A researcher purchased the TP-Link EAP770 v1 Wi-Fi 7 access point in August 2023 and later encountered repeated data corruption during large file transfers over Wi-Fi. Downloads of ISO images and Nix binary cache files frequently failed with bad record mac errors in TLS and SSH, while TCP checksums remained valid because the hardware offload recalculated them after corruption occurred.
Analysis showed that 64-byte blocks were being overwritten in packets traveling from LAN to Wi-Fi. The corruption matched the cache line size of the Qualcomm IPQ9574 processor and was traced to the qca-nss-dp driver failing to invalidate the CPU cache before returning receive buffers to the NIC. The SFE/PPE offload engine then processed the already-damaged data.
TP-Link had discontinued firmware support for the EAP770 v1 even before the device left the factory. The only available workaround required writing two zeros to /sys/sfe/l2_feature and /sys/sfe/ppe_rfs_feature, but the device's SSH shell runs as uid 1 without privileges and no GUI option existed.
To obtain the necessary root access, the researcher chained CVE-2022-0185 with pipe buffer manipulation. The exploit first isolates a user namespace, triggers a slab overflow, leaks kernel pointers via an enlarged key object, and finally overwrites modprobe_path to execute a privileged binary. The payload was carefully designed to keep the device stable after a single successful run.
Development was performed iteratively with AI assistance over seventeen hours. Kernel sources from the related EAP783 model were used to build a matching QEMU test environment because TP-Link never published GPL sources for the v1 hardware. After successful exploitation on the real device, disabling the offload features eliminated the data corruption.
