Hi all, below I reproduced and fixed with the help of AI so pardon my AI slop.
Hardware: GL-BE9300 (Flint 3)
Firmware: 4.9.0
Kernel: 5.4.213
Topology
GL.iNet WAN (eth0) connects to an ISP router that terminates the PPPoE session. Path MTU is 1492, confirmed by ping: -s 1464 passes, -s 1472 fails. I set the WAN interface MTU to 1492 so that MSS clamping (maxseg size set rt mtu) would compute 1452 instead of 1460.
Symptom
Random full-device reboots, several times per day. dmesg shows:
qti_scm_restart_reason: reset_reason : Non-Secure Watchdog [0x1]
Thermals normal (63–65°C), memory free (438 MB of 883 MB used), no OOM kills, no scheduled reboot task, power supply verified.
Root cause
Persistent logging revealed a repeating kernel WARNING in the netifyd NFQUEUE path during NAT translation of ICMP error packets:
WARNING: CPU: 3 PID: 24417 at net/netfilter/nf_nat_core.c:611
nf_nat_setup_info+0x74/0x87c [nf_nat]
Comm: netifyd Tainted: P WC 5.4.213 #0
Hardware name: GL.iNet BE9300, Inc. IPQ5332/AP-MI01.6 (DT)
Call trace:
nf_nat_setup_info+0x74/0x87c [nf_nat]
nf_nat_masquerade_ipv4+0x3b4/0x3f4 [nf_nat]
nft_do_chain+0x1e0/0x3d8 [nf_tables]
nf_nat_inet_fn+0x11c/0x400 [nf_nat]
nf_nat_icmp_reply_translation+0x230/0x508 [nf_nat]
nf_nat_icmp_reply_translation+0x470/0x508 [nf_nat]
nf_hook_slow+0x40/0xbc
br_nf_post_routing+0x2bc/0x320
nf_reinject+0x184/0x200
nfnetlink_unicast+0x238/0xb44 [nfnetlink]
netlink_sendmsg+0x32c/0x3b0
Trigger
Lowering the WAN MTU below 1500 makes the kernel generate ICMP fragmentation-needed packets. netifyd pulls these through NFQUEUE and reinjects them via nf_reinject; NAT setup on the bridge path then hits the warning at nf_nat_core.c:611. This is reproducible on any setup where the upstream is a PPPoE-terminating modem — a very common home topology.
Second issue: DPI cannot be disabled from the UI
Everything under Flow Control was already switched off in the Admin Panel, yet netifyd was running. The cause:
gl_dpi.dpi_config.base_status='1'
There is no way to clear this from the web UI. Users who have disabled Flow Control still have DPI active and have no indication of it. This affects every user, not just those with a reduced WAN MTU.
Workaround
/etc/init.d/netifyd stop && /etc/init.d/netifyd disable
/etc/init.d/gl_dpi stop && /etc/init.d/gl_dpi disable
/etc/init.d/gl_dpi_flow_statistics stop && /etc/init.d/gl_dpi_flow_statistics disable
uci set gl_dpi.dpi_config.base_status='0' && uci commit gl_dpi
After this the warnings stopped and the device has been stable.
