I have two EAP225v3 access points that while they were purchased in Canada are the US model.

Unfortunately someone apparently "upgraded" them at some point with the CA firmware and we have been locked out of any upgrades ever since.

This would not be an issue at all if either a) I could switch back to the US firmware - b) CA firmware was kept up to date with the US version.

Since I know this is US hardware I have no doubt that the latest US firmware release of 5.1.6 - EAP225(US)_V3_5.1.6 Build 20240313 - would have no problem running on it.  Unfortunately the last release available for CA is 5.0.8 - EAP225(CA)_V3_5.0.8 Build 20220225 - which is now almost 3 years old.
 

What is incredibly frustrating is the AP does not prevent me from loading the latest US firmware.  The update claims to have succeeded and the unit reboots.  It never comes back online.  I was then forced to crack the unit open and use the serial console - yes I soldered some stuff - no I am not happy about that either - to find out the system dies with a seg fault.

[   30.300000] Chip id: 0xc, chip version: 0x1000000
[   30.310000]
[   30.310000]  Target Version is 1000000
[   30.320000]
[   30.320000]  Flash Download Address  c0000
[   30.320000] ol_transfer_bin_file: flash data file defined
[   30.330000] Cal location [0]: 00004000
[   30.330000]
[   30.330000]  wifi1 NAND FLASH Select OFFSET 0x5000
[   30.340000] qc98xx_verify_checksum: flash checksum passed: 0x8f4f
[   30.350000] ol_transfer_bin_file 3594: Download Flash data len 12064
[   30.380000]
[   30.380000]  Board data initialized
[   30.710000] ol_ath_download_firmware :First OTP download and Execute is good address:0x6000 return param 4660
[   30.720000] ol_ath_download_firmware:##Board Id 24 , CHIP Id 0
[   30.730000]
[   30.730000]  wifi1: Selecting board data file name boardData_2_0_QCA9888_5G_YA105.bin
[   30.740000] ol_transfer_bin_file: Board Data File download to address=0xc0000 file name=QCA9888/hw.2/boardData_2_0_QCA9888_5G_YA
105.bin
[   30.750000] ol_transfer_bin_file: Failed to get QCA9888/hw.2/boardData_2_0_QCA9888_5G_YA105.bin
[   30.760000] ol_ath_download_firmware : ol_transfer_bin_file failed. phase:1
[   30.770000]  ol_ath_attach error status -5
[   30.770000]
[   30.770000] __ol_ath_attach() scn 85700380 Detaching Codeswap
[   30.780000] Reset Device
[   30.790000] ol_ath_pci_probe: HIF PCI Free needs to happen here
[   30.790000] ath_pci: probe of 0000:00:00.0 failed with error -5
<error>devcfg_init(): 234  @ condition((NULL != pFile)) failed, errno = 2
<error>l_radio_config_init(): 436  @ condition((NULL != pFile)) failed
<error>radio_config_getIfindex():1378  @ init error or invalid radioID:0
<error>devcfg_init(): 234  @ condition((NULL != pFile)) failed, errno = 2
<error>l_radio_config_init(): 436  @ condition((NULL != pFile)) failed
<error>radio_config_getIfindex():1378  @ init error or invalid radioID:0
<error>devcfg_init(): 234  @ condition((NULL != pFile)) failed, errno = 2
<error>l_radio_config_init(): 436  @ condition((NULL != pFile)) failed
<error>radio_config_getBand():1291  @ init error or invalid radioID:0
<error>devcfg_init(): 234  @ condition((NULL != pFile)) failed, errno = 2
<error>l_radio_config_init(): 436  @ condition((NULL != pFile)) failed
<error>radio_config_[   31.040000] ath_attach_dfs[13197] dfsdomain 1
getSpecCARegionCode():1811  @ in[   31.050000] dfs_attach: event log enabled by default
it error
Interface doesn't accept private ioctl...
HALDbg (8BE0): Operation not permitted
<error>devcfg_init(): 234  @ condition((NULL != pFile)) failed, errno = 2
<error>l_radio_config_init(): 436  @ condition((NULL != pFile)) failed
<error>radio_config_getBand():1291  @ init error or invalid radioID:0
<error>devcfg_init(): 234  @ condition((NULL != pFile)) failed, errno = 2
<error>l_radio_config_init(): 436  @ condition((NULL != pFile)) failed
<error>radio_config_getBand():1291  @ init error or invalid radioID:0
<error>devcfg_init(): 234  @ condition((NULL != pFile)) failed, errno = 2
<error>l_radio_config_init(): 436  @ condition((NULL != pFile)) failed
<error>radio_config_thermalCtlSupp():1642  @ init error
OK
<error>devcfg_init(): 234  @ condition((NULL != pFile)) failed, errno = 2
<error>l_radio_config_init(): 436  @ condition((NULL != pFile)) failed
<error>radio_config_getIfindex():1378  @ init error or invalid radioID:1

[   31.340000] CPU 0 Unable to handle kernel paging request at virtual address 00000018, epc == 801cae68, ra == 85433c5c

<error>l_radio_[   31.350000] Oops[#1]:
[   31.350000] Cpu 0
[   31.350000]  0   : 00000000 00000000 87058e00 8738d184
[   31.350000]  4   : 00000000 810b9914 00000008 000004c8
[   31.350000]  8   : 000004c0 ffffffff 0000002c ffffff80
[   31.350000] 12   : 00000001 00200200 00100100 00000000
[   31.350000] 16   : 873e0380 00000000 00000349 00000002
[   31.350000] 20   : 7fc6c148 00000000 873e0000 873bbdf0
[   31.350000] 24   : 00000000 800b9d84
[   31.350000] 28   : 873ba000 873bbd00 85cb71b8 85433c5c
[   31.350000] Hi    : 00000007
[   31.350000] Lo    : 00000002
[   31.350000] epc   : 801cae68 sock_release+0x10/0x98
[   31.350000]     Tainted: P        W  O
[   31.350000] ra    : 85433c5c ath_detach+0x39c/0xe90 [umac]
[   31.350000] Status: 1100dc03    KERNEL EXL IE
[   31.350000] Cause : 00800008
[   31.350000] BadVA : 00000018
[   31.350000] PrId  : 00019750 (MIPS 74Kc)
[   31.350000] Modules linked in: umac(O) ath_dev(PO) hst_tx99(PO) ath_dfs(PO) ath_spectral(PO) ath_rate_atheros(PO) ath_hal(PO) as
f(PO) adf(PO) urlfilter(PO) tp_mdns(O) rate_limit(PO) mesh(O) dhcp_capture(O) tp_domain(O) vlan_manage(O) portal(O) ebt_vlan(O) ebt
able_filter(O) ebtables(O) ebt_log(O) ebt_limit(O) ebt_ip(O) ipt_REJECT(O) ipt_REDIRECT(O) ipt_MASQUERADE(O) iptable_nat(O) iptable
_filter(O) ip_tables(O) nf_nat_proto_gre(O) nf_nat(O) nf_conntrack_ipv4(O) nf_defrag_ipv4(O) xt_state(O) xt_conntrack(O) nf_conntra
ck_h323(O) nf_conntrack(O) xt_time(O) xt_string(O) xt_multiport(O) xt_mac(O) xt_comment(O) xt_TCPMSS(O) xt_mark(O) xt_tcpudp(O) x_t
ables(O) mtdoops(O)
[   31.350000] Process iwpriv (pid: 588, threadinfo=873ba000, task=8733d8f0, tls=00000000)
[   31.350000] Stack : 8032251c 00000000 873e0380 00000000 00000349 873e0380 00000000 85433c5c
[   31.350000]         000200da 000200da 85eb11ac 871bdcb8 00000001 873e0380 00000000 873e0380
[   31.350000]         873bbe30 8546b464 000200da 00000000 00000000 00000000 00000028 00000349
[   31.350000]         00000000 8546b54c 80321f60 85f48000 873bbe30 802900c4 85e80000 00008be0
[   31.350000]         85cba380 85cb6630 85cc7778 872d1f78 00000008 00008be0 00000008 802908a4
[   31.350000]         ...
[   31.350000] Call Trace:
[   31.350000] [<801cae68>] sock_release+0x10/0x98
[   31.350000] [<85433c5c>] ath_detach+0x39c/0xe90 [umac]
[   31.350000]
[   31.350000]
[   31.350000] Code: afb10018  afbf001c  afb00014 <8c830018> 10600007  00808821  8c620008  0040f809  8c700004
config_init(): 4[   31.580000] ---[ end trace 58257c5bb7337327 ]---
36  @ condition((NULL != pFile)) failed
<error>radio_config_getIfindex():1378  @ init error or invalid radioID:1
<error>devcfg_init(): 234  @ condition((NULL != pFile)) failed, errno = 2
<error>l_radio_config_init(): 436  @ condition((NULL != pFile)) failed
<error>radio_config_getBand():1291  @ init error or invalid radioID:1
<error>devcfg_init(): 234  @ condition((NULL != pFile)) failed, errno = 2
<error>l_radio_config_init(): 436  @ condition((NULL != pFile)) failed
<error>radio_config_getSpecCARegionCode():1811  [   31.630000] mtdoops: ready 10, 11 (no erase)
@ init error
Segmentation fault

These two units are used in standalone mode at different locations and it was only lucky I did the local before doing the remote or this would have been a very bad day.

The use of 5Ghz band outdoors in Canada should not be a factor at all here considering these are internal APs.  Not the EAP225-outdoor -  AP is ceiling mounted in my living room.

https://community.tp-link.com/en/business/forum/topic/218176 - seems a similar issue was resolved here.

I would appreciate any help you can offer.