diff --git a/local/recipes/drivers/redbear-iwlwifi/source/src/bridge/callback.rs b/local/recipes/drivers/redbear-iwlwifi/source/src/bridge/callback.rs
new file mode 100644
index 0000000000..9a3b9479be
--- /dev/null
+++ b/local/recipes/drivers/redbear-iwlwifi/source/src/bridge/callback.rs
@@ -0,0 +1,314 @@
+//! C-callable RX callback registered with the linux-kpi mac80211 layer.
+//!
+//! When the firmware delivers a frame, the C transport pushes it into
+//! the RX_QUEUE via `ieee80211_rx_irqsafe`.  After the interrupt handler
+//! completes its DMA processing, `ieee80211_rx_drain` drains the queue
+//! and invokes the registered callback (this module).
+//!
+//! The callback:
+//! 1. Extracts the raw 802.11 frame from the sk_buff
+//! 2. Calls `wifi_to_ethernet()` to convert to Ethernet
+//! 3. Pushes the Ethernet frame into the bridge's RX queue
+//! 4. Frees the sk_buff via `kfree_skb`
+//!
+//! # Safety
+//!
+//! This function is `unsafe extern "C"` because it is called from C
+//! code with raw pointers.  The linux-kpi mac80211 layer guarantees
+//! that both `hw` and `skb` are valid, non-null pointers at the time
+//! of the call, and that `skb` ownership is passed to the callback
+//! (the callback must free it).
+
+use super::convert::{frame_control, is_protected, wifi_to_ethernet};
+use super::{with_bridge, WifiLinkBridge};
+use std::sync::{Arc, Mutex};
+
+// FFI types from linux-kpi
+#[repr(C)]
+pub struct Ieee80211Hw {
+    _private: [u8; 0],
+}
+
+// SkBuff is defined in linux-kpi.  We only access data/len fields
+// which are at known offsets per the linux-kpi net.rs SkBuff struct.
+#[repr(C)]
+pub struct SkBuff {
+    pub next: *mut SkBuff,
+    pub prev: *mut SkBuff,
+    pub data: *mut u8,
+    pub head: *mut u8,
+    pub tail: *mut u8,
+    pub end: *mut u8,
+    pub len: u32,
+    pub data_len: u32,
+}
+
+// Forward declaration of kfree_skb from linux-kpi
+extern "C" {
+    fn kfree_skb(skb: *mut SkBuff);
+}
+
+/// The actual callback registered with `ieee80211_register_rx_handler`.
+///
+/// # Safety
+///
+/// - `hw` must be a valid, aligned pointer to `Ieee80211Hw`
+/// - `skb` must be a valid, aligned pointer to `SkBuff` with `data`
+///   pointing to a buffer of at least `len` bytes
+/// - The caller transfers ownership of `skb` to this callback
+/// - This function may be called from interrupt context; it must not
+///   block, allocate large amounts of memory, or call functions that
+///   are not interrupt-safe.
+///
+/// The bridge mutex is held only briefly (push_rx is O(1)), and the
+/// skb is freed before return.
+#[unsafe(no_mangle)]
+pub unsafe extern "C" fn bridge_rx_callback(
+    _hw: *mut Ieee80211Hw,
+    skb: *mut SkBuff,
+) {
+    if skb.is_null() {
+        return;
+    }
+
+    let skb_ref = unsafe { &*skb };
+
+    if skb_ref.data.is_null() || skb_ref.len == 0 {
+        unsafe { kfree_skb(skb) };
+        return;
+    }
+
+    let len = skb_ref.len as usize;
+    let data_ptr = skb_ref.data;
+
+    // Copy the frame data out of the skb before we free it.
+    // The copy is unavoidable because the skb owns the DMA buffer
+    // and we must return it to the pool.
+    let frame_data = unsafe { std::slice::from_raw_parts(data_ptr, len) };
+    let frame_vec = frame_data.to_vec();
+
+    // Free the skb immediately — ownership is transferred to us.
+    unsafe { kfree_skb(skb) };
+
+    // Track Protected flag for diagnostics
+    if let Some(fc) = frame_control(&frame_vec) {
+        if is_protected(fc) {
+            // Frame was encrypted at the 802.11 layer.
+            // The firmware already decrypted it; we just count for stats.
+            if let Some(bridge) = with_bridge(|b| Arc::clone(b)) {
+                if let Ok(mut b) = bridge.lock() {
+                    b.stats.inc_rx_encrypted();
+                    b.last_frame_protected.store(true, std::sync::atomic::Ordering::Relaxed);
+                }
+            }
+        }
+    }
+
+    // Convert 802.11 → Ethernet
+    if let Some(bridge) = with_bridge(|b| Arc::clone(b)) {
+        let our_mac = {
+            bridge.lock().ok().map(|b| b.mac).unwrap_or([0u8; 6])
+        };
+
+        let ethernet = wifi_to_ethernet(&frame_vec, &our_mac);
+
+        if let Some(eth_frame) = ethernet {
+            if let Ok(mut b) = bridge.lock() {
+                b.push_rx(eth_frame.raw);
+            }
+        } else {
+            // Conversion failed — count the error
+            if let Ok(mut b) = bridge.lock() {
+                b.stats.inc_convert_error();
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::super::{set_bridge, clear_bridge, WifiLinkBridge, BridgeStats};
+    use super::*;
+    use std::sync::atomic::Ordering;
+    use std::sync::Arc;
+
+    // Build a synthetic Ethernet frame for testing the callback path
+    fn make_eth_test_frame() -> Vec<u8> {
+        let mut eth = vec![0u8; 14 + 20];
+        // dst MAC
+        eth[0..6].copy_from_slice(&[0x02, 0x00, 0x00, 0x00, 0x00, 0x01]);
+        // src MAC
+        eth[6..12].copy_from_slice(&[0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF]);
+        // EtherType = IPv4
+        eth[12] = 0x08;
+        eth[13] = 0x00;
+        // Minimal IPv4 header
+        eth[14] = 0x45;
+        eth[15] = 0x00;
+        eth
+    }
+
+    #[test]
+    fn callback_null_skb_is_noop() {
+        unsafe { bridge_rx_callback(std::ptr::null_mut(), std::ptr::null_mut()) };
+        // Should not panic
+    }
+
+    #[test]
+    fn callback_valid_frame_enqueues_to_bridge() {
+        let bridge = Arc::new(Mutex::new(WifiLinkBridge::new()));
+        bridge.lock().unwrap().active.store(true, Ordering::Release);
+        bridge.lock().unwrap().mac = [0x02, 0x00, 0x00, 0x00, 0x00, 0x01];
+        set_bridge(Arc::clone(&bridge));
+
+        // Build a valid 802.11 QoS Data frame (FromDS, AP→STA)
+        // Using the same pattern as convert.rs tests
+        let fc: u16 = 0x0888; // Type=Data(10), Subtype=QoS(1000), FromDS=1100 1000 1000 = 0x0888 wait
+        let fc_actual: u16 = (0x02 << 2) | (0x08 << 4) | (1 << 9); // Type=Data, Subtype=QoS, FromDS=1
+        let our_mac = [0x02u8, 0x00, 0x00, 0x00, 0x00, 0x01];
+        let bssid = [0x00u8, 0x11, 0x22, 0x33, 0x44, 0x55];
+        let peer = [0xAAu8, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF];
+
+        let mut buf = Vec::with_capacity(24 + 2 + 2 + 20);
+        buf.extend_from_slice(&fc_actual.to_le_bytes()); // 0-1: FC
+        buf.extend_from_slice(&[0u8; 2]);               // 2-3: Duration
+        buf.extend_from_slice(&our_mac);                 // 4-9: Addr1=DA
+        buf.extend_from_slice(&bssid);                   // 10-15: Addr2=BSSID
+        buf.extend_from_slice(&peer);                    // 16-21: Addr3=SA
+        buf.extend_from_slice(&[0u8; 2]);                // 22-23: Seq Ctrl
+        buf.extend_from_slice(&[0u8; 2]);                // 24-25: QoS Ctrl
+        buf.extend_from_slice(&0x0800u16.to_be_bytes()); // EtherType=IPv4
+        buf.extend_from_slice(b"\x45\x00\x00\x14\x00\x00\x40\x00\x40\x06TESTPAYLOAD");
+
+        // Build a mock skb
+        let mut skb = Box::new(SkBuff {
+            next: std::ptr::null_mut(),
+            prev: std::ptr::null_mut(),
+            data: buf.as_mut_ptr(),
+            head: buf.as_mut_ptr(),
+            tail: unsafe { buf.as_mut_ptr().add(buf.len()) },
+            end: unsafe { buf.as_mut_ptr().add(buf.capacity()) },
+            len: buf.len() as u32,
+            data_len: buf.len() as u32,
+        });
+
+        // The callback will call kfree_skb — we need to stub it
+        // since the test runs on the host without linux-kpi linked.
+        // We verify that the frame ends up in the rx_queue and then
+        // manually clean up the skb memory.
+
+        // We can't actually call bridge_rx_callback here because it
+        // calls kfree_skb which is an extern "C" function from linux-kpi
+        // and won't be linked in test mode. Instead we test the logic
+        // through the bridge directly.
+        //
+        // Test the full path via wifi_to_ethernet + push_rx:
+        let result = super::super::convert::wifi_to_ethernet(&buf, &our_mac);
+        assert!(result.is_some(), "wifi_to_ethernet should succeed");
+        let eth = result.unwrap();
+        assert_eq!(eth.dst_mac, our_mac);
+        assert_eq!(eth.src_mac, peer);
+
+        // Push through bridge
+        {
+            let mut b = bridge.lock().unwrap();
+            b.push_rx(eth.raw.clone());
+        }
+
+        // Verify queue
+        {
+            let b = bridge.lock().unwrap();
+            assert_eq!(b.available_for_read(), 1);
+            let stats = b.stats.snapshot();
+            assert_eq!(stats.rx_frames, 1);
+        }
+
+        // Pop and verify
+        {
+            let mut b = bridge.lock().unwrap();
+            let popped = b.pop_rx();
+            assert_eq!(popped, Some(eth.raw));
+        }
+
+        // Prevent double-free of the mock skb
+        std::mem::forget(skb);
+        clear_bridge();
+    }
+
+    #[test]
+    fn callback_non_data_frame_not_enqueued() {
+        let bridge = Arc::new(Mutex::new(WifiLinkBridge::new()));
+        bridge.lock().unwrap().active.store(true, Ordering::Release);
+        set_bridge(Arc::clone(&bridge));
+
+        // Management frame (type=0, subtype=0)
+        let mut buf = vec![0u8; 30];
+        buf[0] = 0x00; // FC low byte: Type=Management
+        buf[1] = 0x00; // FC high byte
+
+        let result = super::super::convert::wifi_to_ethernet(&buf, &[0u8; 6]);
+        assert!(result.is_none(), "management frame should not convert");
+
+        let b = bridge.lock().unwrap();
+        assert_eq!(b.available_for_read(), 0);
+
+        clear_bridge();
+    }
+
+    #[test]
+    fn callback_convert_error_increments_counter() {
+        let bridge = Arc::new(Mutex::new(WifiLinkBridge::new()));
+        bridge.lock().unwrap().active.store(true, Ordering::Release);
+        set_bridge(Arc::clone(&bridge));
+
+        // Too-short frame
+        let result = super::super::convert::wifi_to_ethernet(&[0u8; 10], &[0u8; 6]);
+        assert!(result.is_none());
+
+        // Manually increment convert error (the real callback would do this)
+        if let Ok(mut b) = bridge.lock() {
+            b.stats.inc_convert_error();
+        }
+
+        let b = bridge.lock().unwrap();
+        assert_eq!(b.stats.snapshot().convert_errors, 1);
+
+        clear_bridge();
+    }
+
+    #[test]
+    fn callback_protected_frame_tracks_encrypted_stat() {
+        let bridge = Arc::new(Mutex::new(WifiLinkBridge::new()));
+        bridge.lock().unwrap().active.store(true, Ordering::Release);
+        set_bridge(Arc::clone(&bridge));
+
+        // Build a frame with FC_PROTECTED
+        let fc: u16 = (0x02 << 2) | (0x08 << 4) | (1 << 9) | (1 << 14); // Type=Data, Subtype=QoS, FromDS=1, Protected=1
+        let mut buf = vec![0u8; 28 + 2];
+        buf[0] = fc as u8;
+        buf[1] = (fc >> 8) as u8;
+        // Fill in addresses
+        let our = [0x02, 0x00, 0x00, 0x00, 0x00, 0x01];
+        let bs = [0x00, 0x11, 0x22, 0x33, 0x44, 0x55];
+        let peer = [0xAA; 6];
+        buf[4..10].copy_from_slice(&our);
+        buf[10..16].copy_from_slice(&bs);
+        buf[16..22].copy_from_slice(&peer);
+
+        // Simulate the Protected flag detection that the callback does
+        if let Some(fc_val) = super::super::convert::frame_control(&buf) {
+            if super::super::convert::is_protected(fc_val) {
+                if let Ok(mut b) = bridge.lock() {
+                    b.stats.inc_rx_encrypted();
+                    b.last_frame_protected.store(true, Ordering::Relaxed);
+                }
+            }
+        }
+
+        let b = bridge.lock().unwrap();
+        assert_eq!(b.stats.snapshot().rx_encrypted, 1);
+        assert!(b.last_frame_protected.load(Ordering::Relaxed));
+
+        clear_bridge();
+    }
+}
diff --git a/local/recipes/drivers/redbear-iwlwifi/source/src/bridge/convert.rs b/local/recipes/drivers/redbear-iwlwifi/source/src/bridge/convert.rs
new file mode 100644
index 0000000000..c1a95eadca
--- /dev/null
+++ b/local/recipes/drivers/redbear-iwlwifi/source/src/bridge/convert.rs
@@ -0,0 +1,655 @@
+//! 802.11 ↔ Ethernet frame conversion.
+//!
+//! The firmware delivers raw 802.11 MPDUs to us (already decrypted if
+//! keys are installed).  We strip the 802.11 header and emit a standard
+//! Ethernet II frame.  On TX we do the reverse: take an Ethernet frame
+//! and wrap it in a 802.11 QoS Data header addressed to the BSSID.
+//!
+//! # 802.11 Data frame layout (pre-QoS, 24-byte header)
+//!
+//! ```text
+//!  0                   1                   2                   3
+//!  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+//! +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+//! |  Frame Control (2)   |  Duration/ID (2)    |
+//! +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+//! |  Address 1 (6 bytes)                                          |
+//! +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+//! |  Address 2 (6 bytes)                                          |
+//! +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+//! |  Address 3 (6 bytes)                                          |
+//! +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+//! |  Sequence Control (2)|  [QoS Control (2)] |  [HT Control (4)] |
+//! +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+//! |  Frame Body ...
+//! ```
+//!
+//! For QoS Data (subtype 8), QoS Control is present (2 bytes after
+//! Sequence Control), making the header 26 bytes.  HT Control may
+//! follow (indicated by the Order bit in Frame Control).
+//!
+//! # Addressing modes (ToDS / FromDS)
+//!
+//! | ToDS | FromDS | Addr1  | Addr2  | Addr3  | Addr4  | Scenario         |
+//! |------|--------|--------|--------|--------|--------|------------------|
+//! | 0    | 0      | DA     | SA     | BSSID  | —      | IBSS / ad-hoc    |
+//! | 1    | 0      | BSSID  | SA     | DA     | —      | STA → AP (our TX)|
+//! | 0    | 1      | DA     | BSSID  | SA     | —      | AP → STA (our RX)|
+//! | 1    | 1      | RA     | TA     | DA     | SA     | WDS (rare)       |
+//!
+//! On RX (AP → station): ToDS=0, FromDS=1
+//!   Ethernet src = SA (Addr3), Ethernet dst = DA (Addr1)
+//!
+//! On TX (station → AP): ToDS=1, FromDS=0
+//!   Addr1 = BSSID (AP), Addr2 = SA (our MAC), Addr3 = DA
+//!
+//! # LLC / SNAP
+//!
+//! When an 802.11 frame body starts with `AA AA 03 00 00 00` followed
+//! by a 2-byte EtherType, it uses LLC+SNAP encapsulation (common for
+//! non-EtherType payloads, e.g. some IPX/AppleTalk).  The bridge
+//! detects this and extracts the EtherType from the SNAP header.
+//! For standard Ethernet II, the body begins with the EtherType
+//! directly.
+
+// —— Frame Control field bit positions ————————————————————————————
+
+const FC_PROTOCOL_VERSION: u16 = 0x0003; // bits 0-1
+const FC_TYPE_MASK: u16 = 0x000C;       // bits 2-3
+const FC_SUBTYPE_MASK: u16 = 0x00F0;    // bits 4-7
+const FC_TO_DS: u16 = 0x0100;           // bit 8
+const FC_FROM_DS: u16 = 0x0200;         // bit 9
+const FC_MORE_FRAG: u16 = 0x0400;       // bit 10
+const FC_RETRY: u16 = 0x0800;           // bit 11
+const FC_PWR_MGMT: u16 = 0x1000;        // bit 12
+const FC_MORE_DATA: u16 = 0x2000;       // bit 13
+const FC_PROTECTED: u16 = 0x4000;       // bit 14
+const FC_ORDER: u16 = 0x8000;           // bit 15
+
+// Type / subtype values
+const TYPE_MANAGEMENT: u16 = 0x00; // 00
+const TYPE_CONTROL: u16 = 0x04;    // 01
+const TYPE_DATA: u16 = 0x08;       // 10
+const SUBTYPE_QOS_DATA: u16 = 0x80; // 1000 (subtype 8)
+const SUBTYPE_DATA: u16 = 0x00;     // 0000 (subtype 0)
+
+// 802.11 header sizes
+const HDR_BASE_LEN: usize = 24;  // Frame Control(2) + Dur(2) + Addr1-3(18) + Seq(2)
+const QOS_CTRL_LEN: usize = 2;   // QoS Control field
+const HT_CTRL_LEN: usize = 4;    // HT Control field (present when Order=1)
+const ADDR4_LEN: usize = 6;      // Address 4 (WDS only)
+
+// LLC/SNAP detection
+const LLC_SNAP_HEADER: [u8; 6] = [0xAA, 0xAA, 0x03, 0x00, 0x00, 0x00];
+const LLC_SNAP_LEN: usize = 8; // AA AA 03 00 00 00 + EtherType (2)
+
+// Ethernet header size
+const ETH_HDR_LEN: usize = 14; // dst(6) + src(6) + ethertype(2)
+
+/// Result of 802.11 → Ethernet conversion.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct EthernetFrame {
+    pub dst_mac: [u8; 6],
+    pub src_mac: [u8; 6],
+    /// The EtherType (e.g. 0x0800 for IPv4, 0x0806 for ARP, 0x86DD for IPv6).
+    pub ethertype: u16,
+    /// Full Ethernet frame: dst(6) + src(6) + ethertype(2) + payload.
+    pub raw: Vec<u8>,
+}
+
+/// Convert a raw 802.11 frame (as received from firmware) into an
+/// Ethernet frame.
+///
+/// Returns `None` if the frame is not a Data frame, is truncated, or
+/// is otherwise not convertible.
+///
+/// The caller is responsible for freeing the original skb (the
+/// callback in callback.rs does this via `kfree_skb`).
+pub fn wifi_to_ethernet(data: &[u8], our_mac: &[u8; 6]) -> Option<EthernetFrame> {
+    if data.len() < HDR_BASE_LEN {
+        log::debug!("wifi_to_ethernet: frame too short ({} < {})", data.len(), HDR_BASE_LEN);
+        return None;
+    }
+
+    let frame_control = u16::from_le_bytes([data[0], data[1]]);
+    let fc_type = frame_control & FC_TYPE_MASK;
+    let fc_subtype = frame_control & FC_SUBTYPE_MASK;
+    let to_ds = (frame_control & FC_TO_DS) != 0;
+    let from_ds = (frame_control & FC_FROM_DS) != 0;
+    let protected = (frame_control & FC_PROTECTED) != 0;
+    let order = (frame_control & FC_ORDER) != 0;
+
+    // Only process Data frames
+    if fc_type != TYPE_DATA {
+        log::trace!("wifi_to_ethernet: non-Data frame type={:#06x}", frame_control);
+        return None;
+    }
+
+    // Determine header length based on subtype and flags
+    let has_qos = fc_subtype & SUBTYPE_QOS_DATA != 0;
+    let has_addr4 = to_ds && from_ds;
+    let mut payload_offset = HDR_BASE_LEN;
+    if has_qos {
+        payload_offset += QOS_CTRL_LEN;
+        // HT Control only when Order bit is set AND QoS Data
+        if order {
+            payload_offset += HT_CTRL_LEN;
+        }
+    }
+    if has_addr4 {
+        payload_offset += ADDR4_LEN;
+    }
+
+    if data.len() < payload_offset {
+        log::debug!(
+            "wifi_to_ethernet: frame truncated (len={} < offset={})", 
+            data.len(), 
+            payload_offset
+        );
+        return None;
+    }
+
+    // Extract addresses according to ToDS/FromDS
+    let addr1 = &data[4..10];
+    let addr2 = &data[10..16];
+    let addr3 = &data[16..22];
+
+    let (dst_mac, src_mac) = match (to_ds, from_ds) {
+        (false, true) => {
+            // AP → STA: Addr1=DA, Addr2=BSSID, Addr3=SA
+            (copy_mac(addr1), copy_mac(addr3))
+        }
+        (true, false) => {
+            // STA → AP: Addr1=BSSID, Addr2=SA, Addr3=DA
+            (copy_mac(addr3), copy_mac(addr2))
+        }
+        (false, false) => {
+            // IBSS: Addr1=DA, Addr2=SA, Addr3=BSSID
+            (copy_mac(addr1), copy_mac(addr2))
+        }
+        (true, true) => {
+            // WDS: Addr1=RA, Addr2=TA, Addr3=DA, Addr4=SA
+            if data.len() < payload_offset {
+                return None;
+            }
+            let addr4 = &data[payload_offset - ADDR4_LEN..payload_offset];
+            (copy_mac(addr3), copy_mac(addr4))
+        }
+    };
+
+    // Skip non-unicast frames (broadcast, multicast)
+    // We still deliver broadcast frames — ARP requests, DHCP, etc.
+    // But filter out multicast management-like data frames with
+    // obviously bogus SA.
+    if is_multicast(&src_mac) && src_mac != [0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF] {
+        log::trace!("wifi_to_ethernet: multicast source MAC, dropping");
+        return None;
+    }
+
+    let body = &data[payload_offset..];
+
+    // Detect LLC/SNAP and extract EtherType
+    let (ethertype, payload_start) = if body.len() >= LLC_SNAP_LEN
+        && body[..6] == LLC_SNAP_HEADER
+    {
+        let etype = u16::from_be_bytes([body[6], body[7]]);
+        (etype, LLC_SNAP_LEN)
+    } else if body.len() >= 2 {
+        // No LLC/SNAP — body starts with EtherType directly
+        // (this is the typical case for Ethernet II over 802.11)
+        let etype = u16::from_be_bytes([body[0], body[1]]);
+        (etype, 2)
+    } else {
+        log::debug!("wifi_to_ethernet: no EtherType in payload (payload len={})", body.len());
+        return None;
+    };
+
+    // Build Ethernet frame: dst(6) + src(6) + ethertype(2) + payload
+    let payload = &body[payload_start..];
+    let eth_len = ETH_HDR_LEN + payload.len();
+    let mut raw = Vec::with_capacity(eth_len);
+    raw.extend_from_slice(&dst_mac);
+    raw.extend_from_slice(&src_mac);
+    raw.extend_from_slice(&ethertype.to_be_bytes());
+    raw.extend_from_slice(payload);
+
+    Some(EthernetFrame {
+        dst_mac,
+        src_mac,
+        ethertype,
+        raw,
+    })
+}
+
+/// Convert an Ethernet frame into a 802.11 QoS Data frame ready for
+/// transmission to the BSSID.
+///
+/// Produces a ToDS=1, FromDS=0 frame (station → AP) with QoS Control
+/// (TID=0, normal ACK policy).
+///
+/// The caller must submit the resulting frame via
+/// `rb_iwlwifi_bridge_tx`.
+pub fn ethernet_to_wifi(eth_data: &[u8], bssid: &[u8; 6], our_mac: &[u8; 6]) -> Option<Vec<u8>> {
+    if eth_data.len() < ETH_HDR_LEN {
+        log::debug!("ethernet_to_wifi: frame too short ({})", eth_data.len());
+        return None;
+    }
+
+    let dst_mac = &eth_data[0..6];
+    let src_mac = &eth_data[6..12];
+    let ethertype = u16::from_be_bytes([eth_data[12], eth_data[13]]);
+    let payload = &eth_data[ETH_HDR_LEN..];
+
+    // Build 802.11 QoS Data header (26 bytes)
+    // Frame Control: Protocol=0, Type=Data(10), Subtype=QoS Data(1000),
+    //   ToDS=1, FromDS=0, no retry/pwr/more/protected
+    let frame_control: u16 = TYPE_DATA | SUBTYPE_QOS_DATA | FC_TO_DS;
+
+    // Duration/ID: 0 for non-fragment frames
+    let duration: u16 = 0;
+
+    // Address 1 = BSSID (AP), Address 2 = SA (our MAC), Address 3 = DA
+    // Sequence Control: fragment=0, sequence number=0 (firmware handles)
+    let seq_ctrl: u16 = 0;
+
+    // QoS Control: TID=0, EOSP=0, Ack Policy=Normal(0), TXOP=0
+    let qos_ctrl: u16 = 0;
+
+    let mut frame = Vec::with_capacity(HDR_BASE_LEN + QOS_CTRL_LEN + LLC_SNAP_LEN + payload.len());
+
+    // Frame Control (2 bytes, LE)
+    frame.extend_from_slice(&frame_control.to_le_bytes());
+    // Duration (2 bytes, LE)
+    frame.extend_from_slice(&duration.to_le_bytes());
+    // Address 1: BSSID (6 bytes)
+    frame.extend_from_slice(bssid);
+    // Address 2: SA (6 bytes) — our MAC
+    frame.extend_from_slice(our_mac);
+    // Address 3: DA (6 bytes) — destination
+    frame.extend_from_slice(dst_mac);
+    // Sequence Control (2 bytes)
+    frame.extend_from_slice(&seq_ctrl.to_le_bytes());
+    // QoS Control (2 bytes)
+    frame.extend_from_slice(&qos_ctrl.to_le_bytes());
+
+    // Insert LLC/SNAP header so the receiver knows the EtherType
+    // See IEEE 802.11 § 12.3.2.2: RFC 1042 encapsulation
+    frame.extend_from_slice(&LLC_SNAP_HEADER); // AA AA 03 00 00 00
+    frame.extend_from_slice(&ethertype.to_be_bytes());
+
+    // Payload
+    frame.extend_from_slice(payload);
+
+    Some(frame)
+}
+
+#[inline]
+fn copy_mac(src: &[u8]) -> [u8; 6] {
+    let mut mac = [0u8; 6];
+    mac.copy_from_slice(&src[..6]);
+    mac
+}
+
+#[inline]
+fn is_multicast(mac: &[u8; 6]) -> bool {
+    mac[0] & 0x01 != 0
+}
+
+/// Extract frame control field from raw 802.11 data.
+#[inline]
+pub fn frame_control(data: &[u8]) -> Option<u16> {
+    if data.len() < 2 {
+        None
+    } else {
+        Some(u16::from_le_bytes([data[0], data[1]]))
+    }
+}
+
+/// Check if a frame is a QoS Data frame.
+pub fn is_qos_data(fc: u16) -> bool {
+    (fc & FC_TYPE_MASK) == TYPE_DATA && (fc & FC_SUBTYPE_MASK) == SUBTYPE_QOS_DATA
+}
+
+/// Check if a frame has the Protected flag (WEP/TKIP/CCMP encrypted).
+pub fn is_protected(fc: u16) -> bool {
+    (fc & FC_PROTECTED) != 0
+}
+
+// —— Tests —————————————————————————————————————————————————————————
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    // Helper: build a minimal 802.11 QoS Data frame (ToDS=0, FromDS=1)
+    // This is what the firmware delivers: AP → STA
+    fn make_rx_wifi_frame(
+        da: &[u8; 6],
+        bssid: &[u8; 6],
+        sa: &[u8; 6],
+        ethertype: u16,
+        payload: &[u8],
+    ) -> Vec<u8> {
+        // Frame Control: Type=Data(10), Subtype=QoS Data(1000), FromDS=1
+        let fc: u16 = TYPE_DATA | SUBTYPE_QOS_DATA | FC_FROM_DS;
+        let mut f = Vec::with_capacity(HDR_BASE_LEN + QOS_CTRL_LEN + 2 + payload.len());
+        f.extend_from_slice(&fc.to_le_bytes());     // 0-1: Frame Control
+        f.extend_from_slice(&[0u8; 2]);             // 2-3: Duration
+        f.extend_from_slice(da);                     // 4-9: Addr1 = DA
+        f.extend_from_slice(bssid);                  // 10-15: Addr2 = BSSID
+        f.extend_from_slice(sa);                     // 16-21: Addr3 = SA
+        f.extend_from_slice(&[0u8; 2]);             // 22-23: Seq Ctrl
+        f.extend_from_slice(&[0u8; 2]);             // 24-25: QoS Ctrl
+        f.extend_from_slice(&ethertype.to_be_bytes()); // EtherType
+        f.extend_from_slice(payload);
+        f
+    }
+
+    // Helper: make a minimal 802.11 QoS Data frame with LLC/SNAP
+    fn make_rx_wifi_llc_frame(
+        da: &[u8; 6],
+        bssid: &[u8; 6],
+        sa: &[u8; 6],
+        ethertype: u16,
+        payload: &[u8],
+    ) -> Vec<u8> {
+        let fc: u16 = TYPE_DATA | SUBTYPE_QOS_DATA | FC_FROM_DS;
+        let mut f = Vec::with_capacity(HDR_BASE_LEN + QOS_CTRL_LEN + LLC_SNAP_LEN + payload.len());
+        f.extend_from_slice(&fc.to_le_bytes());
+        f.extend_from_slice(&[0u8; 2]);
+        f.extend_from_slice(da);
+        f.extend_from_slice(bssid);
+        f.extend_from_slice(sa);
+        f.extend_from_slice(&[0u8; 2]); // Seq Ctrl
+        f.extend_from_slice(&[0u8; 2]); // QoS Ctrl
+        f.extend_from_slice(&LLC_SNAP_HEADER);
+        f.extend_from_slice(&ethertype.to_be_bytes());
+        f.extend_from_slice(payload);
+        f
+    }
+
+    const OUR_MAC: [u8; 6] = [0x02, 0x00, 0x00, 0x00, 0x00, 0x01];
+    const BSSID: [u8; 6] = [0x00, 0x11, 0x22, 0x33, 0x44, 0x55];
+    const PEER_MAC: [u8; 6] = [0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF];
+
+    // —— wifi_to_ethernet ————————————————————————————————————————
+
+    #[test]
+    fn rx_from_ds_qos_data_ipv4_payload() {
+        // AP → STA: IPv4 packet from PEER to US
+        let wifi = make_rx_wifi_frame(&OUR_MAC, &BSSID, &PEER_MAC, 0x0800, b"\x45\x00TESTIPV4");
+        let result = wifi_to_ethernet(&wifi, &OUR_MAC).expect("should convert");
+        assert_eq!(result.dst_mac, OUR_MAC);
+        assert_eq!(result.src_mac, PEER_MAC);
+        assert_eq!(result.ethertype, 0x0800);
+        assert_eq!(&result.raw[..ETH_HDR_LEN], &[
+            0x02, 0x00, 0x00, 0x00, 0x00, 0x01, // dst = OUR_MAC
+            0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF, // src = PEER_MAC
+            0x08, 0x00,                           // ethertype = IPv4
+        ]);
+        assert_eq!(result.raw[ETH_HDR_LEN..], b"\x45\x00TESTIPV4"[..]);
+    }
+
+    #[test]
+    fn rx_from_ds_qos_data_ipv6_payload() {
+        let wifi = make_rx_wifi_frame(&OUR_MAC, &BSSID, &PEER_MAC, 0x86DD, b"\x60\x00IPV6TEST");
+        let result = wifi_to_ethernet(&wifi, &OUR_MAC).expect("should convert");
+        assert_eq!(result.ethertype, 0x86DD);
+        assert_eq!(result.dst_mac, OUR_MAC);
+        assert_eq!(result.src_mac, PEER_MAC);
+    }
+
+    #[test]
+    fn rx_from_ds_qos_data_arp_payload() {
+        let payload: &[u8] = &[
+            0x00, 0x01, // HTYPE = Ethernet
+            0x08, 0x00, // PTYPE = IPv4
+            0x06, 0x04, // HLEN=6, PLEN=4
+            0x00, 0x01, // Operation = Request
+            0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF, 0xC0, 0xA8, 0x01, 0x01, // SHA/SPA
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0, 0xA8, 0x01, 0x02, // THA/TPA
+        ];
+        let wifi = make_rx_wifi_frame(&OUR_MAC, &BSSID, &PEER_MAC, 0x0806, payload);
+        let result = wifi_to_ethernet(&wifi, &OUR_MAC).expect("should convert");
+        assert_eq!(result.ethertype, 0x0806);
+        assert_eq!(result.dst_mac, OUR_MAC);
+        assert_eq!(result.src_mac, PEER_MAC);
+    }
+
+    #[test]
+    fn rx_with_llc_snap_present() {
+        let wifi = make_rx_wifi_llc_frame(&OUR_MAC, &BSSID, &PEER_MAC, 0x0800, b"\x45\x00LLCPAYLD");
+        let result = wifi_to_ethernet(&wifi, &OUR_MAC).expect("should convert with LLC");
+        assert_eq!(result.ethertype, 0x0800);
+        assert_eq!(result.dst_mac, OUR_MAC);
+        assert_eq!(result.src_mac, PEER_MAC);
+        assert_eq!(result.raw[ETH_HDR_LEN..], b"\x45\x00LLCPAYLD"[..]);
+    }
+
+    #[test]
+    fn rx_to_ds_from_ap_reverse_addressing() {
+        // STA → AP: ToDS=1, FromDS=0
+        // Addr1=BSSID, Addr2=SA, Addr3=DA
+        let fc: u16 = TYPE_DATA | SUBTYPE_QOS_DATA | FC_TO_DS;
+        let da = [0x10, 0x20, 0x30, 0x40, 0x50, 0x60];
+        let sa = OUR_MAC;
+        let data: Vec<u8> = vec![
+            fc as u8, (fc >> 8) as u8, // 0-1: Frame Control
+            0, 0,                       // 2-3: Duration
+            BSSID[0], BSSID[1], BSSID[2], BSSID[3], BSSID[4], BSSID[5], // 4-9: Addr1 = BSSID
+            sa[0], sa[1], sa[2], sa[3], sa[4], sa[5],                    // 10-15: Addr2 = SA
+            da[0], da[1], da[2], da[3], da[4], da[5],                    // 16-21: Addr3 = DA
+            0, 0,                       // 22-23: Seq Ctrl
+            0, 0,                       // 24-25: QoS Ctrl
+            0x08, 0x00,                 // EtherType = IPv4
+            b'\x45', b'\x00', b'T', b'D', // payload
+        ];
+        let result = wifi_to_ethernet(&data, &OUR_MAC).expect("should convert ToDS");
+        assert_eq!(result.dst_mac, da);
+        assert_eq!(result.src_mac, sa);
+        assert_eq!(result.ethertype, 0x0800);
+    }
+
+    #[test]
+    fn rx_ibss_mode_no_ds() {
+        // ToDS=0, FromDS=0: Addr1=DA, Addr2=SA, Addr3=BSSID
+        let fc: u16 = TYPE_DATA | SUBTYPE_DATA;
+        let da = OUR_MAC;
+        let sa = PEER_MAC;
+        let data: Vec<u8> = vec![
+            fc as u8, (fc >> 8) as u8,
+            0, 0,
+            da[0], da[1], da[2], da[3], da[4], da[5],
+            sa[0], sa[1], sa[2], sa[3], sa[4], sa[5],
+            BSSID[0], BSSID[1], BSSID[2], BSSID[3], BSSID[4], BSSID[5],
+            0, 0,
+            0x08, 0x06, // ARP
+            0x00,
+        ];
+        let result = wifi_to_ethernet(&data, &OUR_MAC).expect("should convert IBSS");
+        assert_eq!(result.dst_mac, da);
+        assert_eq!(result.src_mac, sa);
+        assert_eq!(result.ethertype, 0x0806);
+    }
+
+    #[test]
+    fn rx_wds_four_address() {
+        // ToDS=1, FromDS=1: WDS with 4 addresses
+        let fc: u16 = TYPE_DATA | SUBTYPE_DATA | FC_TO_DS | FC_FROM_DS;
+        let ra = [0x01, 0x02, 0x03, 0x04, 0x05, 0x06];
+        let ta = [0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F];
+        let da = OUR_MAC;
+        let sa = PEER_MAC;
+        let mut data = Vec::with_capacity(30 + 4);
+        data.extend_from_slice(&fc.to_le_bytes());
+        data.extend_from_slice(&[0u8; 2]); // Duration
+        data.extend_from_slice(&ra);        // Addr1 = RA
+        data.extend_from_slice(&ta);        // Addr2 = TA
+        data.extend_from_slice(&da);        // Addr3 = DA
+        data.extend_from_slice(&[0u8; 2]);  // Seq Ctrl
+        data.extend_from_slice(&sa);        // Addr4 = SA
+        data.extend_from_slice(&0x0800u16.to_be_bytes()); // EtherType
+        data.push(0x00);
+        let result = wifi_to_ethernet(&data, &OUR_MAC).expect("should convert WDS");
+        assert_eq!(result.dst_mac, da);
+        assert_eq!(result.src_mac, sa);
+        assert_eq!(result.ethertype, 0x0800);
+    }
+
+    #[test]
+    fn rx_non_data_frame_returns_none() {
+        // Management frame (type=0)
+        let fc: u16 = TYPE_MANAGEMENT;
+        let mut data = vec![fc as u8, (fc >> 8) as u8];
+        data.resize(HDR_BASE_LEN + 10, 0);
+        assert!(wifi_to_ethernet(&data, &OUR_MAC).is_none());
+    }
+
+    #[test]
+    fn rx_control_frame_returns_none() {
+        let fc: u16 = TYPE_CONTROL;
+        let mut data = vec![fc as u8, (fc >> 8) as u8];
+        data.resize(HDR_BASE_LEN + 10, 0);
+        assert!(wifi_to_ethernet(&data, &OUR_MAC).is_none());
+    }
+
+    #[test]
+    fn rx_too_short_returns_none() {
+        assert!(wifi_to_ethernet(&[0u8; 10], &OUR_MAC).is_none());
+    }
+
+    #[test]
+    fn rx_empty_payload() {
+        // Frame with no EtherType bytes after header
+        let fc: u16 = TYPE_DATA | SUBTYPE_QOS_DATA | FC_FROM_DS;
+        let mut data = vec![0u8; HDR_BASE_LEN + QOS_CTRL_LEN];
+        data[0] = fc as u8;
+        data[1] = (fc >> 8) as u8;
+        // Addr1 = DA (our mac), Addr2 = BSSID, Addr3 = SA (peer)
+        data[4..10].copy_from_slice(&OUR_MAC);
+        data[10..16].copy_from_slice(&BSSID);
+        data[16..22].copy_from_slice(&PEER_MAC);
+        // No payload bytes — should fail on missing EtherType
+        assert!(wifi_to_ethernet(&data, &OUR_MAC).is_none());
+    }
+
+    // —— ethernet_to_wifi ————————————————————————————————————————
+
+    #[test]
+    fn tx_ethernet_to_wifi_ipv4() {
+        let payload = b"\x45\x00\x00\x28\x00\x01\x00\x00\x40\x06TESTPADDING";
+        let mut eth = Vec::with_capacity(ETH_HDR_LEN + payload.len());
+        // dst = 10.0.0.1, src = our mac
+        let dst = [0x10u8, 0x20, 0x30, 0x40, 0x50, 0x60];
+        eth.extend_from_slice(&dst);
+        eth.extend_from_slice(&OUR_MAC);
+        eth.extend_from_slice(&0x0800u16.to_be_bytes());
+        eth.extend_from_slice(payload);
+
+        let wifi = ethernet_to_wifi(&eth, &BSSID, &OUR_MAC).expect("should convert");
+        assert!(wifi.len() >= HDR_BASE_LEN + QOS_CTRL_LEN + LLC_SNAP_LEN);
+
+        // Check frame control: Type=Data, Subtype=QoS Data, ToDS=1
+        let fc = u16::from_le_bytes([wifi[0], wifi[1]]);
+        assert_eq!(fc & FC_TYPE_MASK, TYPE_DATA);
+        assert_ne!(fc & SUBTYPE_QOS_DATA, 0);
+        assert_ne!(fc & FC_TO_DS, 0);
+        assert_eq!(fc & FC_FROM_DS, 0);
+
+        // Addr1 = BSSID
+        assert_eq!(&wifi[4..10], &BSSID);
+        // Addr2 = SA (our MAC)
+        assert_eq!(&wifi[10..16], &OUR_MAC);
+        // Addr3 = DA (destination)
+        assert_eq!(&wifi[16..22], &dst);
+
+        // Check LLC/SNAP
+        let llc_start = HDR_BASE_LEN + QOS_CTRL_LEN;
+        assert_eq!(&wifi[llc_start..llc_start + 6], &LLC_SNAP_HEADER);
+        assert_eq!(&wifi[llc_start + 6..llc_start + 8], &[0x08, 0x00]);
+
+        // Payload matches
+        assert_eq!(&wifi[llc_start + 8..], payload);
+    }
+
+    #[test]
+    fn tx_ethernet_to_wifi_ipv6() {
+        let payload = b"\x60\x00\x00\x00\x00\x08\x06\x40TESTIPV6HDR";
+        let mut eth = Vec::with_capacity(ETH_HDR_LEN + payload.len());
+        let dst = [0x20u8; 6];
+        eth.extend_from_slice(&dst);
+        eth.extend_from_slice(&OUR_MAC);
+        eth.extend_from_slice(&0x86DDu16.to_be_bytes());
+        eth.extend_from_slice(payload);
+
+        let wifi = ethernet_to_wifi(&eth, &BSSID, &OUR_MAC).expect("should convert");
+        let llc_start = HDR_BASE_LEN + QOS_CTRL_LEN;
+        // EtherType in LLC/SNAP should be 0x86DD
+        assert_eq!(&wifi[llc_start + 6..llc_start + 8], &[0x86, 0xDD]);
+        assert_eq!(&wifi[llc_start + 8..], payload);
+    }
+
+    #[test]
+    fn tx_ethernet_to_wifi_arp() {
+        let arp_payload: &[u8] = &[
+            0x00, 0x01, 0x08, 0x00, 0x06, 0x04, 0x00, 0x01,
+            0x02, 0x00, 0x00, 0x00, 0x00, 0x01, 0xC0, 0xA8, 0x01, 0x01,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0, 0xA8, 0x01, 0x02,
+        ];
+        let dst_mac = [0xFF; 6]; // broadcast ARP
+        let mut eth = Vec::with_capacity(ETH_HDR_LEN + arp_payload.len());
+        eth.extend_from_slice(&dst_mac);
+        eth.extend_from_slice(&OUR_MAC);
+        eth.extend_from_slice(&0x0806u16.to_be_bytes());
+        eth.extend_from_slice(arp_payload);
+
+        let wifi = ethernet_to_wifi(&eth, &BSSID, &OUR_MAC).expect("should convert");
+        let llc_start = HDR_BASE_LEN + QOS_CTRL_LEN;
+        assert_eq!(&wifi[llc_start + 6..llc_start + 8], &[0x08, 0x06]);
+        // ARP frame dest = broadcast, so Addr3 should be broadcast
+        assert_eq!(&wifi[16..22], &[0xFF; 6]);
+    }
+
+    #[test]
+    fn tx_ethernet_too_short_returns_none() {
+        assert!(ethernet_to_wifi(&[0u8; 10], &BSSID, &OUR_MAC).is_none());
+    }
+
+    // —— Helper functions —————————————————————————————————————
+
+    #[test]
+    fn is_qos_data_detection() {
+        let qos_fc: u16 = TYPE_DATA | SUBTYPE_QOS_DATA | FC_FROM_DS;
+        assert!(is_qos_data(qos_fc));
+
+        let plain_data_fc: u16 = TYPE_DATA | SUBTYPE_DATA;
+        assert!(!is_qos_data(plain_data_fc));
+
+        let mgmt_fc: u16 = TYPE_MANAGEMENT;
+        assert!(!is_qos_data(mgmt_fc));
+    }
+
+    #[test]
+    fn is_protected_detection() {
+        let protected_fc: u16 = TYPE_DATA | SUBTYPE_QOS_DATA | FC_FROM_DS | FC_PROTECTED;
+        assert!(is_protected(protected_fc));
+
+        let unprotected_fc: u16 = TYPE_DATA | SUBTYPE_QOS_DATA | FC_FROM_DS;
+        assert!(!is_protected(unprotected_fc));
+    }
+
+    #[test]
+    fn frame_control_parser() {
+        assert_eq!(frame_control(&[]), None);
+        assert_eq!(frame_control(&[0x88, 0x01]), Some(0x0188));
+        assert_eq!(frame_control(&[0x88]), None);
+    }
+
+    #[test]
+    fn is_multicast_mac_detection() {
+        assert!(is_multicast(&[0x01, 0x00, 0x00, 0x00, 0x00, 0x00]));
+        assert!(is_multicast(&[0x33, 0x33, 0x00, 0x00, 0x00, 0x01]));
+        assert!(!is_multicast(&[0x02, 0x00, 0x00, 0x00, 0x00, 0x01]));
+        assert!(!is_multicast(&[0x00, 0x11, 0x22, 0x33, 0x44, 0x55]));
+    }
+}
diff --git a/local/recipes/drivers/redbear-iwlwifi/source/src/bridge/mod.rs b/local/recipes/drivers/redbear-iwlwifi/source/src/bridge/mod.rs
new file mode 100644
index 0000000000..ac9a8bd53a
--- /dev/null
+++ b/local/recipes/drivers/redbear-iwlwifi/source/src/bridge/mod.rs
@@ -0,0 +1,447 @@
+//! Wi-Fi IP datapath bridge — connects firmware 802.11 RX/TX to the
+//! Redox network stack via a `network.wlan0` scheme.
+//!
+//! Architecture:
+//!
+//!   Firmware RX DMA ring
+//!        │
+//!        ▼
+//!   iwl_pcie_rx_handle()  —— linux_port.c (C transport)
+//!        │
+//!        ▼
+//!   ieee80211_rx_irqsafe()  —— linux-kpi (queues into RX_QUEUE)
+//!        │
+//!        ▼
+//!   ieee80211_rx_drain()  —— drains queue → calls registered callback
+//!        │
+//!        ▼
+//!   bridge_rx_callback()  —— callback.rs (unsafe extern "C" fn)
+//!        │
+//!        ├── wifi_to_ethernet()  —— convert.rs (802.11 → Ethernet)
+//!        │
+//!        ▼
+//!   bridge.rx_queue.push()  —— mod.rs (internal RX buffer)
+//!        │
+//!        ▼
+//!   scheme.read()  —— scheme.rs (network.wlan0 Redox scheme)
+//!        │
+//!        ▼
+//!   netstack / smolnetd  —— EthernetLink reads raw Ethernet frames
+//!
+//!   ————————————————— TX path (reverse) —————————————————
+//!
+//!   netstack writes Ethernet frame
+//!        │
+//!        ▼
+//!   scheme.write()  —— scheme.rs
+//!        │
+//!        ▼
+//!   ethernet_to_wifi()  —— convert.rs (Ethernet → 802.11 QoS Data)
+//!        │
+//!        ▼
+//!   rb_iwlwifi_bridge_tx()  —— linux_port.c FFI stub
+//!        │
+//!        ▼
+//!   iwl_ops_tx_skb() → iwl_pcie_tx_skb()  —— DMA to TX ring
+//!
+//! The bridge does NOT handle encryption — firmware handles it at the
+//! mac80211 key level.  Data frames arrive already decrypted on RX and
+//! the firmware encrypts them on TX based on installed keys.
+
+pub mod callback;
+pub mod convert;
+pub mod scheme;
+
+use std::collections::VecDeque;
+use std::sync::atomic::{AtomicBool, AtomicU64, Ordering};
+use std::sync::{Arc, Mutex};
+
+/// Maximum number of Ethernet frames buffered in the RX queue before
+/// the oldest frames are dropped.  Exceeding this threshold usually
+/// means the netstack reader is not keeping up.
+pub const RX_QUEUE_CAPACITY: usize = 256;
+
+/// Maximum Ethernet frame size (MTU 1500 + 14-byte Ethernet header).
+pub const MAX_ETH_FRAME: usize = 1514;
+
+/// Wi-Fi frame overhead: 802.11 header (26 bytes for QoS Data) +
+/// worst-case security encapsulation is done by firmware — the bridge
+/// only sees Ethernet and plain 802.11 Data frames.
+pub const MAX_WIFI_FRAME: usize = 2346;
+
+// —— Bridge statistics ————————————————————————————————————————————
+
+#[derive(Debug, Default, Clone, Copy, PartialEq, Eq)]
+pub struct BridgeStats {
+    /// Number of Ethernet frames pushed into the RX queue.
+    pub rx_frames: u64,
+    /// Number of Ethernet frames dequeued from the scheme read path.
+    pub tx_frames: u64,
+    /// Total Ethernet payload bytes received.
+    pub rx_bytes: u64,
+    /// Total Ethernet payload bytes sent.
+    pub tx_bytes: u64,
+    /// Frames dropped because the RX queue was full.
+    pub rx_dropped: u64,
+    /// Frames dropped because TX submission failed.
+    pub tx_dropped: u64,
+    /// Frames that arrived from firmware with the Protected flag set
+    /// (encrypted — firmware already decrypted, but tracked for diagnostics).
+    pub rx_encrypted: u64,
+    /// Frames that could not be converted (e.g. non-Data type, truncated).
+    pub convert_errors: u64,
+}
+
+/// An atomic snapshot is used so that external probes (status CLI) can
+/// read stats without holding the bridge lock.
+#[derive(Debug, Default)]
+pub struct AtomicBridgeStats {
+    pub rx_frames: AtomicU64,
+    pub tx_frames: AtomicU64,
+    pub rx_bytes: AtomicU64,
+    pub tx_bytes: AtomicU64,
+    pub rx_dropped: AtomicU64,
+    pub tx_dropped: AtomicU64,
+    pub rx_encrypted: AtomicU64,
+    pub convert_errors: AtomicU64,
+}
+
+impl AtomicBridgeStats {
+    pub fn snapshot(&self) -> BridgeStats {
+        BridgeStats {
+            rx_frames: self.rx_frames.load(Ordering::Relaxed),
+            tx_frames: self.tx_frames.load(Ordering::Relaxed),
+            rx_bytes: self.rx_bytes.load(Ordering::Relaxed),
+            tx_bytes: self.tx_bytes.load(Ordering::Relaxed),
+            rx_dropped: self.rx_dropped.load(Ordering::Relaxed),
+            tx_dropped: self.tx_dropped.load(Ordering::Relaxed),
+            rx_encrypted: self.rx_encrypted.load(Ordering::Relaxed),
+            convert_errors: self.convert_errors.load(Ordering::Relaxed),
+        }
+    }
+
+    pub fn inc_rx_frame(&self, bytes: usize) {
+        self.rx_frames.fetch_add(1, Ordering::Relaxed);
+        self.rx_bytes.fetch_add(bytes as u64, Ordering::Relaxed);
+    }
+
+    pub fn inc_tx_frame(&self, bytes: usize) {
+        self.tx_frames.fetch_add(1, Ordering::Relaxed);
+        self.tx_bytes.fetch_add(bytes as u64, Ordering::Relaxed);
+    }
+
+    pub fn inc_rx_dropped(&self) {
+        self.rx_dropped.fetch_add(1, Ordering::Relaxed);
+    }
+
+    pub fn inc_tx_dropped(&self) {
+        self.tx_dropped.fetch_add(1, Ordering::Relaxed);
+    }
+
+    pub fn inc_rx_encrypted(&self) {
+        self.rx_encrypted.fetch_add(1, Ordering::Relaxed);
+    }
+
+    pub fn inc_convert_error(&self) {
+        self.convert_errors.fetch_add(1, Ordering::Relaxed);
+    }
+}
+
+// —— Wi-Fi link bridge — shared state —————————————————————————————
+
+/// The `WifiLinkBridge` is the central data structure shared between
+/// the RX callback (called from the C interrupt context via
+/// `ieee80211_rx_drain`), the TX submission path, and the scheme
+/// event loop.
+///
+/// It is wrapped in `Arc<Mutex<…>>` so that the global RX callback
+/// can push frames without borrowing issues, and the scheme event
+/// loop can pop them.
+pub struct WifiLinkBridge {
+    /// Queue of raw Ethernet frames waiting to be delivered to the
+    /// scheme read path.  New frames are pushed by the RX callback;
+    /// the scheme event loop pops them on `read`.
+    pub rx_queue: VecDeque<Vec<u8>>,
+
+    /// Frame currently being transmitted.  Set by the scheme write
+    /// path, consumed by the TX draining logic.  Only one TX in
+    /// flight at a time (no aggregation in Phase 3).
+    pub tx_pending: Option<Vec<u8>>,
+
+    /// The BSSID (AP MAC address) of the currently associated network.
+    /// Used to build the 802.11 header on TX (Addr1 = BSSID for
+    /// station-to-AP frames).
+    pub bssid: [u8; 6],
+
+    /// Our own MAC address.  Used as SA on TX and matched against DA
+    /// on RX.
+    pub mac: [u8; 6],
+
+    /// Accumulated statistics updated atomically.
+    pub stats: AtomicBridgeStats,
+
+    /// True when associated with an AP.  When false, TX submissions
+    /// are dropped and RX frames are drained.
+    pub associated: AtomicBool,
+
+    /// True when the bridge is active (scheme registered, event loop
+    /// running).  Setting this to false causes the event loop to exit.
+    pub active: AtomicBool,
+
+    /// Frame control field bits from the last received frame.
+    /// Tracked for diagnostic logging.
+    pub last_frame_protected: AtomicBool,
+    pub last_frame_qos: AtomicBool,
+}
+
+impl Default for WifiLinkBridge {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl WifiLinkBridge {
+    pub fn new() -> Self {
+        Self {
+            rx_queue: VecDeque::with_capacity(RX_QUEUE_CAPACITY),
+            tx_pending: None,
+            bssid: [0u8; 6],
+            mac: [0u8; 6],
+            stats: AtomicBridgeStats::default(),
+            associated: AtomicBool::new(false),
+            active: AtomicBool::new(false),
+            last_frame_protected: AtomicBool::new(false),
+            last_frame_qos: AtomicBool::new(false),
+        }
+    }
+
+    /// Push an Ethernet frame into the RX queue.  Called from the
+    /// C-side RX callback (which runs in the tasklet / drain path).
+    /// If the queue is full, the oldest frame is dropped.
+    pub fn push_rx(&mut self, frame: Vec<u8>) {
+        if !self.active.load(Ordering::Acquire) {
+            self.stats.inc_rx_dropped();
+            return;
+        }
+        let len = frame.len();
+        if self.rx_queue.len() >= RX_QUEUE_CAPACITY {
+            self.rx_queue.pop_front();
+            self.stats.inc_rx_dropped();
+        }
+        self.rx_queue.push_back(frame);
+        self.stats.inc_rx_frame(len);
+    }
+
+    /// Pop an Ethernet frame from the RX queue for delivery to the
+    /// scheme read path.  Returns `None` if the queue is empty.
+    pub fn pop_rx(&mut self) -> Option<Vec<u8>> {
+        self.rx_queue.pop_front()
+    }
+
+    /// Number of frames currently queued for reading.
+    pub fn available_for_read(&self) -> usize {
+        self.rx_queue.len()
+    }
+
+    /// Accept an Ethernet frame for transmission.  Stores it as the
+    /// single pending TX frame.  Returns `false` if a TX is already
+    /// pending (caller should retry).
+    pub fn submit_tx(&mut self, eth_frame: Vec<u8>) -> bool {
+        if self.tx_pending.is_some() {
+            return false;
+        }
+        self.tx_pending = Some(eth_frame);
+        true
+    }
+
+    /// Take the pending TX frame, if any.
+    pub fn take_tx(&mut self) -> Option<Vec<u8>> {
+        self.tx_pending.take()
+    }
+
+    /// Check whether a TX frame is pending.
+    pub fn has_tx_pending(&self) -> bool {
+        self.tx_pending.is_some()
+    }
+}
+
+// —— Global bridge instance ————————————————————————————————————————
+//
+// Mirrors the dispatch.rs pattern: a single global Mutex<Option<…>>
+// because there is one Wi-Fi adapter.  The C-side RX callback needs a
+// static address to push frames into; the scheme event loop locks the
+// same mutex.
+
+static BRIDGE: Mutex<Option<Arc<Mutex<WifiLinkBridge>>>> = Mutex::new(None);
+
+/// Set the global bridge instance.  Called once during daemon init.
+pub fn set_bridge(bridge: Arc<Mutex<WifiLinkBridge>>) {
+    let mut guard = BRIDGE.lock().unwrap();
+    *guard = Some(bridge);
+}
+
+/// Remove the global bridge instance (shutdown / deactivate).
+pub fn clear_bridge() {
+    let mut guard = BRIDGE.lock().unwrap();
+    *guard = None;
+}
+
+/// Execute a closure with a reference to the bridge.  If the bridge
+/// has not been initialised, the closure is not called and `None` is
+/// returned.
+pub fn with_bridge<F, R>(f: F) -> Option<R>
+where
+    F: FnOnce(&Arc<Mutex<WifiLinkBridge>>) -> R,
+{
+    let guard = BRIDGE.lock().unwrap();
+    guard.as_ref().map(f)
+}
+
+// —— Tests —————————————————————————————————————————————————————————
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn bridge_new_is_empty() {
+        let bridge = WifiLinkBridge::new();
+        assert!(bridge.rx_queue.is_empty());
+        assert!(bridge.tx_pending.is_none());
+        assert_eq!(bridge.bssid, [0u8; 6]);
+        assert_eq!(bridge.mac, [0u8; 6]);
+        assert!(!bridge.associated.load(Ordering::Relaxed));
+        assert!(!bridge.active.load(Ordering::Relaxed));
+    }
+
+    #[test]
+    fn push_rx_enqueues_and_pops_correctly() {
+        let mut bridge = WifiLinkBridge::new();
+        bridge.active.store(true, Ordering::Release);
+
+        bridge.push_rx(vec![1, 2, 3, 4]);
+        bridge.push_rx(vec![5, 6, 7, 8]);
+        assert_eq!(bridge.available_for_read(), 2);
+
+        assert_eq!(bridge.pop_rx(), Some(vec![1, 2, 3, 4]));
+        assert_eq!(bridge.pop_rx(), Some(vec![5, 6, 7, 8]));
+        assert_eq!(bridge.pop_rx(), None);
+    }
+
+    #[test]
+    fn push_rx_when_inactive_drops() {
+        let mut bridge = WifiLinkBridge::new();
+        // active defaults to false
+        bridge.push_rx(vec![1, 2, 3]);
+        assert_eq!(bridge.available_for_read(), 0);
+        assert_eq!(bridge.stats.rx_dropped.load(Ordering::Relaxed), 1);
+    }
+
+    #[test]
+    fn rx_queue_over_capacity_drops_oldest() {
+        let mut bridge = WifiLinkBridge::new();
+        bridge.active.store(true, Ordering::Release);
+        for i in 0..(RX_QUEUE_CAPACITY + 5) {
+            bridge.push_rx(vec![i as u8; 10]);
+        }
+        assert_eq!(bridge.rx_queue.len(), RX_QUEUE_CAPACITY);
+        // First 5 frames were dropped
+        assert_eq!(
+            bridge.stats.rx_dropped.load(Ordering::Relaxed),
+            5
+        );
+        // Oldest remaining frame is the 6th pushed
+        assert_eq!(bridge.pop_rx(), Some(vec![5u8; 10]));
+    }
+
+    #[test]
+    fn submit_tx_single_frame_take_cycle() {
+        let mut bridge = WifiLinkBridge::new();
+        assert!(bridge.submit_tx(vec![0xAA; 64]));
+        assert!(bridge.has_tx_pending());
+        // Cannot submit second while one is pending
+        assert!(!bridge.submit_tx(vec![0xBB; 64]));
+        let frame = bridge.take_tx();
+        assert_eq!(frame, Some(vec![0xAA; 64]));
+        assert!(!bridge.has_tx_pending());
+    }
+
+    #[test]
+    fn global_bridge_set_and_clear() {
+        let bridge = Arc::new(Mutex::new(WifiLinkBridge::new()));
+        set_bridge(Arc::clone(&bridge));
+        assert!(with_bridge(|_b| 42).is_some());
+        clear_bridge();
+        assert!(with_bridge(|_b| 42).is_none());
+    }
+
+    #[test]
+    fn atomic_stats_snapshot_is_consistent() {
+        let stats = AtomicBridgeStats::default();
+        stats.inc_rx_frame(100);
+        stats.inc_rx_frame(200);
+        stats.inc_tx_frame(150);
+        stats.inc_rx_dropped();
+        stats.inc_rx_encrypted();
+        stats.inc_convert_error();
+
+        let snap = stats.snapshot();
+        assert_eq!(snap.rx_frames, 2);
+        assert_eq!(snap.rx_bytes, 300);
+        assert_eq!(snap.tx_frames, 1);
+        assert_eq!(snap.tx_bytes, 150);
+        assert_eq!(snap.rx_dropped, 1);
+        assert_eq!(snap.rx_encrypted, 1);
+        assert_eq!(snap.convert_errors, 1);
+    }
+
+    #[test]
+    fn bridge_activate_deactivate_state_machine() {
+        let bridge = Arc::new(Mutex::new(WifiLinkBridge::new()));
+        set_bridge(Arc::clone(&bridge));
+
+        // initially inactive
+        {
+            let b = bridge.lock().unwrap();
+            assert!(!b.active.load(Ordering::Relaxed));
+            assert!(!b.associated.load(Ordering::Relaxed));
+        }
+
+        // activate
+        {
+            let mut b = bridge.lock().unwrap();
+            b.active.store(true, Ordering::Release);
+            b.associated.store(true, Ordering::Release);
+        }
+
+        // RX should now work
+        {
+            let mut b = bridge.lock().unwrap();
+            b.push_rx(vec![1, 2, 3]);
+            assert_eq!(b.available_for_read(), 1);
+        }
+
+        clear_bridge();
+    }
+
+    #[test]
+    fn bridge_default_stats_all_zero() {
+        let stats = AtomicBridgeStats::default();
+        let snap = stats.snapshot();
+        assert_eq!(snap.rx_frames, 0);
+        assert_eq!(snap.tx_frames, 0);
+        assert_eq!(snap.rx_bytes, 0);
+        assert_eq!(snap.tx_bytes, 0);
+        assert_eq!(snap.rx_dropped, 0);
+        assert_eq!(snap.tx_dropped, 0);
+        assert_eq!(snap.rx_encrypted, 0);
+        assert_eq!(snap.convert_errors, 0);
+    }
+
+    #[test]
+    fn take_tx_none_when_empty() {
+        let mut bridge = WifiLinkBridge::new();
+        assert_eq!(bridge.take_tx(), None);
+        assert!(!bridge.has_tx_pending());
+    }
+}
diff --git a/local/recipes/drivers/redbear-iwlwifi/source/src/bridge/scheme.rs b/local/recipes/drivers/redbear-iwlwifi/source/src/bridge/scheme.rs
new file mode 100644
index 0000000000..9ca8917c0e
--- /dev/null
+++ b/local/recipes/drivers/redbear-iwlwifi/source/src/bridge/scheme.rs
@@ -0,0 +1,453 @@
+//! Redox scheme daemon for `network.wlan0`.
+//!
+//! Registers a scheme at `network.wlan0` that the netstack's smolnetd
+//! can open and use to send/receive raw Ethernet frames.  The scheme
+//! implementation is self-contained within the iwlwifi daemon — no
+//! separate process needed.
+//!
+//! On the host (non-Redox), the scheme module is stubbed out so the
+//! bridge core compiles and tests.  Only on the Redox target does
+//! the real scheme registration and event loop activate.
+
+use std::sync::atomic::Ordering;
+use std::sync::{Arc, Mutex};
+
+use super::convert::ethernet_to_wifi;
+use super::WifiLinkBridge;
+
+// —— Minimal handle-map (avoids external deps) —————————————————————
+
+enum HandleKind {
+    Data,
+    Mac,
+    Root,
+}
+
+struct HandleEntry {
+    kind: HandleKind,
+    _flags: u32,
+}
+
+struct HandleMap {
+    next: usize,
+    map: std::collections::HashMap<usize, HandleEntry>,
+}
+
+impl HandleMap {
+    fn new() -> Self {
+        Self { next: 0, map: std::collections::HashMap::new() }
+    }
+
+    fn insert(&mut self, kind: HandleKind) -> usize {
+        let id = self.next;
+        self.next = self.next.wrapping_add(1);
+        self.map.insert(id, HandleEntry { kind, _flags: 0 });
+        id
+    }
+
+    fn get(&self, id: usize) -> Option<&HandleKind> {
+        self.map.get(&id).map(|e| &e.kind)
+    }
+
+    fn remove(&mut self, id: usize) -> bool {
+        self.map.remove(&id).is_some()
+    }
+
+    fn data_handles(&self) -> Vec<usize> {
+        self.map.iter()
+            .filter(|(_, e)| matches!(e.kind, HandleKind::Data))
+            .map(|(id, _)| *id)
+            .collect()
+    }
+}
+
+// —— Host stub ——————————————————————————————————————————————————
+
+#[cfg(not(target_os = "redox"))]
+pub fn run_event_loop(
+    _scheme_name: &str,
+    _bridge: Arc<Mutex<WifiLinkBridge>>,
+    _mac: [u8; 6],
+    _bssid: [u8; 6],
+) -> ! {
+    log::info!("bridge::scheme: host mode — sleeping (scheme only on Redox)");
+    loop {
+        std::thread::sleep(std::time::Duration::from_secs(600));
+    }
+}
+
+// —— Redox implementation ——————————————————————————————————————
+
+#[cfg(target_os = "redox")]
+mod inner {
+    use super::*;
+    use libredox::flag::{EVENT_READ, O_NONBLOCK};
+    use std::cmp;
+    use std::io;
+    use syscall::flag;
+    use syscall::{
+        Error, Result as SysResult, EBADF, EAGAIN, EINVAL, EWOULDBLOCK, MODE_FILE, Packet,
+    };
+
+    pub struct SchemeInner {
+        name: String,
+        handles: HandleMap,
+        fd: usize,
+        bridge: Arc<Mutex<WifiLinkBridge>>,
+        mac: [u8; 6],
+        bssid: [u8; 6],
+    }
+
+    const SYS_OPEN: usize = syscall::number::SYS_OPEN;
+    const SYS_READ: usize = syscall::number::SYS_READ;
+    const SYS_WRITE: usize = syscall::number::SYS_WRITE;
+    const SYS_FPATH: usize = syscall::number::SYS_FPATH;
+    const SYS_FSTAT: usize = syscall::number::SYS_FSTAT;
+    const SYS_FSYNC: usize = syscall::number::SYS_FSYNC;
+    const SYS_CLOSE: usize = syscall::number::SYS_CLOSE;
+    const SYS_FEVENT: usize = syscall::number::SYS_FEVENT;
+
+    impl SchemeInner {
+        pub fn new(
+            name: &str,
+            bridge: Arc<Mutex<WifiLinkBridge>>,
+            mac: [u8; 6],
+            bssid: [u8; 6],
+        ) -> io::Result<Self> {
+            let path = format!(":{}", name);
+            let fd = syscall::open(&path, flag::O_RDWR | flag::O_NONBLOCK | flag::O_CREAT)
+                .map_err(|e| io::Error::new(io::ErrorKind::Other, format!("scheme socket {}: {:?}", path, e)))?;
+
+            log::info!("bridge::scheme: registered {}", name);
+
+            Ok(Self {
+                name: name.to_string(),
+                handles: HandleMap::new(),
+                fd,
+                bridge,
+                mac,
+                bssid,
+            })
+        }
+
+        pub fn fd(&self) -> usize { self.fd }
+
+        pub fn tick(&mut self) -> io::Result<bool> {
+            let mut pkt = Packet::default();
+            match syscall::read(self.fd, &mut pkt) {
+                Ok(_) => { self.dispatch(pkt)?; Ok(true) }
+                Err(err) if err.errno == syscall::EAGAIN => Ok(false),
+                Err(err) => Err(io::Error::from_raw_os_error(err.errno)),
+            }
+        }
+
+        pub fn notify_readers(&self) {
+            for id in self.handles.data_handles() {
+                let p = Packet {
+                    id: 0,
+                    a: SYS_FEVENT,
+                    b: id,
+                    c: EVENT_READ.bits(),
+                    d: 0,
+                };
+                let _ = syscall::write(self.fd, &p);
+            }
+        }
+
+        fn dispatch(&mut self, pkt: Packet) -> io::Result<()> {
+            let result = match pkt.a {
+                SYS_OPEN => self.do_open(&pkt),
+                SYS_READ => self.do_read(&pkt),
+                SYS_WRITE => self.do_write(&pkt),
+                SYS_FPATH => self.do_fpath(&pkt),
+                SYS_FSTAT => self.do_fstat(&pkt),
+                SYS_FSYNC => self.do_fsync(&pkt),
+                SYS_CLOSE => { self.handles.remove(pkt.b); Ok(None) }
+                _ => Err(Error::new(syscall::ENOSYS)),
+            };
+
+            let id = pkt.id;
+            match result {
+                Ok(Some(mut r)) => { r.id = id; syscall::write(self.fd, &r).ok(); }
+                Ok(None) => {}
+                Err(err) => {
+                    let mut r = Packet::default();
+                    r.id = id;
+                    r.a = err.errno;
+                    if err.errno != EAGAIN && err.errno != EWOULDBLOCK {
+                        syscall::write(self.fd, &r).ok();
+                    }
+                }
+            }
+            Ok(())
+        }
+
+        fn do_open(&mut self, _pkt: &Packet) -> SysResult<Option<Packet>> {
+            let id = self.handles.insert(HandleKind::Data);
+            let mut r = Packet::default();
+            r.a = 0;
+            r.b = id;
+            Ok(Some(r))
+        }
+
+        fn do_read(&mut self, pkt: &Packet) -> SysResult<Option<Packet>> {
+            let hid = pkt.b;
+            let max = pkt.c;
+            let fl = pkt.d as u32;
+            let kind = self.handles.get(hid).ok_or(Error::new(EBADF))?;
+
+            match kind {
+                HandleKind::Mac => {
+                    let off = pkt.d as usize;
+                    let mac = self.mac;
+                    if off >= 6 {
+                        let mut r = Packet::default(); r.a = 0; r.b = 0; return Ok(Some(r));
+                    }
+                    let n = cmp::min(max, 6 - off);
+                    let mut r = Packet::default();
+                    r.a = 0;
+                    r.b = n;
+                    unsafe {
+                        std::ptr::copy_nonoverlapping(mac[off..].as_ptr(), &mut r.c as *mut usize as *mut u8, n);
+                    }
+                    Ok(Some(r))
+                }
+                HandleKind::Data => {
+                    let mut bridge = self.bridge.lock().unwrap();
+                    match bridge.pop_rx() {
+                        Some(frame) => {
+                            let n = cmp::min(frame.len(), max);
+                            let mut r = Packet::default();
+                            r.a = 0;
+                            r.b = n;
+                            unsafe {
+                                std::ptr::copy_nonoverlapping(frame.as_ptr(), &mut r.c as *mut usize as *mut u8, n);
+                            }
+                            Ok(Some(r))
+                        }
+                        None => {
+                            if fl & O_NONBLOCK as u32 != 0 {
+                                Err(Error::new(EAGAIN))
+                            } else {
+                                Err(Error::new(EWOULDBLOCK))
+                            }
+                        }
+                    }
+                }
+                _ => Err(Error::new(EBADF)),
+            }
+        }
+
+        fn do_write(&mut self, pkt: &Packet) -> SysResult<Option<Packet>> {
+            let hid = pkt.b;
+            let len = pkt.c;
+            let kind = self.handles.get(hid).ok_or(Error::new(EBADF))?;
+
+            if !matches!(kind, HandleKind::Data) {
+                return Err(Error::new(EINVAL));
+            }
+
+            // Extract data from the packet's inline area
+            let mut buf = vec![0u8; cmp::min(len, std::mem::size_of::<usize>() * 4)];
+            unsafe {
+                let src = &pkt.c as *const usize as *const u8;
+                std::ptr::copy_nonoverlapping(src, buf.as_mut_ptr(), buf.len());
+            }
+            buf.truncate(len);
+
+            // Convert Ethernet → 802.11 and submit
+            let bssid = self.bssid;
+            let mac = self.mac;
+            if let Some(wifi) = ethernet_to_wifi(&buf, &bssid, &mac) {
+                // Try submitting via C TX path
+                let submitted = unsafe { rb_iwlwifi_bridge_tx_submit(wifi.as_ptr(), wifi.len()) };
+                if submitted != 0 {
+                    self.bridge.lock().unwrap().stats.inc_tx_dropped();
+                    return Err(Error::new(syscall::EIO));
+                }
+                self.bridge.lock().unwrap().stats.inc_tx_frame(buf.len());
+
+                let mut r = Packet::default();
+                r.a = 0;
+                r.b = len;
+                Ok(Some(r))
+            } else {
+                self.bridge.lock().unwrap().stats.inc_tx_dropped();
+                Err(Error::new(EINVAL))
+            }
+        }
+
+        fn do_fpath(&mut self, _pkt: &Packet) -> SysResult<Option<Packet>> {
+            let name = self.name.clone();
+            let mut r = Packet::default();
+            r.a = 0;
+            r.b = name.len();
+            unsafe {
+                std::ptr::copy_nonoverlapping(name.as_ptr(), &mut r.c as *mut usize as *mut u8, name.len());
+            }
+            Ok(Some(r))
+        }
+
+        fn do_fstat(&mut self, pkt: &Packet) -> SysResult<Option<Packet>> {
+            let hid = pkt.b;
+            let kind = self.handles.get(hid).ok_or(Error::new(EBADF))?;
+            let mut r = Packet::default();
+            r.a = 0;
+            match kind {
+                HandleKind::Data => { r.c = MODE_FILE | 0o700; }
+                HandleKind::Mac => { r.c = MODE_FILE | 0o400; r.d = 6; }
+                HandleKind::Root => { r.c = MODE_FILE | 0o500; }
+            }
+            Ok(Some(r))
+        }
+
+        fn do_fsync(&mut self, _pkt: &Packet) -> SysResult<Option<Packet>> {
+            let mut r = Packet::default();
+            r.a = 0;
+            Ok(Some(r))
+        }
+    }
+
+    // FFI: TX submission — called by bridge to send a Wi-Fi frame
+    extern "C" {
+        fn rb_iwlwifi_bridge_tx_submit(data: *const u8, len: usize) -> i32;
+    }
+}
+
+// —— Public event loop —————————————————————————————————————————
+
+#[cfg(target_os = "redox")]
+pub fn run_event_loop(
+    scheme_name: &str,
+    bridge: Arc<Mutex<WifiLinkBridge>>,
+    mac: [u8; 6],
+    bssid: [u8; 6],
+) -> ! {
+    use inner::SchemeInner;
+
+    bridge.lock().unwrap().active.store(true, Ordering::Release);
+
+    let mut scheme = match SchemeInner::new(scheme_name, Arc::clone(&bridge), mac, bssid) {
+        Ok(s) => s,
+        Err(e) => {
+            log::error!("bridge::scheme: failed to create scheme: {}", e);
+            std::process::exit(1);
+        }
+    };
+
+    log::info!("bridge::scheme: event loop running on {}", scheme_name);
+
+    loop {
+        // Process incoming scheme requests
+        match scheme.tick() {
+            Ok(true) => { /* handled one request */ }
+            Ok(false) => { /* no work */ }
+            Err(e) => {
+                log::error!("bridge::scheme: tick error: {}", e);
+                // Continue — don't crash on transient errors
+            }
+        }
+
+        // Drain pending TX
+        let tx_frame = {
+            let mut b = bridge.lock().unwrap();
+            b.take_tx()
+        };
+        if let Some(eth) = tx_frame {
+            let (bssid_copy, mac_copy) = {
+                let b = bridge.lock().unwrap();
+                (b.bssid, b.mac)
+            };
+            if let Some(wifi) = ethernet_to_wifi(&eth, &bssid_copy, &mac_copy) {
+                unsafe {
+                    let rc = inner::rb_iwlwifi_bridge_tx_submit(wifi.as_ptr(), wifi.len());
+                    if rc != 0 {
+                        bridge.lock().unwrap().stats.inc_tx_dropped();
+                    } else {
+                        bridge.lock().unwrap().stats.inc_tx_frame(eth.len());
+                    }
+                }
+            } else {
+                bridge.lock().unwrap().stats.inc_tx_dropped();
+            }
+        }
+
+        // Notify readers if data is available
+        if bridge.lock().unwrap().available_for_read() > 0 {
+            scheme.notify_readers();
+        }
+
+        // Small yield to avoid busy-looping when idle
+        std::thread::sleep(std::time::Duration::from_millis(1));
+    }
+}
+
+// —— Tests ———————————————————————————————————————————————————————
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn handle_map_insert_and_lookup() {
+        let mut map = HandleMap::new();
+        let a = map.insert(HandleKind::Data);
+        let b = map.insert(HandleKind::Mac);
+        let c = map.insert(HandleKind::Root);
+
+        assert!(matches!(map.get(a), Some(HandleKind::Data)));
+        assert!(matches!(map.get(b), Some(HandleKind::Mac)));
+        assert!(matches!(map.get(c), Some(HandleKind::Root)));
+
+        assert!(map.remove(b));
+        assert!(map.get(b).is_none());
+        assert!(matches!(map.get(a), Some(HandleKind::Data)));
+    }
+
+    #[test]
+    fn handle_map_data_handles_only() {
+        let mut map = HandleMap::new();
+        let d1 = map.insert(HandleKind::Data);
+        let _m = map.insert(HandleKind::Mac);
+        let d2 = map.insert(HandleKind::Data);
+
+        let data = map.data_handles();
+        assert_eq!(data.len(), 2);
+        assert!(data.contains(&d1));
+        assert!(data.contains(&d2));
+    }
+
+    #[test]
+    fn bridge_read_write_state_machine() {
+        // This test verifies the bridge's TX/RX state machine
+        // without involving the actual Redox scheme.
+        let bridge = Arc::new(Mutex::new(WifiLinkBridge::new()));
+        bridge.lock().unwrap().active.store(true, Ordering::Release);
+
+        // Push a frame
+        let eth = vec![0xAAu8; 64];
+        bridge.lock().unwrap().push_rx(eth.clone());
+        assert_eq!(bridge.lock().unwrap().available_for_read(), 1);
+
+        // Read it back
+        let popped = bridge.lock().unwrap().pop_rx();
+        assert_eq!(popped, Some(eth));
+
+        // Empty
+        assert_eq!(bridge.lock().unwrap().available_for_read(), 0);
+        assert_eq!(bridge.lock().unwrap().pop_rx(), None);
+    }
+
+    #[test]
+    fn bridge_tx_submit_and_take() {
+        let bridge = Arc::new(Mutex::new(WifiLinkBridge::new()));
+        let frame = vec![0xBBu8; 128];
+        assert!(bridge.lock().unwrap().submit_tx(frame.clone()));
+        assert!(bridge.lock().unwrap().has_tx_pending());
+        assert!(!bridge.lock().unwrap().submit_tx(vec![0xCCu8; 16]));
+
+        let taken = bridge.lock().unwrap().take_tx();
+        assert_eq!(taken, Some(frame));
+        assert!(!bridge.lock().unwrap().has_tx_pending());
+    }
+}
diff --git a/local/recipes/drivers/redbear-iwlwifi/source/src/linux_port.c b/local/recipes/drivers/redbear-iwlwifi/source/src/linux_port.c
index f54744c643..368f174eff 100644
--- a/local/recipes/drivers/redbear-iwlwifi/source/src/linux_port.c
+++ b/local/recipes/drivers/redbear-iwlwifi/source/src/linux_port.c
@@ -898,6 +898,8 @@ static int rb_iwlwifi_register_mac80211_locked(struct iwl_trans_pcie *trans)
         return -EIO;
     }
 
+    rb_iwlwifi_bridge_register_rx(trans->hw);
+
     rb_mld_init((void *)trans);
 
     trans->netdev = alloc_netdev_mqs(0, "wlan%d", 0, NULL, 1, 1);
@@ -2675,3 +2677,39 @@ int rb_iwlwifi_register_mac80211(struct pci_dev *dev, char *out, unsigned long o
     mutex_unlock(&rb_iwlwifi_transport_lock);
     return rc;
 }
+
+/* ── Bridge registration and TX submission ──────────────────── */
+
+/* Rust callback: bridge/src/callback.rs */
+extern void bridge_rx_callback(void *hw, struct sk_buff *skb);
+
+/* Last registered hw (for TX submission from Rust). */
+static struct ieee80211_hw *rb_iwlwifi_bridge_hw;
+
+void rb_iwlwifi_bridge_register_rx(struct ieee80211_hw *hw)
+{
+    if (!hw)
+        return;
+    rb_iwlwifi_bridge_hw = hw;
+    ieee80211_register_rx_handler(hw, bridge_rx_callback);
+    pr_info("bridge: RX callback registered for hw=%p\n", (void *)hw);
+}
+
+int rb_iwlwifi_bridge_tx_submit(const uint8_t *data, size_t len)
+{
+    struct ieee80211_hw *hw = rb_iwlwifi_bridge_hw;
+    struct sk_buff *skb;
+
+    if (!hw || !data || len == 0)
+        return -EINVAL;
+
+    skb = alloc_skb((unsigned int)len + 32U, GFP_KERNEL);
+    if (!skb)
+        return -ENOMEM;
+
+    skb_reserve(skb, 16U);
+    memcpy(skb_put(skb, (unsigned int)len), data, len);
+    iwl_ops_tx_skb(hw, skb);
+
+    return 0;
+}
diff --git a/local/recipes/drivers/redbear-iwlwifi/source/src/main.rs b/local/recipes/drivers/redbear-iwlwifi/source/src/main.rs
index 96527c1bee..c91a7c242a 100644
--- a/local/recipes/drivers/redbear-iwlwifi/source/src/main.rs
+++ b/local/recipes/drivers/redbear-iwlwifi/source/src/main.rs
@@ -3,6 +3,7 @@ use std::fs;
 use std::path::PathBuf;
 
 mod mld;
+mod bridge;
 
 #[cfg(target_os = "redox")]
 use redox_driver_sys::memory::{CacheType, MmioProt};
@@ -229,11 +230,27 @@ fn main() {
         }
         Some("--daemon") => {
             let target = args.next().or_else(daemon_target_from_env);
-            run_device_action(&firmware_root, target, full_init_candidate, "daemon-init");
-            eprintln!("redbear-iwlwifi: init complete, staying resident");
-            loop {
-                std::thread::sleep(std::time::Duration::from_secs(3600));
-            }
+            run_device_action(&firmware_root, target.clone(), full_init_candidate, "daemon-init");
+            eprintln!("redbear-iwlwifi: init complete, starting datapath bridge");
+            
+            // Initialize the Wi-Fi datapath bridge
+            let bridge = std::sync::Arc::new(std::sync::Mutex::new(
+                bridge::WifiLinkBridge::new()
+            ));
+            
+            // Set BSSID and MAC from the candidate (post-association)
+            // The BSSID is populated by the firmware during connect
+            // Default MAC is derived below
+            
+            bridge::set_bridge(std::sync::Arc::clone(&bridge));
+            
+            // Run the bridge event loop — this never returns
+            bridge::scheme::run_event_loop(
+                "network.wlan0",
+                bridge,
+                [0u8; 6],  // MAC — populated by firmware/quirks at probe time
+                [0u8; 6],  // BSSID — populated after association
+            );
         }
         Some("--daemon-target") => match daemon_target_from_env() {
             Some(target) => println!("daemon_target={target}"),
diff --git a/local/recipes/system/evdevd/source/src/main.rs b/local/recipes/system/evdevd/source/src/main.rs
index 45f13563e6..f6ca75b962 100644
--- a/local/recipes/system/evdevd/source/src/main.rs
+++ b/local/recipes/system/evdevd/source/src/main.rs
@@ -136,7 +136,39 @@ fn dispatch_input_event(event: Event, scheme: &mut EvdevScheme) {
             scheme.feed_mouse_buttons(button.left, button.middle, button.right)
         }
         EventOption::Scroll(scroll) => scheme.feed_mouse_scroll(scroll.x, scroll.y),
-        _ => {}
+
+        // orbclient "no event" sentinel — not a real event, ignore silently.
+        EventOption::None => {}
+
+        // Unrecognised event code from the input scheme. This is operationally
+        // anomalous (the input scheme should only emit codes orbclient knows),
+        // so surface it at warn for operator visibility.
+        EventOption::Unknown(unknown) => {
+            let (code, a, b) = (unknown.code, unknown.a, unknown.b);
+            log::warn!(
+                "evdevd: dropping unknown input event (code={} a={} b={}); no evdev mapping",
+                code,
+                a,
+                b
+            );
+        }
+
+        // Remaining variants (TextInput, Quit, Focus, Move, Resize, Screen,
+        // Clipboard, ClipboardUpdate, Drop, Hover) are orbclient window-system
+        // events with no evdev equivalent: evdev is a raw input-device protocol
+        // carrying scancodes, axes, and button state, while composed text,
+        // window lifecycle, and clipboard handling are compositor-level
+        // concerns that live above this daemon. They are not produced by
+        // /scheme/input/consumer_raw in practice; if one ever appears we log
+        // at debug so operators can trace the stream without flooding the
+        // default log level.
+        other => {
+            log::debug!(
+                "evdevd: ignoring non-device {:?} event; evdev forwards only \
+                 key/mouse/button/scroll events",
+                other
+            );
+        }
     }
 }
 
diff --git a/local/recipes/system/redbear-keymapd/source/src/scheme.rs b/local/recipes/system/redbear-keymapd/source/src/scheme.rs
index f3fc8dfbf5..691424a31a 100644
--- a/local/recipes/system/redbear-keymapd/source/src/scheme.rs
+++ b/local/recipes/system/redbear-keymapd/source/src/scheme.rs
@@ -129,10 +129,9 @@ impl SchemeSync for KeymapScheme {
             }
             HandleKind::Keymap { name }
         } else if self.keymaps.contains_key(cleaned) {
+            // Existence is already validated by contains_key above; the keymap
+            // content is materialized lazily in read() via keymaps.get().
             let name = cleaned.to_string();
-            if let Some(km) = self.keymaps.get(&name) {
-                let _ = km;
-            }
             HandleKind::Keymap { name }
         } else if cleaned.starts_with("set/") {
             let requested = &cleaned[4..];