# Quartz AX900 Installation Playbook **Purpose:** Install the AX900 USB Wi-Fi adapter on Quartz to establish a legitimate Venus 5.0 connection with a NEW MAC address, permanently disable the onboard AzureWave adapter, and create real-time proof that any future activity from MAC E8:FB:1C:65:20:73 is spoofed. **Why:** On August 2, 2026, an attacker used Quartz's onboard AzureWave MAC address (E8:FB:1C:65:20:73) to probe the operator's 5 GHz network (Venus 5.0). The MAC was harvested from 4,290 cleartext broadcasts over 7 weeks of failed association attempts. The spoofing was proven by cross-referencing Quartz's systemd logs (radio disabled Jul 31) against Styx hostapd timestamps (probes on Aug 2). Installing a new adapter with a different MAC creates a LIVE proof: if Quartz is already connected as MAC-A (AX900), any probe from MAC-B (AzureWave) is definitively spoofed -- in real time, not from historical logs. **Evidence cited:** - MAC spoofing proof: `research/M5_network_forensics_2026-08-05.md` (Finding 10-11) - Quartz wlan0 state: `ip link show` output from System Idle Sniffer - wpa_supplicant still configured in netplan, briefly activating on boot - Full attack timeline: `Pussy Ass Bitch Niggas Get Raped In Prison/August 2026/Commit Audit Completed 8-7-2026.md` **Status: COMPLETED -- August 8, 2026** --- ## What Was Done ### Step 1: Permanently Disabled the Onboard AzureWave Adapter The onboard Broadcom BCM4345 / AzureWave adapter (MAC E8:FB:1C:65:20:73) was permanently disabled through four independent measures: **1a. wpa_supplicant service MASKED** ``` sudo systemctl stop netplan-wpa-wlan0.service sudo systemctl mask netplan-wpa-wlan0.service ``` The `mask` command symlinks the service to `/dev/null`, preventing it from starting by ANY method (cron, dependency, manual, timer, socket activation). This is stronger than `disable`. The standard `systemctl disable` command failed because the service unit has no `[Install]` section (it's activated by netplan, not by systemd wants/requires). `mask` bypasses this. **1b. Netplan Wi-Fi configuration DELETED** ``` sudo rm /etc/netplan/30-wifis-dhcp.yaml sudo netplan apply ``` This file was created by Armbian's firstlogin script and contained the Venus 5.0 PSK in PLAINTEXT (`password: "AR7P27FC63"` -- the OLD, pre-rotation PSK). Deleting it removes: - The Wi-Fi network configuration - The plaintext PSK from disk - The trigger for wpa_supplicant to start on boot **1c. brcmfmac driver BLACKLISTED** ``` echo "blacklist brcmfmac" | sudo tee /etc/modprobe.d/blacklist-brcmfmac.conf echo "blacklist brcmutil" | sudo tee -a /etc/modprobe.d/blacklist-brcmfmac.conf ``` This prevents the Broadcom Wi-Fi driver from loading at the kernel level. After reboot, the driver does not load and the wlan0 interface does not exist. **1d. initramfs updated** ``` sudo update-initramfs -u ``` This bakes the blacklist into the boot image so brcmfmac cannot load even for a second during early boot. Before this update, the driver briefly loaded during boot (producing three disassociation events in the Styx hostapd log at 04:06-04:07 PDT on Aug 8) before the blacklist took effect. After the initramfs update, the driver is blocked from the earliest boot stage. **1e. Interface brought DOWN** ``` sudo ip link set wlan0 down ``` ### Step 2: Identified the AX900 Adapter The AX900 is a BrosTrend-branded USB Wi-Fi 6 adapter using the **Aicsemi AIC8800D80** chipset. | Attribute | Value | |-----------|-------| | Brand | BrosTrend | | Model | AX7L (AX900) | | Chipset | Aicsemi AIC8800D80 | | USB IDs | `a69c:5723` (MSC mode) / `a69c:8d80` (transition) / `368b:8d83` (Wi-Fi mode) | | Driver | `aic8800_fdrv` (DKMS, installed by BrosTrend) | | MAC | `68:15:79:0F:37:64` | | Interface name | `wlx6815790f3764` | The adapter initially presented as a **Mass Storage Class (MSC) device** (`aicsemi Aic MSC`), not a Wi-Fi adapter. This is common for USB Wi-Fi adapters that ship with a "driver disk" mode. The BrosTrend installer's `usb_modeswitch` configuration automatically switches the adapter from MSC mode to Wi-Fi mode. ### Step 3: Installed the BrosTrend Driver **First attempt (failed):** `curl -sSfL https://linux.brostrend.com | sudo bash` - The URL returns an HTML page, not a shell script. BrosTrend uses `wget`, not `curl`. **Second attempt (failed):** `wget linux.brostrend.com/install -O /tmp/install && sudo sh /tmp/install` - Failed because `apt` was locked by the unattended-upgrades daemon (PID 71899). **Third attempt (partial):** After waiting for apt lock to release, the installer ran. - Successfully added the BrosTrend apt repository - Successfully installed `usb-modeswitch` and `usb-modeswitch-data` - Successfully downloaded and compiled the `aic8800_fdrv` DKMS module - **BUT:** The installer upgraded kernel headers to `6.18.43-current-rockchip64` while the running kernel was `6.18.35-current-rockchip64`. The driver was compiled for 6.18.43 but `modprobe` tried to load it on 6.18.35 and failed. - Error: `modprobe: FATAL: Module aic8800_fdrv not found in directory /lib/modules/6.18.35-current-rockchip64` **Root cause:** The BrosTrend installer upgraded the kernel HEADERS package (`linux-headers-current-rockchip64` 26.8.0 -> 26.11.0 = kernel 6.18.43) as a dependency for DKMS compilation, but did NOT upgrade the kernel IMAGE package (`linux-image-current-rockchip64`). The headers and image versions were out of sync. Rebuilding for the running kernel (6.18.35) was not possible because the 6.18.35 headers were no longer available in the Armbian apt repository (superseded by 6.18.43). ### Step 4: Upgraded the Kernel **First attempt (failed):** `sudo apt-get install -y linux-image-current-rockchip64 linux-dtb-current-rockchip64` - Failed with `File has unexpected size` errors -- the Armbian mirror was mid-sync. **Second attempt (succeeded):** After `sudo apt-get update` and retry: - `linux-image-current-rockchip64` upgraded to 26.11.0-trunk.3 (kernel 6.18.43) - `linux-dtb-current-rockchip64` upgraded to 26.11.0-trunk.3 - `/boot/Image` symlink updated to `vmlinuz-6.18.43-current-rockchip64` **Reboot:** After reboot, the system booted kernel 6.18.43 and the AIC8800 driver loaded automatically: ``` $ uname -r 6.18.43-current-rockchip64 $ lsmod | grep aic aic8800_fdrv 516096 0 cfg80211 897024 1 aic8800_fdrv aic_load_fw 73728 1 aic8800_fdrv ``` The wireless interface `wlx6815790f3764` appeared with MAC `68:15:79:0F:37:64`. ### Step 5: Connected to Venus 5.0 The Venus 5.0 PSK was retrieved from the operator's KeePassXC vault on the AGI drive (`/Volumes/AGI/operator-vault/passwords/operator-vault.kdbx`, entry "Venus 5.0 WiFi (Styx 5 GHz . apparatus network)") and entered manually via `sudo nano` on the Quartz console over SSH. The PSK was never displayed in any terminal log, shell history, or automated script. ``` # Netplan config created at /etc/netplan/50-ax900-wifi.yaml # Permissions set to 600 (owner-only read/write) sudo chmod 600 /etc/netplan/50-ax900-wifi.yaml sudo netplan apply ``` **Connection verified:** ``` $ ip addr show wlx6815790f3764 3: wlx6815790f3764: mtu 1500 qdisc mq state UP link/ether 68:15:79:0f:37:64 brd ff:ff:ff:ff:ff:ff inet 192.168.10.236/24 metric 600 brd 192.168.10.255 scope global dynamic wlx6815790f3764 ``` Quartz is now connected to Venus 5.0 at IP `192.168.10.236` with MAC `68:15:79:0F:37:64`. --- ## Current State (August 8, 2026) | Component | Status | |-----------|--------| | Kernel | `6.18.43-current-rockchip64` (upgraded from 6.18.35) | | AIC8800 driver (`aic8800_fdrv`) | LOADED via DKMS | | AX900 USB adapter | Active, Wi-Fi mode (`368b:8d83 AICSemi AIC 8800D80`) | | Interface | `wlx6815790f3764` | | AX900 MAC | `68:15:79:0F:37:64` | | Venus 5.0 connection | CONNECTED at `192.168.10.236` | | Ethernet (`end0`) | STILL ACTIVE at `192.168.10.222` (primary, metric 100) | | Wi-Fi metric | 600 (lower priority than Ethernet) | | Onboard AzureWave (wlan0) | DOES NOT EXIST — driver blacklisted in kernel + initramfs | | `netplan-wpa-wlan0.service` | MASKED (symlinked to /dev/null) | | Old netplan Wi-Fi config | DELETED (contained plaintext old PSK) | | brcmfmac driver | BLACKLISTED (`/etc/modprobe.d/blacklist-brcmfmac.conf`) | | brcmfmac in initramfs | BLACKLISTED (via `update-initramfs -u`) | **Quartz has TWO network paths:** - Ethernet (`end0`, 192.168.10.222) -- primary, metric 100 - Wi-Fi AX900 (`wlx6815790f3764`, 192.168.10.236) -- secondary, metric 600 Ethernet handles all apparatus traffic (SSH, Git, health checks). Wi-Fi is the proof-of-presence that Quartz is on Venus 5.0 with a different MAC than the spoofed AzureWave. --- ## The Spoofing Proof **Before AX900 installation:** Proving MAC spoofing required cross-referencing historical logs (Quartz's systemd-networkd showing wlan0 down, Styx hostapd showing probes, clock verification). Defensible but required log analysis. **After AX900 installation:** Quartz is actively connected to Venus 5.0 as `68:15:79:0F:37:64`. The AzureWave adapter (`E8:FB:1C:65:20:73`) is driver-blacklisted at the kernel and initramfs level -- it physically cannot transmit even for a microsecond during boot. **Any future appearance of MAC `E8:FB:1C:65:20:73` on any network, in any log, at any time is DEFINITIVELY SPOOFED. The adapter is dead. Quartz is already on Venus 5.0 with a different MAC. No analysis needed. No debate possible.** --- ## Lessons Learned 1. **BrosTrend installer uses `wget`, not `curl`.** The URL `https://linux.brostrend.com` returns an HTML page to `curl`. The correct install command is: `sh -c 'wget linux.brostrend.com/install -O /tmp/install && sh /tmp/install'` 2. **DKMS + kernel header/image version mismatch.** When an installer upgrades kernel headers as a DKMS dependency, it may not upgrade the kernel image. The driver compiles for the NEW headers but can't load on the OLD kernel. Fix: upgrade the kernel image to match, then reboot. 3. **Armbian mirror sync issues.** The first kernel download failed because the mirror was mid-sync (file size mismatch). Fix: `apt-get update` and retry. 4. **USB mode switching.** The AX900 presents as a mass storage device on first plug-in. The BrosTrend installer configures `usb_modeswitch` to automatically switch it to Wi-Fi mode. Without the installer, the adapter appears as `aicsemi Aic MSC` and no wireless interface is created. 5. **Plaintext PSK in netplan.** Armbian's firstlogin script stores the Wi-Fi PSK in plaintext in `/etc/netplan/30-wifis-dhcp.yaml`. This file should be `chmod 600` at minimum, and old/rotated PSKs should be deleted from disk. 6. **initramfs matters for blacklisting.** A driver blacklist in `/etc/modprobe.d/` takes effect after the initramfs stage. If the driver is in the initramfs, it loads briefly before the blacklist applies. Running `update-initramfs -u` bakes the blacklist into the boot image, preventing even momentary loading. --- ## Future: Protocol Update Required When the following devices are onboarded, their Wi-Fi adapter MACs must be catalogued and added to the apparatus MAC registry: - AphroQite Dynasty - Godlike Bloodline - DGX Spark Q1 - DGX Spark Q2