup,
  Host: parsing and resolver error text; a WPS PIN must be digits only (a PIN such as 0;reboot passed the
  checksum and reached the hostapd command line); eight httpd upload handlers no longer walk past a missing
  header boundary; nvram_check() and validate_apply() guard their NULLs; the unused Main_AdmStatus
  system-command route is gone; the IPsec ICMP rule uses the real LAN netmask; LLMNR bounds its loop entry;
  the USB mount check reads labels of any length (a stack overflow on escaped labels) and no longer leaks a
  file handle; Time Machine, libdisk and minidlna take the upstream fixes verbatim. Two refinements were
  deliberately not taken (see the commit message).
• Repository: the public history was rewritten on 2026-10-17 — test fixtures, docs and patch text now use
  documentation addresses (RFC 3849/5737/7042) instead of real network values, and two vendored packages
  no longer carry their upstream test trees. Anyone with a clone or fork needs to re-clone; the published
  images and provenance records are unchanged. Build gates: the repo's personal-data scan runs on every
  push and in the cut, and every image is checked for private-key material before it ships (the only
  allowed blocks are GnuTLS's six public self-test vectors, pinned by hash).

---

Images & checksums (GT-BE98)

Two flashable images: + AI Advisor (default) and Standard (noMCP, all AI components compiled out entirely). Flash the *_nand_squashfs.pkgtb via Administration > Firmware Upgrade.

This is a beta release. Its filename carries _BETA and the router reports the same string on the dashboard and the About page, so you can always tell which channel a flashed image came from. Stable releases carry no marker.

Variant	File	SHA-256
+ AI Advisor	GT-BE98_3006_102.8_Reaper_v3.4.6_BETA_nand_squashfs.pkgtb	9ebee6fb072b8ce9b38507aff0e61d55ccc40541b57f1284c12021762f676b12
Standard	GT-BE98_3006_102.8_Reaper_v3.4.6_BETA_noMCP_nand_squashfs.pkgtb	02aee89618315bc840ffe51fea6f63dfdb2aff7001b41f413231dd52cebd2dcd

Verify a download against the attached SHA256SUMS-GT-BE98-Reaper_v3.4.6.txt.

---

Corresponding source & reproducibility

The GT-BE98 image for v3.4.6-beta is built from this repository at tag v3.4.6-beta-GT-BE98: the pinned Asuswrt-Merlin base (3006.102.8-beta2, a7ebfa133a) plus the complete patch series. The tag freezes the exact source that produced it.

• Patches: patches/
• Provenance record: provenance/manifest.json
• How to verify: docs/REPRODUCIBILITY.md and docs/SOURCE-AVAILABILITY.md

The auto-attached Source code (zip/tar.gz) asset below is this repository at tag v3.4.6-beta-GT-BE98 (patches + docs).