Found by diffing the kernel driver's complete init write sequence
(usbmon pcap, 7836 vendor writes) against devourer's own write log
(DEVOURER_LOG_WRITES) — the systematic source-level comparison:

- halrf kfree port: kfree_init reads the PPG physical-efuse trims
  (2G/5G per-band-group TX gain 0x3DB..0x3EE, 2G PA bias 0x3D5/0x3D6)
  and applies the PA-bias RF LUT correction — the RF 0x51/0x52 word
  recomposed and written into RF LUT entries 0/1/3 through the 0xef[10]
  window (write-only LUT state; this is the 0x3f=0x4bb block in the
  kernel's golden init that devourer never produced). kfree_apply
  programs the per-channel-group TX gain trim (RF 0xde/0x65/0x55) on
  every full channel set, phydm_config_kfree parity. Gotcha ported with
  it: RF LUT windows left open by the table apply alias the 0x51/0x52
  reads — close 0xef before reading.

- CCA threshold table: RFE types 3/5/12/15/16/17/19 (external-FEM
  boards — including the bench T3U, rfe_type 3) must use the
  cca_ifem_ccut_rfe table (0x82c=0x75da8010, distinct 0x830/0x838
  columns); devourer hardcoded the plain iFEM C-cut column for every
  board, leaving eFEM boards with mis-set carrier-sense thresholds.
  Plus the vendor's 20 MHz DFS-channel CCA adjust (0x838[7:4]=5 for
  ch52-144).

Regression: 20/40/80 smokes + ctest pass on both variants; 8822B
20 MHz on-air RX holds at the improved level (8100 hits/cell).
8822B narrowband remains gated — these close real parity gaps but the
NB sync deficit persists; the remaining un-ported channel-set component
is the phydm spur-calibration/PSD machinery, and the composite
golden-init replay stays the definitive next experiment (see the NB
branch comment).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

… notch)

The last un-ported component of the vendor's channel-set tail
(phydm_spur_calibration_8822b -> phydm_dynamic_spur_det_eliminate,
enabled by CONFIG_8822B_SPUR_CALIBRATION in the CE build):

- Reset half on every channel set: clear the CSI mask bank
  (0x880..0x89c, 0x874[0]) and both NBI notch enables (0x87c[13],
  0xc20[28]/0xe20[28]) — vendor parity for the mask-clear writes the
  kernel produces on every switch.

- Detection half on the chip's own spur channels (2G 5-8/13 @20M,
  3-11 @40m; 5G 153/161/54/118/151/159/58/122/155): PSD-scan the spur
  frequency point +/-1 (3-wire off, per-path 0x808 select, PSD engine
  0x910 BIT(22)|freq_pt, report 0xf44[15:0], IGI toggle to re-enter
  RX), and above the vendor threshold (0x8D) program the NBI notch +
  CSI mask at the spur frequency (2440/2480/5280/5600/5760/5800 MHz
  per channel/BW) through the existing ToneMask appliers, plus the
  dsde CCA tweak (0x82c[19:12]).

Hardware-validated on the T3U at ch6 (a real spur channel): the scan
measures PSD A=634/B=515 >= threshold and engages the notch at
2440 MHz; 20 MHz RX healthy with the notch active (7400 hits/cell);
non-spur ch44 rides the reset-only path (7200 hits/cell); smokes +
ctest pass on both variants. Narrowband bw 5/6 takes the reset-only
path (matches the vendor, whose dsde tables only key 20/40/80) — the
8822B NB sync deficit is unchanged and remains gated; also measured
this session: the deficit is band-independent (2.4 GHz ch6 NB reads
the same ~10 sync as 5 GHz).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

… + golden-init replay lever

Root cause of the 8822B 5/10 MHz deadness, isolated by golden-init
replay: capture the working kernel driver's complete post-DLFW register
write stream from usbmon (3630 writes), replay it verbatim from devourer
(new DEVOURER_REPLAY_WSEQ debug knob — applied at the end of Init,
overriding devourer's own config), confirm NB unlocks (39100 hits vs
~10), then delta-debug the stream down to a single causal write pair:

  RF 0x18 = <different channel byte>
  RF 0x18 = <real value>

The 8822B RF synthesizer only re-latches its internal channel state on
an RF18 VALUE EDGE — a same-value rewrite does nothing. The kernel never
hits this because its flow always tunes through a channel/band change
around a bandwidth switch; devourer's end-of-bring-up narrowband
re-clock rewrote RF18 with the identical value, leaving the RF latched
to pre-re-clock internals (RX deaf, TX invalid, band-independent).
Verified minimally: the edge pair alone recovers 23300 hits; the
same-value rewrite alone stays at 9.

Fix: in the 8822B narrowband path, write RF18 once with a substitute
channel byte before the real value (both RF paths).

Hardware validation (T3U 8822BU x Jaguar3 8812CU, true frame counts):
- ch44 10M RX 7700, TX 12600; ch44 5M RX 6500; 2.4G ch6 10M RX 7700
- scripted cross-RX: 20M=3900 / 10M=4000 / 5M=3900 — full control parity
- 20/40/80 smokes + ctest pass; the edge is NB-gated (wide paths
  untouched)

Caps ungated: narrowband_ok=true on both Jaguar2 variants, bw_mask keeps
kBw5|kBw10. Docs/tests updated to current state; DEVOURER_REPLAY_WSEQ
kept as a permanent debugging lever (the tool that found this).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>