diff --git a/local/docs/NETWORKING-AND-DRIVERS-CODE-ASSESSMENT-2026-07-27.md b/local/docs/NETWORKING-AND-DRIVERS-CODE-ASSESSMENT-2026-07-27.md
index 8fe85bef5b..13e7a450fc 100644
--- a/local/docs/NETWORKING-AND-DRIVERS-CODE-ASSESSMENT-2026-07-27.md
+++ b/local/docs/NETWORKING-AND-DRIVERS-CODE-ASSESSMENT-2026-07-27.md
@@ -1017,7 +1017,8 @@ incrementally; this is a rolling changelog.
 | **DEF-P0-6** | e1000d MMIO register bounds check | `submodule/base 3a3af825` → parent `22bd63bbe2` | `local/sources/base/drivers/net/e1000d/src/device.rs` |
 | **CRITICAL F1.1** | **xHCI re-entrancy: clear event TRB before state.finish()** | `submodule/base 51ae1567` → parent `4fc85b9be4` | `local/sources/base/drivers/usb/xhcid/src/xhci/irq_reactor.rs` (4 call sites) |
 | **CRITICAL F3.1** | **libredox demux: replace .expect() with .unwrap_or(u16::MAX)** | `submodule/libredox bfb5f8b` → parent `7aba4f84ed` | `local/sources/libredox/src/lib.rs` |
-| **F22 (btintel)** | **ECDSA firmware length check** | `(uncommitted)` | `local/recipes/drivers/redbear-btusb/source/src/btintel.rs` |
+| **CRITICAL F22** | **btintel ECDSA firmware length check** | `94c8b51b44` | `local/recipes/drivers/redbear-btusb/source/src/btintel.rs` (ECDSA_FULL_LEN = 964) |
+| **P001 (firewalling)** | **IPv6 ext header firewall bypass fix** | `submodule/base f6780296` → parent `17367212dc` | `local/sources/base/netstack/src/router/mod.rs` (ipv6_transport_offset walker) |
 | **F21 (dnsd wiring)** | **Wire redbear-dnsd into redbear-mini** | `6b105c7cee` | `config/redbear-mini.toml` ([packages] + [init] 11_dnsd.service) |
 | **ghost-recipe docs** | **netd/audiodevd/usbd WIP per AGENTS.md** | `6b105c7cee` | `local/recipes/system/{netd,audiodevd,usbd}/recipe.toml` |
 | **local ssh recipe** | **net/openssh Red Bear fork with IPv6 detect + host-key gen** | `5656f8ccbe` | `local/recipes/net/openssh/recipe.toml` + `local/scripts/apply-patches.sh` symlink entry |