TheUnboundDeveloper/AM-Reaper v3.5.0-beta-RT-BE86U

Reaper v3.5.0-beta — RT-BE86U

on GitHub

v3.5.0 — Wallguard fixed and explains itself, System Log filters, Security Review rules list, VLAN tab back, fixes from Asuswrt-Merlin

Everything in v3.4.9 is included.

• Wallguard builds its block table again. The router's BusyBox flock has no wait option, so in
  v3.4.9 every table build and fold failed at once: no list was ever blocked and the page kept saying
  the lists were downloading. The locks now poll; Warden's counter locks, which had the same flaw, poll
  too. The HaGeZi Threat Intelligence preset now fetches the Medium list - the full list (about
  2.1 million names, 43 MB) is larger than one list or the table may be, so it could never load; a
  profile that had it keeps it.
• Wallguard says why it cannot work. A list whose server Warden's router-traffic filter drops (a
  picked country, the ban list or a threat feed) reads blocked by Warden (FR) on the page, with the
  address and the three ways out on hover, and the log line names the same. When a firewall rule sends
  devices' DNS straight to another server (a Service Intercept rule, DNS Director), an amber banner says
  so: those lookups never reach the router, so Wallguard and Dreadwatch cannot see them. The build log
  reports the table's total instead of the last list's count.
• System Log: Find and Exclude take comma-separated lists, and Saved exclusions keep yours. Find
  shows a line holding any of its words and Exclude hides a line holding any of its words (case is
  ignored). Saved exclusions is your own version of the stock logFilter.json, which is part of the
  read-only image: one entry per line, kept in /jffs/reaper/logfilter (64 entries of up to 128
  characters, editable over SSH too) and carried by the Reaper settings file; Add the Exclude words
  moves the Exclude box into it. Only the view changes - the log file, Save and a remote syslog server
  still get every line. Guide 2.12.
• Security Review: one bar for the rows you tick, and the watch rules as a list. Accept, ignore, or
  watch size and date only for every ticked row at once; the rules list has Delete, Delete selected,
  Delete all and an Add form (a new rule goes first; the first matching rule wins), with the raw text
  behind Edit as text. A JFFS-backed setting that ASUS's prebuilt device discovery rewrites as
  writable by everyone is put right on each watchdog tick, so the review and the dashboard no longer
  flag it for good.
• LAN › VLAN is back on every model with guest/VLAN networks. A v3.4.9 menu change had inverted
  stock's test and hid the tab; the VLAN Switch and VLAN Profile pages (per-port access and trunk) ship
  again.
• AiMesh backhaul parking: no park/hold loop, schedules respected, the card works again. With a
  radio's primary parked its client networks read as down, so the hold fired over and over (RT-BE88U
  field report); it now acts only on radios whose primary is up, and a radio with a Wi-Fi schedule is
  never parked. The parking card on Wireless › Wireless Quality showed only a dash when the reason text
  held an apostrophe; it reads the text safely now.
• Diagnostics report v1.3.50: the "store in RAM" warning no longer counts the platform's own
  defaults volume.
• From Asuswrt-Merlin (Eric "Merlin" Sauvageau), carried unchanged after checking that none was
  already fixed another way: the CA bundle (Mozilla data of 2026-10-21 - Entrust Root CA, ePKI,
  Atos TrustedRoot 2011 and SecureSign Root CA12 out); DNS over TCP from guest/VLAN networks to the
  router (by dave14305 - truncated and large DNSSEC answers failed there; Reaper adds the same rule
  for IPv6); wanduck's listening sockets close when it starts another program (by Jacopo Labardi);
  miniupnpd treating MX: 0 as invalid (CVE-2026-107159, by Thomas Bernard - compiled out in this
  build's configuration, carried to match upstream); urlfilterd bounding the packet data it searches
  (from ASUS GPL 102_40585 - the daemon is not started in this image); and OpenSSL 3.5's build dropping a
  deprecated option.

Images & checksums (RT-BE86U)

Two flashable images: + AI Advisor (default) and Standard (noMCP, all AI components compiled out entirely). Flash the *_nand_squashfs.pkgtb via Administration > Firmware Upgrade.

This is a beta release. Its filename carries _BETA and the router reports the same string on the dashboard and the About page, so you can always tell which channel a flashed image came from. Stable releases carry no marker.

Verify a download against the attached SHA256SUMS-RT-BE86U-Reaper_v3.5.0.txt.

Corresponding source & reproducibility

The RT-BE86U image for v3.5.0-beta is built from this repository at tag v3.5.0-beta-RT-BE86U: the pinned Asuswrt-Merlin base (3006.102.8-beta2, a7ebfa133a) plus the complete patch series. The tag freezes the exact source that produced it.

• Patches: patches/
• Provenance record: provenance/manifest.json
• How to verify: docs/REPRODUCIBILITY.md and docs/SOURCE-AVAILABILITY.md

The auto-attached Source code (zip/tar.gz) asset below is this repository at tag v3.5.0-beta-RT-BE86U (patches + docs).