TheUnboundDeveloper/AM-Reaper v3.7.2-beta-RT-BE88U

Reaper v3.7.2-beta — RT-BE88U

on GitHub

v3.7.2 — 279 kernel fixes and a High in the Wi-Fi 7 frame parser; CVE fixes in dnsmasq, netatalk and more; Let's Encrypt without DDNS; DNS rewrites in Wallguard; FTP passthrough off by default

Everything in v3.7.1 is included. Both lines carry the same changes: RT-BE96U, RT-BE86U, RT-BE88U and GT-BE98 Pro on
3006.102.10; GT-BE98, GT-BE19000, BQ16 and BQ16 Pro on 3006.102.8.

• A High in the Wi-Fi 7 multi-link parser is closed. The access-point daemon's parser for Wi-Fi 7 multi-link
  elements trusted the frame: a malformed element that reached it could make it write past a three-entry table or
  follow a missing pointer. It now checks every length and caps the link count. No CVE is assigned; the same code
  ships in the stock firmware.
• 279 kernel fixes. The router's 4.19 kernel gets no upstream updates after the version it is built on, so Reaper
  carries them: 104 fixes from 4.19 stable, 160 small mainline fixes each checked against 4.19, and 15 more from the
  CVE audit, among them the H.323 and SIP connection-tracking flaws and a route-cache flaw on CISA's list of exploited
  vulnerabilities (CVE-2024-36971). Two behaviour changes come with them: a packet with an IP source-route option
  needs root on the router, and an interface's transmit queue length is capped at 32767.
• Less kernel code to attack. nf_tables, which nothing in Reaper or the amtm add-ons uses, is no longer built;
  that closes CVE-2024-1086 (also on CISA's exploited list) and 28 more. SCTP sockets, VXLAN, the IPv6 routing-header
  match and five unused firewall matches are gone too. SCTP traffic passing through the router is still handled, and
  SMB mounts (cifs) stay for backup add-ons.
• CVE fixes in the router's services. dnsmasq (four, including the DNSSEC name buffer and the DHCPv6 name), wget
  (four), iperf3 (three), the media server's TiVo support, the L2TP client, libevent's DNS and avahi. AFP / Time
  Machine (netatalk) closes twelve, including a flaw in the DHX2 login reachable before login, and no longer crashes
  on an account with a locked password; the old DHX1 login is no longer offered (macOS uses DHX2). avahi's wide-area
  DNS and Samba's Spotlight search are off, which closes five more.
• Let's Encrypt without DDNS. The DDNS page has a new choice, Let's Encrypt via DNS: give it a name in a domain
  you hold at Cloudflare, deSEC or Duck DNS and an API token, and the router gets a trusted certificate by writing a
  temporary DNS record. No DDNS, no open port 80, and the name does not have to point at your router; it renews on
  its own. The web interface and Encrypted DNS use it, so an iPhone's DNS profile no longer needs a certificate
  installed. The web server switches to a new certificate once nobody is logged in. The plain Let's Encrypt option
  is now always listed, greyed until DDNS is on.
• DNS rewrites in Wallguard, as in AdGuard Home and Pi-hole: point a name at an address or at another name for
  every device that uses the router's DNS. A rewritten name is never blocked by Wallguard's lists.
• FTP passthrough is off by default. The FTP and PPTP connection helpers now attach only where they are needed,
  not to every connection on their port: a malicious FTP server could use the FTP helper to open ports towards a LAN
  device. If a device on your network uses active-mode FTP to a server on the Internet, turn on FTP Passthrough on the
  NAT page. The router's own FTP server, a port forward to an FTP server and PPTP passthrough work as before.
• Security audit fixes. Three web endpoints now require the page token, an endpoint that stored a setting before
  login is no longer served, a request with a false length can no longer stall the web server before login,
  WireGuard's temporary files moved to root's private directory, and the Security Review also watches a USB long-term
  store and fixes files that closed programs leave writable by everyone. Gone: a socket-leak workaround that every
  model's vendor libraries no longer need, and two LLTD programs that never ran.
• Devices no longer lists a phone or laptop twice. With MLO off, a device can still connect on extra randomized
  addresses; those rows ("no lease", "private address") now fold into the device they belong to.
• System Info names its capabilities instead of showing internal tokens, and hides the ones that mean nothing on
  this firmware. The NordVPN and Surfshark hooks, which no Reaper page offered, are no longer built.
• Faster firewall rebuilds and Connections page. Gatekeeper loads its rules in batches, Warden and Gatekeeper tear
  their rules down once instead of twice, and the Connections page sorts the connection table once instead of
  scanning it for every flow.
• Wireless Log refreshes every 10 seconds, pauses while its tab is hidden, and reads its data as JSON.
• Rule Status C3: a port forwarded to another of the router's own addresses, such as a WireGuard server, is no
  longer reported as blocked.
• GT-BE98, GT-BE19000, BQ16 and BQ16 Pro: the built-in CA list matches the other models (emSign ECC Root CA - G3
  removed, as Merlin did).

Images & checksums (RT-BE88U)

Two flashable images: + AI Advisor (default) and Standard (noMCP, all AI components compiled out entirely). Flash the *_nand_squashfs.pkgtb via Administration > Firmware Upgrade.

This is a beta release. Its filename carries _BETA and the router reports the same string on the dashboard and the About page, so you can always tell which channel a flashed image came from. Stable releases carry no marker.

Verify a download against the attached SHA256SUMS-RT-BE88U-Reaper_v3.7.2.txt.

Corresponding source & reproducibility

The RT-BE88U image for v3.7.2-beta is built from this repository at tag v3.7.2-beta-RT-BE88U: the pinned Asuswrt-Merlin base (3006.102.10, ca72a61f8bc) plus the complete patch series. The tag freezes the exact source that produced it.

• Patches: patches/
• Provenance record: provenance/manifest.json
• How to verify: docs/REPRODUCIBILITY.md and docs/SOURCE-AVAILABILITY.md

The auto-attached Source code (zip/tar.gz) asset below is this repository at tag v3.7.2-beta-RT-BE88U (patches + docs).