Reaper v3.7.3-beta — BQ16

v3.7.3 — Wallguard takes AdGuard Home rule lists; Chrome's Secure DNS no longer slips past the Encrypted DNS block; kernel CVE fixes; port trigger keeps live sessions

Everything in v3.7.2 is included. Both lines carry the same changes: RT-BE96U, RT-BE86U, RT-BE88U and GT-BE98 Pro on
3006.102.10; GT-BE98, GT-BE19000, BQ16 and BQ16 Pro on 3006.102.8.

• Advanced rules in Wallguard. A new box on the Wallguard page takes an AdGuard Home rule list as it is, up to
  40,000 characters: ||name^ blocks a name and its subdomains, |name| that name only, @@ allows, and
  $important, $client= (an address, a MAC or a device's name), $ctag= (a Wallguard profile), $dnstype=,
  $dnsrewrite=, wildcards and /regex/ all work. A rule for some devices applies to those devices only, and a
  block is never put on a name the router itself needs. After Save the page shows how many rules are in use and lists
  every line it could not use, with the reason. Invisible characters pasted with a list (zero-width spaces, byte-order
  marks) are removed and counted; a device's name in $client= can also be its DHCP reservation name.
• Chrome's Secure DNS no longer gets past the Encrypted DNS block. With the router's own DNS Privacy set to a
  Cloudflare family or security name, the block left all of cloudflare-dns.com open, so Chrome's "Secure DNS:
  Cloudflare" still worked. The provider name now stays blocked and only the router's own DoT name answers, and the
  built-in address list adds Chrome's Cloudflare endpoint and the missing IPv6 addresses of Firefox's.
• Kernel CVE fixes. CVE-2024-26921 (IP fragment reassembly kept a socket reference, ported to this 4.19 kernel),
  CVE-2023-4207 (the fw packet classifier) and CVE-2023-4623 (the HFSC scheduler), both use-after-free.
• Port trigger keeps live sessions. Any firewall change, such as Warden or Gatekeeper updating its rules, used to
  close every open trigger port, which dropped game and VoIP sessions. Each trigger rule now keeps its own ports; a
  rule you remove still closes its ports at once.
• Security Review watches /tmp and /var folders that any user could write. The router made six of them that way
  at every start (Samba's and Encrypted DNS's working folders); they are now created writable by root only, so the
  review no longer reports them after a flash.
• The lighttpd web server is built position-independent with FORTIFY checks, and its debug log is created
  readable by root only.
• Eight stock pages that nothing reached are gone (old access-point list and scan pages, the WAN auto-detect page,
  three AiProtection mobile pages and the old device list). Their addresses open the matching Reaper page.
• Rule Status: with the Encrypted DNS block on, the "reaches the Internet" rows no longer all read red; the
  checker now finds a test address that no block list holds.
• AiMesh shows a node location such as "First Floor" as typed, and the clocks on the dashboard and the top bar
  no longer jitter as the seconds change.

---

Images & checksums (BQ16)

Two flashable images: + AI Advisor (default) and Standard (noMCP, all AI components compiled out entirely). Flash the *_nand_squashfs.pkgtb via Administration > Firmware Upgrade.

This is a beta release. Its filename carries _BETA and the router reports the same string on the dashboard and the About page, so you can always tell which channel a flashed image came from. Stable releases carry no marker.

Variant	File	SHA-256
+ AI Advisor	BQ16_3006_102.8_Reaper_v3.7.3_BETA_nand_squashfs.pkgtb	b8b4bb5d930a404768ac76ac621f64cd1cee8a059a84f90778270eab2ec12182
Standard	BQ16_3006_102.8_Reaper_v3.7.3_BETA_noMCP_nand_squashfs.pkgtb	0af3fa4aa9d144c35d53f6f369f0dd0ef27ffa57621c8df1241795445fd091b3

Verify a download against the attached SHA256SUMS-BQ16-Reaper_v3.7.3.txt.

---

Corresponding source & reproducibility

The BQ16 image for v3.7.3-beta is built from this repository at tag v3.7.3-beta-BQ16: the pinned Asuswrt-Merlin base (3006.102.8-beta2, a7ebfa133a) plus the complete patch series. The tag freezes the exact source that produced it.

• Patches: patches/
• Provenance record: provenance/manifest.json
• How to verify: docs/REPRODUCIBILITY.md and docs/SOURCE-AVAILABILITY.md

The auto-attached Source code (zip/tar.gz) asset below is this repository at tag v3.7.3-beta-BQ16 (patches + docs).