GL-MT6000 (Flint 2) – GRO on WAN corrupts forwarded TCP traffic (same driver issue as Beryl AX?)

Router
1

Hi everyone,

I ran into data corruption on forwarded traffic with my Flint 2 and found a workaround. It looks related to the Beryl AX TSO/GSO report: Bug Report: Faulty TSO/GSO Implementation in Beryl AX Firmware 4.9.0

Setup

  • Router: GL-MT6000 (Flint 2)

  • GL firmware: v4.11.0

  • OpenWrt 21.02-SNAPSHOT r15812+1095-46b6ee7ffc, kernel 5.4.238

  • Upstream: Zyxel MC801A (5G), connected to the Flint 2 WAN port

  • Client: Mac, wired to a Flint 2 LAN port

Problem
Large SSH/rsync transfers from a remote server (Hetzner Storage Box, IPv4) to the Mac repeatedly abort with:

ssh_dispatch_run_fatal: ... message authentication code incorrect

So data gets altered in transit, but in a way that TCP doesn’t catch. Only SSH’s own integrity check notices it. Changing the SSH cipher (aes256-gcm) did not help.

Narrowing it down

  • Mac connected directly to the Zyxel: no errors.

  • GL-MT3000 (Beryl AX) in place of the Flint 2, same setup: no errors.

  • With the Flint 2 in between: reproducible aborts.

  • Already off / not involved: software flow offloading in LuCI, Full Cone NAT, SIP ALG, Packet Steering. HNAT shows BIND cnt = 0 during the transfer. The route to the server goes directly via eth1 (no WireGuard). No CRC/frame errors on any port, temperature ~48 °C.

Workaround

ethtool -K eth0 tso off gso off gro off
ethtool -K eth1 tso off gso off gro off
ethtool -K br-lan tso off gso off gro off

With this, the same transfer runs without aborts. I put the commands in /etc/rc.local. After a reboot, there have been no aborts so far.

Questions

  • Is this a known issue on the Flint 2 / with the mtk_soc_eth driver in this firmware?

  • Is a firmware fix planned so the workaround isn’t needed?

Happy to provide logs or test a beta firmware.

Best wishes,
dev107

3

Hi,

Thanks for your report. Please see the following post for our latest update on this issue: