I have two EAP225v3 access points that while they were purchased in Canada are the US model. Unfortunately someone apparently "upgraded" them at some point with the CA firmware and we have been locked out of any upgrades ever since. This would not be an issue at all if either a) I could switch back to the US firmware - b) CA firmware was kept up to date with the US version. Since I know this is US hardware I have no doubt that the latest US firmware release of 5.1.6 - EAP225(US)_V3_5.1.6 Build 20240313 - would have no problem running on it. Unfortunately the last release available for CA is 5.0.8 - EAP225(CA)_V3_5.0.8 Build 20220225 - which is now almost 3 years old. What is incredibly frustrating is the AP does not prevent me from loading the latest US firmware. The update claims to have succeeded and the unit reboots. It never comes back online. I was then forced to crack the unit open and use the serial console - yes I soldered some stuff - no I am not happy about that either - to find out the system dies with a seg fault. [ 30.300000] Chip id: 0xc, chip version: 0x1000000 [ 30.310000] [ 30.310000] Target Version is 1000000 [ 30.320000] [ 30.320000] Flash Download Address c0000 [ 30.320000] ol_transfer_bin_file: flash data file defined [ 30.330000] Cal location [0]: 00004000 [ 30.330000] [ 30.330000] wifi1 NAND FLASH Select OFFSET 0x5000 [ 30.340000] qc98xx_verify_checksum: flash checksum passed: 0x8f4f [ 30.350000] ol_transfer_bin_file 3594: Download Flash data len 12064 [ 30.380000] [ 30.380000] Board data initialized [ 30.710000] ol_ath_download_firmware :First OTP download and Execute is good address:0x6000 return param 4660 [ 30.720000] ol_ath_download_firmware:##Board Id 24 , CHIP Id 0 [ 30.730000] [ 30.730000] wifi1: Selecting board data file name boardData_2_0_QCA9888_5G_YA105.bin [ 30.740000] ol_transfer_bin_file: Board Data File download to address=0xc0000 file name=QCA9888/hw.2/boardData_2_0_QCA9888_5G_YA 105.bin [ 30.750000] ol_transfer_bin_file: Failed to get QCA9888/hw.2/boardData_2_0_QCA9888_5G_YA105.bin [ 30.760000] ol_ath_download_firmware : ol_transfer_bin_file failed. phase:1 [ 30.770000] ol_ath_attach error status -5 [ 30.770000] [ 30.770000] __ol_ath_attach() scn 85700380 Detaching Codeswap [ 30.780000] Reset Device [ 30.790000] ol_ath_pci_probe: HIF PCI Free needs to happen here [ 30.790000] ath_pci: probe of 0000:00:00.0 failed with error -5 devcfg_init(): 234 @ condition((NULL != pFile)) failed, errno = 2 l_radio_config_init(): 436 @ condition((NULL != pFile)) failed radio_config_getIfindex():1378 @ init error or invalid radioID:0 devcfg_init(): 234 @ condition((NULL != pFile)) failed, errno = 2 l_radio_config_init(): 436 @ condition((NULL != pFile)) failed radio_config_getIfindex():1378 @ init error or invalid radioID:0 devcfg_init(): 234 @ condition((NULL != pFile)) failed, errno = 2 l_radio_config_init(): 436 @ condition((NULL != pFile)) failed radio_config_getBand():1291 @ init error or invalid radioID:0 devcfg_init(): 234 @ condition((NULL != pFile)) failed, errno = 2 l_radio_config_init(): 436 @ condition((NULL != pFile)) failed radio_config_[ 31.040000] ath_attach_dfs[13197] dfsdomain 1 getSpecCARegionCode():1811 @ in[ 31.050000] dfs_attach: event log enabled by default it error Interface doesn't accept private ioctl... HALDbg (8BE0): Operation not permitted devcfg_init(): 234 @ condition((NULL != pFile)) failed, errno = 2 l_radio_config_init(): 436 @ condition((NULL != pFile)) failed radio_config_getBand():1291 @ init error or invalid radioID:0 devcfg_init(): 234 @ condition((NULL != pFile)) failed, errno = 2 l_radio_config_init(): 436 @ condition((NULL != pFile)) failed radio_config_getBand():1291 @ init error or invalid radioID:0 devcfg_init(): 234 @ condition((NULL != pFile)) failed, errno = 2 l_radio_config_init(): 436 @ condition((NULL != pFile)) failed radio_config_thermalCtlSupp():1642 @ init error OK devcfg_init(): 234 @ condition((NULL != pFile)) failed, errno = 2 l_radio_config_init(): 436 @ condition((NULL != pFile)) failed radio_config_getIfindex():1378 @ init error or invalid radioID:1 [ 31.340000] CPU 0 Unable to handle kernel paging request at virtual address 00000018, epc == 801cae68, ra == 85433c5c l_radio_[ 31.350000] Oops[#1]: [ 31.350000] Cpu 0 [ 31.350000] 0 : 00000000 00000000 87058e00 8738d184 [ 31.350000] 4 : 00000000 810b9914 00000008 000004c8 [ 31.350000] 8 : 000004c0 ffffffff 0000002c ffffff80 [ 31.350000] 12 : 00000001 00200200 00100100 00000000 [ 31.350000] 16 : 873e0380 00000000 00000349 00000002 [ 31.350000] 20 : 7fc6c148 00000000 873e0000 873bbdf0 [ 31.350000] 24 : 00000000 800b9d84 [ 31.350000] 28 : 873ba000 873bbd00 85cb71b8 85433c5c [ 31.350000] Hi : 00000007 [ 31.350000] Lo : 00000002 [ 31.350000] epc : 801cae68 sock_release+0x10/0x98 [ 31.350000] Tainted: P W O [ 31.350000] ra : 85433c5c ath_detach+0x39c/0xe90 [umac] [ 31.350000] Status: 1100dc03 KERNEL EXL IE [ 31.350000] Cause : 00800008 [ 31.350000] BadVA : 00000018 [ 31.350000] PrId : 00019750 (MIPS 74Kc) [ 31.350000] Modules linked in: umac(O) ath_dev(PO) hst_tx99(PO) ath_dfs(PO) ath_spectral(PO) ath_rate_atheros(PO) ath_hal(PO) as f(PO) adf(PO) urlfilter(PO) tp_mdns(O) rate_limit(PO) mesh(O) dhcp_capture(O) tp_domain(O) vlan_manage(O) portal(O) ebt_vlan(O) ebt able_filter(O) ebtables(O) ebt_log(O) ebt_limit(O) ebt_ip(O) ipt_REJECT(O) ipt_REDIRECT(O) ipt_MASQUERADE(O) iptable_nat(O) iptable _filter(O) ip_tables(O) nf_nat_proto_gre(O) nf_nat(O) nf_conntrack_ipv4(O) nf_defrag_ipv4(O) xt_state(O) xt_conntrack(O) nf_conntra ck_h323(O) nf_conntrack(O) xt_time(O) xt_string(O) xt_multiport(O) xt_mac(O) xt_comment(O) xt_TCPMSS(O) xt_mark(O) xt_tcpudp(O) x_t ables(O) mtdoops(O) [ 31.350000] Process iwpriv (pid: 588, threadinfo=873ba000, task=8733d8f0, tls=00000000) [ 31.350000] Stack : 8032251c 00000000 873e0380 00000000 00000349 873e0380 00000000 85433c5c [ 31.350000] 000200da 000200da 85eb11ac 871bdcb8 00000001 873e0380 00000000 873e0380 [ 31.350000] 873bbe30 8546b464 000200da 00000000 00000000 00000000 00000028 00000349 [ 31.350000] 00000000 8546b54c 80321f60 85f48000 873bbe30 802900c4 85e80000 00008be0 [ 31.350000] 85cba380 85cb6630 85cc7778 872d1f78 00000008 00008be0 00000008 802908a4 [ 31.350000] ... [ 31.350000] Call Trace: [ 31.350000] [<801cae68>] sock_release+0x10/0x98 [ 31.350000] [<85433c5c>] ath_detach+0x39c/0xe90 [umac] [ 31.350000] [ 31.350000] [ 31.350000] Code: afb10018 afbf001c afb00014 <8c830018> 10600007 00808821 8c620008 0040f809 8c700004 config_init(): 4[ 31.580000] ---[ end trace 58257c5bb7337327 ]--- 36 @ condition((NULL != pFile)) failed radio_config_getIfindex():1378 @ init error or invalid radioID:1 devcfg_init(): 234 @ condition((NULL != pFile)) failed, errno = 2 l_radio_config_init(): 436 @ condition((NULL != pFile)) failed radio_config_getBand():1291 @ init error or invalid radioID:1 devcfg_init(): 234 @ condition((NULL != pFile)) failed, errno = 2 l_radio_config_init(): 436 @ condition((NULL != pFile)) failed radio_config_getSpecCARegionCode():1811 [ 31.630000] mtdoops: ready 10, 11 (no erase) @ init error Segmentation fault These two units are used in standalone mode at different locations and it was only lucky I did the local before doing the remote or this would have been a very bad day. The use of 5Ghz band outdoors in Canada should not be a factor at all here considering these are internal APs. Not the EAP225-outdoor - AP is ceiling mounted in my living room. https://community.tp-link.com/en/business/forum/topic/218176 - seems a similar issue was resolved here. I would appreciate any help you can offer.