diff --git a/projects/ROCKNIX/devices/SM8750/linux/linux.aarch64.conf b/projects/ROCKNIX/devices/SM8750/linux/linux.aarch64.conf
index 7c1c9e83c28..54435feacdd 100644
--- a/projects/ROCKNIX/devices/SM8750/linux/linux.aarch64.conf
+++ b/projects/ROCKNIX/devices/SM8750/linux/linux.aarch64.conf
@@ -121,6 +121,7 @@ CONFIG_PREEMPT_BUILD=y
 CONFIG_ARCH_HAS_PREEMPT_LAZY=y
 CONFIG_PREEMPT=y
 # CONFIG_PREEMPT_LAZY is not set
+# CONFIG_PREEMPT_RT is not set
 CONFIG_PREEMPT_COUNT=y
 CONFIG_PREEMPTION=y
 # CONFIG_PREEMPT_DYNAMIC is not set
@@ -172,6 +173,7 @@ CONFIG_GENERIC_SCHED_CLOCK=y
 # Scheduler features
 #
 # CONFIG_UCLAMP_TASK is not set
+# CONFIG_SCHED_PROXY_EXEC is not set
 # end of Scheduler features
 
 CONFIG_ARCH_SUPPORTS_NUMA_BALANCING=y
@@ -255,14 +257,16 @@ CONFIG_SYSCTL=y
 CONFIG_HAVE_UID16=y
 CONFIG_SYSCTL_EXCEPTION_TRACE=y
 CONFIG_SYSFS_SYSCALL=y
-# CONFIG_EXPERT is not set
+CONFIG_EXPERT=y
 CONFIG_UID16=y
 CONFIG_MULTIUSER=y
+# CONFIG_SGETMASK_SYSCALL is not set
 CONFIG_FHANDLE=y
 CONFIG_POSIX_TIMERS=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
 CONFIG_ELF_CORE=y
+# CONFIG_BASE_SMALL is not set
 CONFIG_FUTEX=y
 CONFIG_FUTEX_PI=y
 CONFIG_FUTEX_PRIVATE_HASH=y
@@ -274,10 +278,14 @@ CONFIG_EVENTFD=y
 CONFIG_SHMEM=y
 CONFIG_AIO=y
 CONFIG_IO_URING=y
+# CONFIG_IO_URING_MOCK_FILE is not set
 CONFIG_ADVISE_SYSCALLS=y
 CONFIG_MEMBARRIER=y
 CONFIG_KCMP=y
 CONFIG_RSEQ=y
+# CONFIG_RSEQ_STATS is not set
+# CONFIG_RSEQ_DEBUG_DEFAULT_ENABLE is not set
+# CONFIG_DEBUG_RSEQ is not set
 CONFIG_CACHESTAT_SYSCALL=y
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_SELFTEST is not set
@@ -464,6 +472,7 @@ CONFIG_ARM64_4K_PAGES=y
 # CONFIG_ARM64_VA_BITS_39 is not set
 # CONFIG_ARM64_VA_BITS_48 is not set
 CONFIG_ARM64_VA_BITS_52=y
+# CONFIG_ARM64_FORCE_52BIT is not set
 CONFIG_ARM64_VA_BITS=52
 CONFIG_ARM64_PA_BITS_52=y
 CONFIG_ARM64_PA_BITS=52
@@ -602,6 +611,7 @@ CONFIG_DMI=y
 #
 CONFIG_SUSPEND=y
 CONFIG_SUSPEND_FREEZER=y
+# CONFIG_SUSPEND_SKIP_SYNC is not set
 CONFIG_HIBERNATE_CALLBACKS=y
 CONFIG_HIBERNATION=y
 CONFIG_HIBERNATION_SNAPSHOT_DEV=y
@@ -1038,6 +1048,7 @@ CONFIG_ZSMALLOC_CHAIN_SIZE=8
 #
 CONFIG_SLUB=y
 CONFIG_KVFREE_RCU_BATCHED=y
+# CONFIG_SLUB_TINY is not set
 CONFIG_SLAB_MERGE_DEFAULT=y
 # CONFIG_SLAB_FREELIST_RANDOM is not set
 # CONFIG_SLAB_FREELIST_HARDENED is not set
@@ -1124,6 +1135,7 @@ CONFIG_GENERIC_EARLY_IOREMAP=y
 # CONFIG_IDLE_PAGE_TRACKING is not set
 CONFIG_ARCH_HAS_CACHE_LINE_SIZE=y
 CONFIG_ARCH_HAS_CURRENT_STACK_POINTER=y
+CONFIG_ARCH_HAS_ZONE_DMA_SET=y
 CONFIG_ZONE_DMA=y
 CONFIG_ZONE_DMA32=y
 # CONFIG_ZONE_DEVICE is not set
@@ -1702,8 +1714,12 @@ CONFIG_WIRELESS=y
 CONFIG_CFG80211=y
 # CONFIG_NL80211_TESTMODE is not set
 # CONFIG_CFG80211_DEVELOPER_WARNINGS is not set
+CONFIG_CFG80211_CERTIFICATION_ONUS=y
 CONFIG_CFG80211_REQUIRE_SIGNED_REGDB=y
 CONFIG_CFG80211_USE_KERNEL_REGDB_KEYS=y
+CONFIG_CFG80211_EXTRA_REGDB_KEYDIR=""
+# CONFIG_CFG80211_REG_CELLULAR_HINTS is not set
+# CONFIG_CFG80211_REG_RELAX_NO_IR is not set
 CONFIG_CFG80211_DEFAULT_PS=y
 # CONFIG_CFG80211_DEBUGFS is not set
 CONFIG_CFG80211_CRDA_SUPPORT=y
@@ -1776,6 +1792,11 @@ CONFIG_PCI_PASID=y
 # CONFIG_PCIE_TPH is not set
 CONFIG_PCI_LABEL=y
 # CONFIG_PCI_DYNAMIC_OF_NODES is not set
+# CONFIG_PCIE_BUS_TUNE_OFF is not set
+CONFIG_PCIE_BUS_DEFAULT=y
+# CONFIG_PCIE_BUS_SAFE is not set
+# CONFIG_PCIE_BUS_PERFORMANCE is not set
+# CONFIG_PCIE_BUS_PEER2PEER is not set
 CONFIG_VGA_ARB=y
 CONFIG_VGA_ARB_MAX_GPUS=16
 CONFIG_HOTPLUG_PCI=y
@@ -1861,6 +1882,7 @@ CONFIG_PCI_PWRCTRL_TC9563=m
 # CONFIG_CXL_BUS is not set
 # CONFIG_PCCARD is not set
 # CONFIG_RAPIDIO is not set
+# CONFIG_PC104 is not set
 
 #
 # Generic Driver Options
@@ -1969,6 +1991,7 @@ CONFIG_ARM_SCMI_TRANSPORT_OPTEE=y
 
 CONFIG_ARM_SCPI_PROTOCOL=y
 CONFIG_ARM_SDE_INTERFACE=y
+# CONFIG_FIRMWARE_MEMMAP is not set
 CONFIG_DMIID=y
 # CONFIG_DMI_SYSFS is not set
 # CONFIG_ISCSI_IBFT is not set
@@ -2671,6 +2694,8 @@ CONFIG_WLAN=y
 # CONFIG_WLAN_VENDOR_ADMTEK is not set
 CONFIG_WLAN_VENDOR_ATH=y
 # CONFIG_ATH_DEBUG is not set
+CONFIG_ATH_REG_DYNAMIC_USER_REG_HINTS=y
+# CONFIG_ATH_REG_DYNAMIC_USER_CERT_TESTING is not set
 # CONFIG_ATH5K is not set
 # CONFIG_ATH5K_PCI is not set
 # CONFIG_ATH9K is not set
@@ -3068,6 +3093,7 @@ CONFIG_HVC_DRIVER=y
 # CONFIG_RPMSG_TTY is not set
 CONFIG_SERIAL_DEV_BUS=y
 CONFIG_SERIAL_DEV_CTRL_TTYPORT=y
+# CONFIG_TTY_PRINTK is not set
 CONFIG_VIRTIO_CONSOLE=y
 CONFIG_IPMI_HANDLER=m
 CONFIG_IPMI_DMI_DECODE=y
@@ -3416,6 +3442,7 @@ CONFIG_GPIO_ACPI=y
 CONFIG_GPIOLIB_IRQCHIP=y
 CONFIG_GPIO_SHARED=y
 # CONFIG_DEBUG_GPIO is not set
+# CONFIG_GPIO_SYSFS is not set
 CONFIG_GPIO_CDEV=y
 CONFIG_GPIO_CDEV_V1=y
 CONFIG_GPIO_GENERIC=y
@@ -3508,6 +3535,7 @@ CONFIG_GPIO_SHARED_PROXY=m
 #
 # GPIO Debugging utilities
 #
+# CONFIG_GPIO_SLOPPY_LOGIC_ANALYZER is not set
 # CONFIG_GPIO_VIRTUSER is not set
 # end of GPIO Debugging utilities
 
@@ -4283,19 +4311,114 @@ CONFIG_VIDEOBUF2_VMALLOC=y
 CONFIG_VIDEOBUF2_DMA_SG=m
 # end of Media drivers
 
-CONFIG_MEDIA_HIDE_ANCILLARY_SUBDRV=y
-
 #
 # Media ancillary drivers
 #
 
 #
-# audio, video and radio I2C drivers auto-selected by 'Autoselect ancillary drivers'
-#
+# Audio decoders, processors and mixers
+#
+# CONFIG_VIDEO_CS3308 is not set
+# CONFIG_VIDEO_CS5345 is not set
+# CONFIG_VIDEO_CS53L32A is not set
+# CONFIG_VIDEO_MSP3400 is not set
+# CONFIG_VIDEO_SONY_BTF_MPX is not set
+# CONFIG_VIDEO_TDA1997X is not set
+# CONFIG_VIDEO_TDA7432 is not set
+# CONFIG_VIDEO_TDA9840 is not set
+# CONFIG_VIDEO_TEA6415C is not set
+# CONFIG_VIDEO_TEA6420 is not set
+# CONFIG_VIDEO_TLV320AIC23B is not set
+# CONFIG_VIDEO_TVAUDIO is not set
+# CONFIG_VIDEO_UDA1342 is not set
+# CONFIG_VIDEO_VP27SMPX is not set
+# CONFIG_VIDEO_WM8739 is not set
+# CONFIG_VIDEO_WM8775 is not set
+# end of Audio decoders, processors and mixers
+
+#
+# RDS decoders
+#
+# CONFIG_VIDEO_SAA6588 is not set
+# end of RDS decoders
+
+#
+# Video decoders
+#
+# CONFIG_VIDEO_ADV7180 is not set
+# CONFIG_VIDEO_ADV7183 is not set
+# CONFIG_VIDEO_ADV748X is not set
+# CONFIG_VIDEO_ADV7604 is not set
+# CONFIG_VIDEO_ADV7842 is not set
+# CONFIG_VIDEO_BT819 is not set
+# CONFIG_VIDEO_BT856 is not set
+# CONFIG_VIDEO_BT866 is not set
+# CONFIG_VIDEO_ISL7998X is not set
+# CONFIG_VIDEO_LT6911UXE is not set
+# CONFIG_VIDEO_KS0127 is not set
+# CONFIG_VIDEO_MAX9286 is not set
+# CONFIG_VIDEO_ML86V7667 is not set
+# CONFIG_VIDEO_SAA7110 is not set
+# CONFIG_VIDEO_SAA711X is not set
+# CONFIG_VIDEO_TC358743 is not set
+# CONFIG_VIDEO_TC358746 is not set
+# CONFIG_VIDEO_TVP514X is not set
+# CONFIG_VIDEO_TVP5150 is not set
+# CONFIG_VIDEO_TVP7002 is not set
+# CONFIG_VIDEO_TW2804 is not set
+# CONFIG_VIDEO_TW9900 is not set
+# CONFIG_VIDEO_TW9903 is not set
+# CONFIG_VIDEO_TW9906 is not set
+# CONFIG_VIDEO_TW9910 is not set
+# CONFIG_VIDEO_VPX3220 is not set
 
 #
 # Video and audio decoders
 #
+# CONFIG_VIDEO_SAA717X is not set
+# CONFIG_VIDEO_CX25840 is not set
+# end of Video decoders
+
+#
+# Video encoders
+#
+# CONFIG_VIDEO_ADV7170 is not set
+# CONFIG_VIDEO_ADV7175 is not set
+# CONFIG_VIDEO_ADV7343 is not set
+# CONFIG_VIDEO_ADV7393 is not set
+# CONFIG_VIDEO_ADV7511 is not set
+# CONFIG_VIDEO_AK881X is not set
+# CONFIG_VIDEO_SAA7127 is not set
+# CONFIG_VIDEO_SAA7185 is not set
+# CONFIG_VIDEO_THS8200 is not set
+# end of Video encoders
+
+#
+# Video improvement chips
+#
+# CONFIG_VIDEO_UPD64031A is not set
+# CONFIG_VIDEO_UPD64083 is not set
+# end of Video improvement chips
+
+#
+# Audio/Video compression chips
+#
+# CONFIG_VIDEO_SAA6752HS is not set
+# end of Audio/Video compression chips
+
+#
+# SDR tuner chips
+#
+# end of SDR tuner chips
+
+#
+# Miscellaneous helper chips
+#
+# CONFIG_VIDEO_I2C is not set
+# CONFIG_VIDEO_M52790 is not set
+# CONFIG_VIDEO_ST_MIPID02 is not set
+# CONFIG_VIDEO_THS7303 is not set
+# end of Miscellaneous helper chips
 
 #
 # Video serializers and deserializers
@@ -4307,10 +4430,6 @@ CONFIG_MEDIA_HIDE_ANCILLARY_SUBDRV=y
 # CONFIG_VIDEO_MAX96717 is not set
 # end of Video serializers and deserializers
 
-#
-# SPI I2C drivers auto-selected by 'Autoselect ancillary drivers'
-#
-
 #
 # Media SPI Adapters
 #
@@ -4330,6 +4449,7 @@ CONFIG_DRM=y
 #
 # DRM debugging options
 #
+# CONFIG_DRM_WERROR is not set
 # CONFIG_DRM_DEBUG_MM is not set
 # end of DRM debugging options
 
@@ -4337,6 +4457,8 @@ CONFIG_DRM_MIPI_DSI=y
 CONFIG_DRM_KMS_HELPER=y
 # CONFIG_DRM_PANIC is not set
 # CONFIG_DRM_RAS is not set
+# CONFIG_DRM_DEBUG_DP_MST_TOPOLOGY_REFS is not set
+# CONFIG_DRM_DEBUG_MODESET_LOCK is not set
 CONFIG_DRM_CLIENT=y
 CONFIG_DRM_CLIENT_LIB=y
 CONFIG_DRM_CLIENT_SELECTION=y
@@ -4347,6 +4469,7 @@ CONFIG_DRM_CLIENT_SETUP=y
 #
 CONFIG_DRM_FBDEV_EMULATION=y
 CONFIG_DRM_FBDEV_OVERALLOC=100
+# CONFIG_DRM_FBDEV_LEAK_PHYS_SMEM is not set
 # CONFIG_DRM_CLIENT_LOG is not set
 CONFIG_DRM_CLIENT_DEFAULT_FBDEV=y
 CONFIG_DRM_CLIENT_DEFAULT="fbdev"
@@ -4442,6 +4565,7 @@ CONFIG_DRM_SIMPLE_BRIDGE=m
 # CONFIG_DRM_MGAG200 is not set
 CONFIG_DRM_MSM=y
 CONFIG_DRM_MSM_GPU_STATE=y
+# CONFIG_DRM_MSM_GPU_SUDO is not set
 CONFIG_DRM_MSM_KMS=y
 CONFIG_DRM_MSM_KMS_FBDEV=y
 CONFIG_DRM_MSM_MDSS=y
@@ -5199,6 +5323,7 @@ CONFIG_SND_SOC_HDMI_CODEC=y
 # CONFIG_SND_SOC_RT9123P is not set
 # CONFIG_SND_SOC_RTQ9124 is not set
 # CONFIG_SND_SOC_RTQ9128 is not set
+# CONFIG_SND_SOC_SDW_MOCKUP is not set
 # CONFIG_SND_SOC_SGTL5000 is not set
 CONFIG_SND_SOC_SIMPLE_AMPLIFIER=m
 CONFIG_SND_SOC_SIMPLE_MUX=m
@@ -7328,6 +7453,7 @@ CONFIG_RESET_GPIO=m
 CONFIG_RESET_QCOM_AOSS=y
 CONFIG_RESET_QCOM_PDC=y
 CONFIG_RESET_SCMI=y
+# CONFIG_RESET_SIMPLE is not set
 # CONFIG_RESET_TI_SYSCON is not set
 # CONFIG_RESET_TI_TPS380X is not set
 
@@ -7909,6 +8035,7 @@ CONFIG_CRYPTO_ACOMP2=y
 CONFIG_CRYPTO_MANAGER=y
 CONFIG_CRYPTO_MANAGER2=y
 CONFIG_CRYPTO_USER=y
+# CONFIG_CRYPTO_SELFTESTS is not set
 CONFIG_CRYPTO_NULL=y
 # CONFIG_CRYPTO_PCRYPT is not set
 # CONFIG_CRYPTO_CRYPTD is not set
@@ -8339,8 +8466,10 @@ CONFIG_FRAME_WARN=2048
 # CONFIG_HEADERS_INSTALL is not set
 # CONFIG_DEBUG_SECTION_MISMATCH is not set
 CONFIG_SECTION_MISMATCH_WARN_ONLY=y
+# CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B is not set
 CONFIG_ARCH_WANT_FRAME_POINTERS=y
 CONFIG_FRAME_POINTER=y
+# CONFIG_VMLINUX_MAP is not set
 # CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set
 # end of Compile-time checks and compiler options
 
@@ -8358,7 +8487,9 @@ CONFIG_HAVE_ARCH_KGDB=y
 # CONFIG_KGDB is not set
 CONFIG_ARCH_HAS_UBSAN=y
 # CONFIG_UBSAN is not set
+CONFIG_HAVE_ARCH_KCSAN=y
 CONFIG_HAVE_KCSAN_COMPILER=y
+# CONFIG_KCSAN is not set
 # end of Generic Kernel Debugging Instruments
 
 #
@@ -8566,6 +8697,7 @@ CONFIG_RUNTIME_TESTING_MENU=y
 # CONFIG_FIND_BIT_BENCHMARK is not set
 # CONFIG_TEST_FIRMWARE is not set
 # CONFIG_TEST_SYSCTL is not set
+# CONFIG_CONTEXT_ANALYSIS_TEST is not set
 # CONFIG_TEST_UDELAY is not set
 # CONFIG_TEST_STATIC_KEYS is not set
 # CONFIG_TEST_DYNAMIC_DEBUG is not set
diff --git a/projects/ROCKNIX/packages/rocknix/sources/scripts/wifictl b/projects/ROCKNIX/packages/rocknix/sources/scripts/wifictl
index c0c9df54c37..7b5bd0a1f8d 100755
--- a/projects/ROCKNIX/packages/rocknix/sources/scripts/wifictl
+++ b/projects/ROCKNIX/packages/rocknix/sources/scripts/wifictl
@@ -29,7 +29,7 @@ DEFAULT_CHAN="6"
 
 SSID="${2:-$(get_setting wifi.ssid 2>/dev/null)}"
 PSK="${3:-$(get_setting wifi.key 2>/dev/null)}"
-COUNTRY="${4:-$(get_setting wifi.country | tr -d '[:space:]' 2>/dev/null)}"
+COUNTRY="${4:-$(get_setting wifi.country 2>/dev/null | tr -d '[:space:]')}"
 
 if [ "${WIFI_TYPE}" = "1" ]; then
   SSID="NETPLAY_AP"
@@ -52,7 +52,56 @@ wait_for_wifi() {
     iwctl device list | grep -q "${WIFI_DEV}" && break
     sleep 1
   done
-  [ -n "${COUNTRY}" ] && iw reg set "${COUNTRY}"
+
+  return 0
+}
+
+# Put the radio on the configured country, and record it where iw's udev hook
+# (60-iw-regdomain.rules -> /usr/lib/iw/setregdomain) will find it on the next
+# boot. That hook runs on ieee80211 "add", which is the only correct moment:
+# the phy exists, nothing is associated yet, and it costs nothing on devices
+# with no Wi-Fi at all. Applying the domain later rebuilds the channel list and
+# drops any active link, so this is a no-op unless the country really changed.
+#
+# Not called from the scan or connect path either: emptying the scan cache
+# immediately before "device wifi connect" makes the connect fail with the SSID
+# not found -- it breaks the connection it is meant to enable.
+apply_regdomain() {
+  local current target
+
+  # ES stores "N/A" as an empty string. Ask for the world domain then, instead
+  # of leaving the radio on whatever the firmware picked for itself: wcn7860
+  # comes up as country US, which allows 30 dBm on 2.4 GHz and on 5735-5855
+  # where ETSI allows 20 and 14, so it is the wrong table to sit on in Europe.
+  if [ -z "${COUNTRY}" ]; then
+    target="00"
+  else
+    # iw only takes ISO 3166-1 alpha-2 codes, and setregdomain sources the
+    # file below as root, so refuse anything that is not exactly two letters
+    # instead of writing it out.
+    case "${COUNTRY}" in
+      [A-Za-z][A-Za-z]) target="$(echo "${COUNTRY}" | tr '[:lower:]' '[:upper:]')" ;;
+      *) return 0 ;;
+    esac
+  fi
+
+  # The udev hook reads this back at the next boot, world domain included.
+  mkdir -p /storage/.cache
+  echo "REGDOMAIN=${target}" >/storage/.cache/regdomain.conf
+
+  # Already there: don't touch the radio, re-applying would drop the link.
+  # Self-managed drivers (ath12k) report their country in a phy# section;
+  # everything else only has the global domain.
+  current="$(iw reg get 2>/dev/null | sed -n '/^phy#/,$p' |
+             awk '/^country/ { print substr($2, 1, 2); exit }')"
+  [ -z "${current}" ] &&
+    current="$(iw reg get 2>/dev/null |
+               awk '/^country/ { print substr($2, 1, 2); exit }')"
+  [ "${current}" = "${target}" ] && return 0
+
+  iw reg set "${target}"
+
+  return 0
 }
 
 # lists all wifi networks
@@ -71,8 +120,15 @@ connect_wifi() {
     "${NMCLI}" -t -f DEVICE,STATE dev status 2>/dev/null | grep -q "^${WIFI_DEV}:connected" && return 0
     sleep 1
   done
-  "${NMCLI}" dev wifi rescan ifname "${WIFI_DEV}" 2>/dev/null
-  sleep 2
+  # "device wifi connect" fails outright when the SSID isn't in the scan cache,
+  # which is normal for a radio that has only just come up. Rescan until it
+  # appears rather than assuming one pass is enough.
+  for i in $(seq 1 5); do
+    "${NMCLI}" dev wifi rescan ifname "${WIFI_DEV}" 2>/dev/null
+    sleep 2
+    "${NMCLI}" -t -f SSID dev wifi list ifname "${WIFI_DEV}" 2>/dev/null |
+      grep -qxF "${SSID}" && break
+  done
   # If a keyfile profile for this SSID already exists but is incomplete (e.g. missing
   # 802-11-wireless-security.key-mgmt), NM fails connection-update with "key-mgmt: property is missing".
   # Drop the stale profile so "device wifi connect" creates a clean one.
@@ -158,6 +214,7 @@ has_ap_mode() {
 case "${1}" in
   enable)
     rfkill unblock wifi
+    apply_regdomain
     ;;
   disable)
     rfkill block wifi
@@ -166,6 +223,12 @@ case "${1}" in
     pin_wifi
     ;;
   connect)
+    # ES passes the country on this call and not on "enable", so apply it here
+    # too. It has to run before connect_wifi: changing the domain rebuilds the
+    # channel list and empties the scan cache, which is what connect_wifi's
+    # rescan loop then refills. apply_regdomain returns without touching the
+    # radio when the country has not changed, so the usual path is a no-op.
+    apply_regdomain
     if [ "${WIFI_TYPE}" = "1" ] && \
        [ "${ADHOC_CLIENT_ID}" = "1" ]; then
       create_adhoc >/dev/null 2>&1