b43 802.11n for the BCM4331 (Netgear R6400) — rc11 (test version)

Test version. OpenWrt images for the Netgear R6400 v1/v2 with 802.11n for the BCM4331 2.4 GHz radio (b43).

rc11 is Rosen Penev's updated b43 802.11n series, openwrt/openwrt#25922 at fe90f890dc (2026-11-02), plus six patches of ours (890–895) and a wifi-scripts change. What they do, the test results and how to build it yourself: b43-80211n/README.md.

What is new compared with rc10:

• Rebased on his update, which adds among others the transmit I/Q and LO calibration for HT-PHY, CCK reception only when the network uses it, our R6400 analog-PA front-end fix, and firmware 784.2 as the new default (the image brings it along).
• Our patches are renumbered 890–895 (his series now uses 862–869). rc10's 864 is dropped, because his series now does the same; the RX I/Q calibration (893, was 866) now runs after his new transmit calibration. The other patches are unchanged.

Upgrading from rc9 or rc10: nothing to change in the settings.

Tests: alternated against rc10 on the R6400 v1 (with the v2 as client) and on the R6400 v2 (with an ath11k client): the same speed (about 97–103 Mbit/s up, 98–102 down), on the v2 MCS 15 loss 1.3–3.0 % against 1.8–4.6 % with rc10, no ping loss, no b43 errors; firmware 784.2 against 666.2 on the v1: the same speed. No long soak test this time: our patches are unchanged from rc10.

OpenWrt snapshot r38011-46e6335fbd, kernel 6.18.60, b43 firmware 784.2.

Router	board ID	Image
R6400 v1	U12H332T00_NETGEAR	openwrt-r6400-v1-b43-80211n-rc11-squashfs.chk
R6400 v2	U12H332T20_NETGEAR	openwrt-r6400-v2-b43-80211n-rc11-squashfs.chk
R6400 v2 (OTP)	U12H332T30_NETGEAR	openwrt-r6400-v2-otp-b43-80211n-rc11-squashfs.chk

Check the SHA-256 sums (sha256sums) before flashing, and have a way back (Netgear's TFTP/nmrp recovery). Analysis, measurements and the patches were done with the help of an LLM (Anthropic's Claude). Thanks to Rosen Penev (@neheb) for openwrt/openwrt#25922.

b43 802.11n for the BCM4331 (Netgear R6400) — rc10 (test version)

Test version. OpenWrt images for the Netgear R6400 v1/v2 with 802.11n for the BCM4331 2.4 GHz radio (b43).

rc10 is Rosen Penev's b43 802.11n series, openwrt/openwrt#25922 at 0615bc0150 (the same as in rc9), plus seven patches of ours (862–868) and a wifi-scripts change. What they do, the test results and how to build it yourself: b43-80211n/README.md.

What is new compared with rc9:

• 866 (RX I/Q calibration) reworked: it now calibrates only the operating channel, once each time the radio starts, and only at 2.4 GHz. rc9 also calibrated on the channels mac80211 sets while an interface starts or stops, which gave an odd result at interface stop on the R6400 v1 and up to four calibrations per start.
• 868 (new): drop the A-MSDU subframes the MAC splits off. b43 passed them on as whole frames, and with hardware encryption that could make mac80211 drop all later traffic of a client as replays. A precaution on the R6400 (none of our clients sent A-MSDUs to it); it stopped 5 GHz uploads on a Linksys EA6900.

Upgrading from rc9: nothing to change in the settings.

Tests: rc10 against rc9 alternated on the R6400 v2 with an ath11k client: the same speed (about 97 Mbit/s up, 101 down) and the same MCS 15 loss; a 43-minute soak with restarts and scans without errors; 868 for 20 hours on the R6400 v1 with a phone. The 9.5-hour rc9 soak test is in the README.

OpenWrt snapshot r37930-a1788e6156, kernel 6.18.55.

Router	board ID	Image
R6400 v1	U12H332T00_NETGEAR	openwrt-r6400-v1-b43-80211n-rc10-squashfs.chk
R6400 v2	U12H332T20_NETGEAR	openwrt-r6400-v2-b43-80211n-rc10-squashfs.chk
R6400 v2 (OTP)	U12H332T30_NETGEAR	openwrt-r6400-v2-otp-b43-80211n-rc10-squashfs.chk

Check the SHA-256 sums (sha256sums) before flashing, and have a way back (Netgear's TFTP/nmrp recovery). Analysis, measurements and the patches were done with the help of an LLM (Anthropic's Claude). Thanks to Rosen Penev (@neheb) for openwrt/openwrt#25922.

b43 802.11n for the BCM4331 (Netgear R6400) — rc9 (test version)

Test version. OpenWrt images for the Netgear R6400 v1/v2 with 802.11n for the BCM4331 2.4 GHz radio (b43).

rc9 is Rosen Penev's b43 802.11n series, openwrt/openwrt#25922 at 0615bc0150, plus six patches of ours (862–867) and a wifi-scripts change. What they do, the test results and how to build it yourself: b43-80211n/README.md.

What is new compared with rc8:

• The base is now Rosen Penev's series, which contains most of rc8 in his own form; it has no module parameters (the rc8 ones are gone: clear /etc/modules.d/b43 back to just b43).
• 863: the R6400 v1 no longer loses ~10 dB of transmit power to the table 9 upload.
• 866: RX I/Q calibration; the R6400 v1 lost up to a third of the top-rate (MCS 15) frames from a client without it.
• 867: receive A-MPDUs of up to 64 KiB (upload +17 % on the R6400 v2).
• 2 ms best effort frame bursting by default on b43: much fairer when a client uploads and downloads at once.
• 862: NAPI fix for SDIO devices (not used by the R6400).

Soak test: 9.5 hours, R6400 v1 as access point with an R6400 v2, an ath11k router and a phone as clients: averages of 96–108 Mbit/s per client and direction, no kernel errors, stalls or hangs.

OpenWrt snapshot r37744-7d0bf92bee, kernel 6.18.

Router	board ID	Image
R6400 v1	U12H332T00_NETGEAR	openwrt-r6400-v1-b43-80211n-rc9-squashfs.chk
R6400 v2	U12H332T20_NETGEAR	openwrt-r6400-v2-b43-80211n-rc9-squashfs.chk
R6400 v2 (OTP)	U12H332T30_NETGEAR	openwrt-r6400-v2-otp-b43-80211n-rc9-squashfs.chk

Check the SHA-256 sums (sha256sums) before flashing, and have a way back (Netgear's TFTP/nmrp recovery). Analysis, measurements and the patches were done with the help of an LLM (Anthropic's Claude). Thanks to Rosen Penev (@neheb) for openwrt/openwrt#25922.

b43 802.11n for the BCM4331 (Netgear R6400) — rc8 (test version)

Test images for the Netgear R6400 v1 and v2 with the b43 802.11n series rc8 (patches 820–839, see b43-80211n).

OpenWrt snapshot r37507-4e16c2ed8f, kernel 6.18. Pick the image by the router's board ID:

Router	board ID	Image
R6400 v1	U12H332T00_NETGEAR	openwrt-r6400-v1-b43-80211n-rc8-squashfs.chk
R6400 v2	U12H332T20_NETGEAR	openwrt-r6400-v2-b43-80211n-rc8-squashfs.chk
R6400 v2 (OTP)	U12H332T30_NETGEAR	openwrt-r6400-v2-otp-b43-80211n-rc8-squashfs.chk

Changes since rc7:

• The module parameter ht_txgain_idx is gone. Patch 824 now sets the static transmit gain only on boards whose SPROM board flags show an external front end (BFL_FEM or BFL_HGPA). This is the same check as in Rosen Penev's openwrt/openwrt#25922. On the R6400 nothing changes: index 24 on the v1, 16 on the v2 (logread | grep "static TX gain").
  • If /etc/modules.d/b43 still holds ht_txgain_idx, remove it there. The kernel ignores it with a warning.
• 827: the radio hang detector no longer restarts the radio of an idle access point on a quiet channel. It now also watches the CRS glitch counter, which a working receiver keeps counting when no frames arrive.
• 827: the firmware's header format is checked after the firmware upload, when it is known.
• The other patches are unchanged in code.

Test: a 10.3-hour soak test with the R6400 v2 as access point (HT20, channel 9) and an IPQ8074 router (ath11k) as client, plus a phone now and then.

• 18 load runs: 92–101 Mbit/s download, 106–110 Mbit/s upload, MCS 15 short GI.
• 14.6 million frames; 76 frames given up.
• No stalls, hangs, block-ack window resets or receive errors; memory stable.

The R6400 v1 uses the same gain index as with rc7 (24); rc8 was not soak-tested on it.

See the rc7 and rc6 releases, the README for all module parameters and tools, and PROVENANCE.md for where every patch comes from.

This is a test version.

• Check the SHA-256 sums (sha256sums).
• Have a way back (Netgear TFTP/nmrp recovery).
• Read Known limitations and the note on htmode when keeping settings in the README.

Reports are welcome as issues.

b43 802.11n for the BCM4331 (Netgear R6400) — rc7 (test version)

Test images for the Netgear R6400 v1 and v2 with the b43 802.11n series rc7 (patches 820–839, see b43-80211n).

OpenWrt snapshot r37195-66ee7b6950, kernel 6.18. Pick the image by the router's board ID:

Router	board ID	Image
R6400 v1	U12H332T00_NETGEAR	openwrt-r6400-v1-b43-80211n-rc7-squashfs.chk
R6400 v2	U12H332T20_NETGEAR	openwrt-r6400-v2-b43-80211n-rc7-squashfs.chk
R6400 v2 (OTP)	U12H332T30_NETGEAR	openwrt-r6400-v2-otp-b43-80211n-rc7-squashfs.chk

Changes since rc6:

• 822 (BCM4331 external front end) is rewritten. The earlier version was ported from a decompiled Broadcom driver. The rc7 version rests only on open sources and on measurements of the hardware:

  • Linux bcma;
  • Broadcom's ISC-licensed chip-control and board-flag definitions;
  • register read-back under Netgear's and DD-WRT's Broadcom drivers.

  Every value and its source is listed in PROVENANCE.md, together with where every other patch comes from.

• It sets exactly the same hardware state as before, also from a cold start, so nothing changes in use. A 100-minute soak test (R6400 v1 access point, R6400 v2 client) gave 89.5 / 92.2 Mbit/s with no stalls, hangs or receive errors, the same as rc5/rc6.

• 824, 833 and 839 differ only in line offsets; all other patches are unchanged.

Everything else is rc6:

• Rosen Penev's PMF fix (839);
• two transmit streams by default;
• one hardware queue per WMM class;
• multi-rate retry.

See the rc6 and rc5 releases, and the README for all module parameters and tools.

This is a test version.

• Check the SHA-256 sums (sha256sums).
• Have a way back (Netgear TFTP/nmrp recovery).
• Read Known limitations and the note on htmode when keeping settings in the README.

Reports are welcome as issues.

b43 802.11n for the BCM4331 (Netgear R6400) — rc6 (test version)

Test images for the Netgear R6400 v1 and v2 with the b43 802.11n series rc6 (patches 820–839, see b43-80211n).

OpenWrt snapshot r37195-66ee7b6950, kernel 6.18. Pick the image by the router's board ID:

Router	board ID	Image
R6400 v1	U12H332T00_NETGEAR	openwrt-r6400-v1-b43-80211n-rc6-squashfs.chk
R6400 v2	U12H332T20_NETGEAR	openwrt-r6400-v2-b43-80211n-rc6-squashfs.chk
R6400 v2 (OTP)	U12H332T30_NETGEAR	openwrt-r6400-v2-otp-b43-80211n-rc6-squashfs.chk

Changes since rc5:

• 839 (by Rosen Penev, @neheb, from openwrt/openwrt#25922, unchanged): encrypt robust management frames in software. b43 announces management frame protection (PMF, required for WPA3), but the hardware encrypts protected management frames like data frames, so with PMF the block-ack setup never arrived. If you use WPA3 or PMF, rc5 and earlier set up no send aggregation: R6400 v2 download/upload 23/20 Mbit/s and pings up to 2.2 s; with 839 85.5/91.4 Mbit/s, block-ack sessions in both directions, also to a phone. Without PMF nothing changes.

Everything else is rc5 (two transmit streams by default, one hardware queue per WMM class, multi-rate retry; see the rc5 release and the README for all module parameters and tools). The rc5 overnight test (14.2 h) covers 820–838.

This is a test version. Check the SHA-256 sums (sha256sums), have a way back (Netgear TFTP/nmrp recovery), and read Known limitations and the note on htmode when keeping settings in the README. Reports are welcome as issues.

b43 802.11n for the BCM4331 (Netgear R6400) — rc5 (test version)

Test images for the Netgear R6400 v1 and v2 with the b43 802.11n series rc5 (patches 820–838, see b43-80211n).

OpenWrt snapshot r37195-66ee7b6950, kernel 6.18. Pick the image by the router's board ID:

Router	board ID	Image
R6400 v1	U12H332T00_NETGEAR	openwrt-r6400-v1-b43-80211n-rc5-squashfs.chk
R6400 v2	U12H332T20_NETGEAR	openwrt-r6400-v2-b43-80211n-rc5-squashfs.chk
R6400 v2 (OTP)	U12H332T30_NETGEAR	openwrt-r6400-v2-otp-b43-80211n-rc5-squashfs.chk

Changes since rc4:

• 836: two transmit streams (MCS 8–15) are now on by default: download to two-stream clients ~50 → 85–90 Mbit/s. A 30-minute power test on the R6400 v1 (external high-gain amplifiers): SoC 55.6 → 56.9 °C, case lukewarm. ht_tx_streams=1 goes back to one stream; ht_txgain_idx=30 (v1) keeps two streams at the total power of one. See Two transmit streams.
• 837: the BCM4331's video and voice hardware queues were too small to ever send a frame, so all traffic went through the best-effort queue (bug 5). They are now enlarged and each WMM class has its own queue again: voice and video get priority under load (a voice-class download next to a best-effort one: 32.5 instead of 5.5 Mbit/s), video gets aggregation (10 → 56 Mbit/s). ht_qos_fifos=0 restores the rc4 behaviour.
• 838: frames sent again go out at rate control's most reliable rate from the second re-send on (multi-rate retry). With a phone that at times cannot take two-stream frames: through within 3 sends instead of 6, no frames given up. ampdu_retry_mrr=0 restores the rc4 behaviour.
• README: all module parameters with how to change them (also without a reboot), and a Tools section. Note: the transmit power setting of LuCI and iw has no effect on the BCM4331; ht_txgain_idx sets the power.
• The images now also contain the full iw, iputils-ping, GNU timeout, nvram and an SFTP server. The v2 images have the updated device tree with the pin controller (as in openwrt/openwrt#25929).

Overnight test (14.2 h, v1 access point, R6400 v2 + ath11k clients, phone in power save): R6400 v2 download/upload 89.8/91.9 Mbit/s (rc4: 49.4/50.2), no stalls or hangs on the access point, no block-ack window resets, the phone 0 % loss in all 136 runs.

This is a test version. Check the SHA-256 sums (sha256sums), have a way back (Netgear TFTP/nmrp recovery), and read Known limitations and the note on htmode when keeping settings in the README. Reports are welcome as issues.

b43 802.11n for the BCM4331 (Netgear R6400) — rc4 (test version)

Test images for the Netgear R6400 v1 and v2 with the b43 802.11n series rc4 (patches 820–836, see b43-80211n).

OpenWrt snapshot r37195-66ee7b6950, kernel 6.18. Pick the image by the router's board ID:

Router	board ID	Image
R6400 v1	U12H332T00_NETGEAR	openwrt-r6400-v1-b43-80211n-rc4-squashfs.chk
R6400 v2	U12H332T20_NETGEAR	openwrt-r6400-v2-b43-80211n-rc4-squashfs.chk
R6400 v2 (OTP)	U12H332T30_NETGEAR	openwrt-r6400-v2-otp-b43-80211n-rc4-squashfs.chk

Changes since rc3:

• 834 updated: a client could stop receiving for good after many failed frames (frames waiting to be sent again counted against mac80211's airtime queue limit, and above it they were never sent). They are now sent directly.
• 835: one rate control status per aggregate, so rate control also sees the frames that are sent again and falls back when a rate stops working. Based on work by Rosen Penev (@neheb) in openwrt/openwrt#25922.
• 836: two transmit streams (MCS 8–15), off by default. With ht_tx_streams=2 the download to two-stream clients goes from ~53 to 70–83 Mbit/s (tested on the R6400 v1 and v2). How to turn it on: Two transmit streams.

Overnight test (12.7 h, v1 access point, R6400 v2 + ath11k clients, phone in power save): no stalls or hangs on the access point, no block-ack window resets, 58 frames given up (rc2: 1381), the phone 0 % loss in all 122 runs.

This is a test version. Check the SHA-256 sums (sha256sums), have a way back (Netgear TFTP/nmrp recovery), and read Known limitations and the note on htmode when keeping settings in the README. Reports are welcome as issues.

b43 802.11n for the BCM4331 (Netgear R6400) — rc3 (test version)

Test images for the Netgear R6400 v1 and v2 with the b43 802.11n series rc3 (patches 820–834, see b43-80211n).

OpenWrt snapshot r37195-66ee7b6950, kernel 6.18. Pick the image by the router's board ID:

Router	board ID	Image
R6400 v1	U12H332T00_NETGEAR	openwrt-r6400-v1-b43-80211n-rc3-squashfs.chk
R6400 v2	U12H332T20_NETGEAR	openwrt-r6400-v2-b43-80211n-rc3-squashfs.chk
R6400 v2 (OTP)	U12H332T30_NETGEAR	openwrt-r6400-v2-otp-b43-80211n-rc3-squashfs.chk

Changes since rc2:

• 833: the receiver no longer locks onto weak 802.11b frames of neighbouring networks (CCK reception off when the network uses no 802.11b rates, the OpenWrt default): client frames acknowledged at the first attempt 86 → 99 %, TCP +8–10 %.
• 834: airtime fairness — frames are taken from mac80211's per-station queues only when the hardware has room; airtime is reported to mac80211 (AIRTIME_FAIRNESS, AQL). A phone in power save has the same latency under load as without load (~0.3 s instead of up to 1.5 s); two downloads get equal airtime.

This is a test version. Check the SHA-256 sums (sha256sums), have a way back (Netgear TFTP/nmrp recovery), and read Known limitations and the note on htmode when keeping settings in the README. Reports are welcome as issues.

b43 802.11n for the BCM4331 (Netgear R6400) — rc2 (test version)

Test images for the Netgear R6400 v1 and v2 with the b43 802.11n series rc2 (patches 820–832, see b43-80211n).

OpenWrt snapshot r37195-66ee7b6950, kernel 6.18. Pick the image by the router's board ID:

Router	board ID	Image
R6400 v1	U12H332T00_NETGEAR	openwrt-r6400-v1-b43-80211n-rc2-squashfs.chk
R6400 v2	U12H332T20_NETGEAR	openwrt-r6400-v2-b43-80211n-rc2-squashfs.chk
R6400 v2 (OTP)	U12H332T30_NETGEAR	openwrt-r6400-v2-otp-b43-80211n-rc2-squashfs.chk

Changes since rc1: power save in AP mode (830), Duration of 802.11n frames (831), 256-slot RX ring (832) — no more lost frames or unreachable phones under load.

This is a test version. Check the SHA-256 sums (sha256sums), have a way back (Netgear TFTP/nmrp recovery), and read Known limitations and the note on htmode when keeping settings in the README. Reports are welcome as issues.