# COMFAST CF-WR632AX boot loop

**URL:** <https://forum.openwrt.org/t/comfast-cf-wr632ax-boot-loop/254085>\
**Category:** Installing and Using OpenWrt\
**Created:** [October 1, 2026, 4:19pm UTC](https://forum.openwrt.org/t/comfast-cf-wr632ax-boot-loop/254085 "2026-10-01T16:19:10Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![VBic1993](https://forum.openwrt.org/letter_avatar/vbic1993/32/5_5575768a8748004e209b776fc1b2916d.png) [@VBic1993](https://forum.openwrt.org/u/VBic1993)\
**Post date:** [October 1, 2026, 4:19pm UTC](https://forum.openwrt.org/t/comfast-cf-wr632ax-boot-loop/254085/1 "2026-10-01T16:19:10Z")

</div>

Hi guys, on 25.12.5 Comfast is going under reboot loop, if Wirelles 2.4 is enabled, from my tests this is due to wireless.radio0.txpower\>=15 if value is set to 10 Wireless will work and Router will not enter on a loop. To bring back Device on loop go to MediaTek U BOOT Recovery Mode and Upload sysupgrade.bin file

---

<div class="post-metadata">

**Author:** ![frollic](https://forum.openwrt.org/user_avatar/forum.openwrt.org/frollic/32/30113_2.png) [@frollic](https://forum.openwrt.org/u/frollic)\
**Post date:** [October 2, 2026, 2:28pm UTC](https://forum.openwrt.org/t/comfast-cf-wr632ax-boot-loop/254085/2 "2026-10-02T14:28:03Z")

</div>

> <https://github.com/openwrt/openwrt/issues/24594>
>
> \### Describe the bug
> 
> I came across \[this forum post\](https://forum.openwrt.org/…t/setting-up-comfast-wr632ax/) which made me realize that my issue was not isolated, and as such am opening this ticket.
> 
> I have purchased a number of Comfast WR632AX devices for my family and in-laws through AliExpress over the last 1.5 years or so. I have 2 devices where enabling the 2.4GHz radio causes a Kernel crash (timing ranging as early as "Enable" is pressed in Luci, or up to 24 hours later).
> 
> I have experienced this using both stock uboot as well as uboot-mod (having tested that, I have reverted to standard uboot).
> 
> When the system goes down, it is due to a Kernel crash. Below I am pasting 2 examples from /sys/fs/pstore/. The point of failure sometimes is different, but they are consistently related to 2.4GHz radio. If 2.4GHz is disabled (keeping 5GHz enabled), the device stays up indefinitely. This to me indicates a bug in the wifi drivers are triggering a kernel crash at random points:
> 
> \`\`\`
> \<1\>\[232.438884\] Unable to handle kernel paging request at virtual address fffffd8000004908
> \<1\>\[232.446836\] Mem abort info:
> \<1\>\[232.449619\] ESR = 0x0000000096000004
> \<1\>\[232.453385\] EC = 0x25: DABT (current EL), IL = 32 bits
> \<1\>\[232.458695\] SET = 0, FnV = 0
> \<1\>\[232.461753\] EA = 0, S1PTW = 0
> \<1\>\[232.464891\] FSC = 0x04: level 0 translation fault
> \<1\>\[232.469763\] Data abort info:
> \<1\>\[232.472654\] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
> \<1\>\[232.478127\] CM = 0, WnR = 0, TnD = 0, TagAccess = 0
> \<1\>\[232.483188\] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
> \<1\>\[232.488498\] \[fffffd8000004908\] address between user and kernel address ranges
> \<0\>\[232.495636\] Internal error: Oops: 0000000096000004 \[#1\] SMP
> \<7\>\[232.501284\] Modules linked in: pppoe ppp\_async nft\_fib\_inet nf\_flow\_table\_inet wireguard pppox ppp\_generic nft\_reject\_ipv6 nft\_reject\_ipv4 nft\_reject\_inet nft\_reject nft
> \_redir nft\_quota nft\_numgen nft\_nat nft\_masq nft\_log nft\_limit nft\_hash nft\_flow\_offload nft\_fib\_ipv6 nft\_fib\_ipv4 nft\_fib nft\_ct nft\_chain\_nat nf\_tables nf\_nat nf\_flow\_table
> nf\_conntrack\_netlink nf\_conntrack mt7915e(O) mt76\_connac\_lib(O) mt76(O) mac80211(O) libchacha20poly1305 cfg80211(O) slhc pwm\_gpio nfnetlink nf\_reject\_ipv6 nf\_reject\_ipv4 nf\_lo
> g\_syslog nf\_defrag\_ipv6 nf\_defrag\_ipv4 libpoly1305 libcurve25519 libchacha compat(O) crypto\_safexcel pwm\_fan ip6\_udp\_tunnel udp\_tunnel sha1 seqiv md5 libmd5 geniv des\_generic
> libdes authencesn authenc leds\_gpio xhci\_plat\_hcd xhci\_pci xhci\_mtk\_hcd xhci\_hcd gpio\_button\_hotplug(O) usbcore usb\_common
> \<7\>\[232.572696\] CPU: 0 UID: 101 PID: 1724 Comm: hostapd Tainted: G O #0 NONE
> \<7\>\[232.581643\] Tainted: \[O\]=OOT\_MODULE
> \<7\>\[232.585118\] Hardware name: COMFAST CF-WR632AX
> \<7\>\[232.591978\] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> \<7\>\[232.598927\] pc : kvfree\_call\_rcu+0x5c/0x400
> \<7\>\[232.603104\] lr : kvfree\_call\_rcu+0x20/0x400
> \<7\>\[232.607276\] sp : ffffffc08179b890
> \<7\>\[232.610579\] x29: ffffffc08179b890 x28: 000000000000000f x27: 000000000000030b
> \<7\>\[232.617706\] x26: 000000000000000e x25: 000000000000010a x24: ffffff80003fd680
> \<7\>\[232.624832\] x23: ffffff80003fdd08 x22: 000000000000000e x21: ffffff80003fdd00
> \<7\>\[232.631959\] x20: ffffffc08179baa0 x19: ffffffc08179bde8 x18: ffffffc08179bde8
> \<7\>\[232.639087\] x17: ffffff8003bc4540 x16: ffffff8003bc4cc0 x15: 0000000000000000
> \<7\>\[232.646213\] x14: ffffff80037d3600 x13: 0000000000000000 x12: ffffff8003b91840
> \<7\>\[232.653340\] x11: 0000000000000000 x10: ffffff80038c0780 x9 : ffffff80038ace40
> \<7\>\[232.660467\] x8 : ffffff80038a00c0 x7 : ffffff8003825c00 x6 : 0000000000000000
> \<7\>\[232.667593\] x5 : 000000000000030b x4 : 0000000000000000 x3 : ffffff8001185f50
> \<7\>\[232.674719\] x2 : fffffd80000048ff x1 : 00000000000000f5 x0 : fffffd8000004900
> \<7\>\[232.681846\] Call trace:
> \<7\>\[232.684281\] kvfree\_call\_rcu+0x5c/0x400 (P)
> \<7\>\[232.688456\] mas\_wr\_node\_store+0x2ec/0x380
> \<7\>\[232.692547\] mas\_wr\_store\_entry+0x27c/0x3c0
> \<7\>\[232.696723\] mas\_store\_prealloc+0x178/0x398
> \<7\>\[232.700899\] vma\_complete+0x26c/0x2c8
> \<7\>\[232.704556\] \_\_split\_vma+0x228/0x2a4
> \<7\>\[232.708125\] vms\_gather\_munmap\_vmas+0xd8/0x2c4
> \<7\>\[232.712561\] do\_vmi\_align\_munmap+0xb4/0x154
> \<7\>\[232.716737\] do\_vmi\_munmap+0x84/0xe8
> \<7\>\[232.720305\] \_\_vm\_munmap+0x98/0x11c
> \<7\>\[232.723788\] \_\_arm64\_sys\_munmap+0x1c/0x28
> \<7\>\[232.727787\] invoke\_syscall.constprop.0+0x48/0xb0
> \<7\>\[232.732484\] do\_el0\_svc+0x3c/0xb0
> \<7\>\[232.735792\] el0\_svc+0x18/0x60
> \<7\>\[232.738841\] el0t\_64\_sync\_handler+0x98/0xdc
> \<7\>\[232.743014\] el0t\_64\_sync+0x158/0x15c
> \<0\>\[232.746672\] Code: 3940cc01 7103d43f 54000081 f9400400 (f9400401)
> \<4\>\[232.752751\] ---\[end trace 0000000000000000 \]---
> 
> \`\`\`
> 
> 
> And here is another that just happend after about 5 minutes of 2.4GHz being enabled:
> 
> \`\`\`
> \<1\>\[18.901190\] Unable to handle kernel paging request at virtual address fffffd80024d2d20
> \<1\>\[18.909111\] Mem abort info:
> \<1\>\[18.911919\] ESR = 0x0000000096000004
> \<1\>\[18.915657\] EC = 0x25: DABT (current EL), IL = 32 bits
> \<1\>\[18.920959\] SET = 0, FnV = 0
> \<1\>\[18.924024\] EA = 0, S1PTW = 0
> \<1\>\[18.927157\] FSC = 0x04: level 0 translation fault
> \<1\>\[18.932030\] Data abort info:
> \<1\>\[18.934899\] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
> \<1\>\[18.940370\] CM = 0, WnR = 0, TnD = 0, TagAccess = 0
> \<1\>\[18.945416\] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
> \<1\>\[18.950716\] \[fffffd80024d2d20\] address between user and kernel address ranges
> \<0\>\[18.957853\] Internal error: Oops: 0000000096000004 \[#1\] SMP
> \<7\>\[18.963501\] Modules linked in: pppoe ppp\_async nft\_flow\_offload nft\_fib\_inet nf\_flow\_table\_inet nf\_flow\_table wireguard pppox ppp\_generic nft\_reject\_ipv6 nft\_reject\_ipv4
> nft\_reject\_inet nft\_reject nft\_redir nft\_quota nft\_numgen nft\_nat nft\_masq nft\_log nft\_limit nft\_hash nft\_fib\_ipv6 nft\_fib\_ipv4 nft\_fib nft\_ct nft\_chain\_nat nf\_tables nf\_nat
> nf\_conntrack\_netlink nf\_conntrack mt7915e(O) mt76\_connac\_lib(O) mt76(O) mac80211(O) libchacha20poly1305 cfg80211(O) slhc rtc\_pcf8563 nfnetlink nf\_reject\_ipv6 nf\_reject\_ipv4 nf
> \_log\_syslog nf\_defrag\_ipv6 nf\_defrag\_ipv4 libpoly1305 libcurve25519 libchacha compat(O) crypto\_safexcel ip6\_udp\_tunnel udp\_tunnel sha1 seqiv md5 libmd5 geniv des\_generic libde
> s authencesn authenc leds\_gpio xhci\_plat\_hcd xhci\_pci xhci\_mtk\_hcd xhci\_hcd gpio\_button\_hotplug(O) usbcore usb\_common air\_en8811h
> \<7\>\[19.035522\] CPU: 1 UID: 0 PID: 920 Comm: napi/phy0-0 Tainted: G O 6.18.41 #0 NONE
> \<7\>\[19.044556\] Tainted: \[O\]=OOT\_MODULE
> \<7\>\[19.048032\] Hardware name: COMFAST CF-WR632AX (DT)
> \<7\>\[19.052810\] pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> \<7\>\[19.059759\] pc : napi\_threaded\_poll+0x20/0x7c
> \<7\>\[19.064110\] lr : napi\_threaded\_poll+0x38/0x7c
> \<7\>\[19.068456\] sp : ffffffc081443e40
> \<7\>\[19.071758\] x29: ffffffc081443e40 x28: 0000000000000000 x27: 0000000000000000
> \<7\>\[19.078885\] x26: 0000000000000000 x25: 0000000000000000 x24: ffffff80024d2d10
> \<7\>\[19.086011\] x23: ffffffc08075ddc8 x22: ffffff8000b60e40 x21: 0000000000000001
> \<7\>\[19.093138\] x20: ffffff8000b60e40 x19: fffffd80024d2d10 x18: 0000000000000000
> \<7\>\[19.100264\] x17: ffffffbf9f1e8000 x16: ffffffc080ec0000 x15: 0672000000000000
> \<7\>\[19.107392\] x14: 00000000000002f2 x13: 00000000000002f2 x12: 000000000005d97b
> \<7\>\[19.114519\] x11: 00000000000000c0 x10: 00000000000008f0 x9 : ffffffc081443d80
> \<7\>\[19.121646\] x8 : ffffff8000b61790 x7 : 0000000000000001 x6 : 0000000000000000
> \<7\>\[19.128773\] x5 : 0000000168501bad x4 : 0000000000000002 x3 : ffffffbf9f1e8000
> \<7\>\[19.135899\] x2 : 0000000000000000 x1 : 0000000000208040 x0 : 0000000000000000
> \<7\>\[19.143026\] Call trace:
> \<7\>\[19.145461\] napi\_threaded\_poll+0x20/0x7c (P)
> \<7\>\[19.149811\] kthread+0xe4/0x1ac
> \<7\>\[19.152948\] ret\_from\_fork+0x10/0x20
> \<0\>\[19.156520\] Code: d5384114 f90013f5 52800035 14000004 (f9400a61)
> \<4\>\[19.162600\] ---\[end trace 0000000000000000 \]---
> \<3\>\[19.171307\] pstore: backend (ramoops) writing error (-28)
> \<0\>\[19.176698\] Kernel panic - not syncing: Oops: Fatal exception
> \<2\>\[19.182432\] SMP: stopping secondary CPUs
> \<0\>\[19.186348\] Kernel Offset: disabled
> \<0\>\[19.189824\] CPU features: 0x000000,00000000,00000001,0400400b
> \<0\>\[19.195557\] Memory Limit: none
> 
> \`\`\`
> 
> 
> I have reproduced this both with firmware-selector builds, as well as local compiled builds (containing a fix for nmbm in newer devices).
> Device vintage doesn't appear to be the root cause of this issue as 1 of the 2 devices is the "old FIB version" while the 2nd is the newer FIB version as explained in \[this PR\](https://github.com/openwrt/openwrt/pull/24552).
> 
> 
> \### OpenWrt version
> 
> r35650-5ecd3173d6
> 
> \### OpenWrt release
> 
> SNAPSHOT
> 
> \### OpenWrt target/subtarget
> 
> mediatek/filogic
> 
> \### Device
> 
> COMFAST CF-WR632AX
> 
> \### Image kind
> 
> Official downloaded image
> 
> \### Steps to reproduce
> 
> If the device is impacted (in my case it is not 100% of devices), setup 2.4GHz Wifi and enable. Time to crash has been observed as anytime between immediately upon enabling up to 24 hours later.
> 
> \### Actual behaviour
> 
> Device experiences Kernel crash, and in some cases could result in bootloop requiring recovery to be used.
> 
> \### Expected behaviour
> 
> Enablin 2.4Ghz does not cause Kernel crash.
> 
> \### Additional info
> 
> /etc/config/wireless:
> 
> \`\`\`
> config wifi-device 'radio0'
> option type 'mac80211'
> option path 'platform/soc/18000000.wifi'
> option band '2g'
> option channel '11'
> option htmode 'HE20'
> option country 'US'
> option cell\_density '0'
> option disabled '1'
> 
> config wifi-iface 'default\_radio0'
> option device 'radio0'
> option network 'lan'
> option mode 'ap'
> option ssid 'BROKEN-DO-NOT-ENABLE'
> option encryption 'psk2+ccmp'
> option dtim\_period '1'
> option max\_inactivity '15'
> option disassoc\_low\_ack '0'
> option key 'XXXXXXXX'
> option ieee80211r '1'
> option mobility\_domain '1111'
> option reassociation\_deadline '20000'
> option ft\_over\_ds '0'
> option ft\_psk\_generate\_local '1'
> option pmk\_r1\_push '1'
> option ieee80211k '1'
> option time\_advertisement '2'
> option time\_zone 'EST5EDT,M3.2.0,M11.1.0'
> option wnm\_sleep\_mode '1'
> option bss\_transition '1'
> option nasid 'lowercase MAC without colons'
> option disabled '1'
> 
> config wifi-device 'radio1'
> option type 'mac80211'
> option path 'platform/soc/18000000.wifi+1'
> option band '5g'
> option channel '36'
> option htmode 'HE80'
> option country 'US'
> option cell\_density '0'
> 
> config wifi-iface 'default\_radio1'
> option device 'radio1'
> option network 'lan'
> option mode 'ap'
> option ssid 'Works'
> option encryption 'psk2+ccmp'
> option dtim\_period '1'
> option max\_inactivity '15'
> option disassoc\_low\_ack '0'
> option key 'XXXXXXXXX'
> option ieee80211r '1'
> option mobility\_domain '1111'
> option reassociation\_deadline '20000'
> option ft\_over\_ds '0'
> option ft\_psk\_generate\_local '1'
> option pmk\_r1\_push '1'
> option ieee80211k '1'
> option time\_advertisement '2'
> option time\_zone 'EST5EDT,M3.2.0,M11.1.0'
> option wnm\_sleep\_mode '1'
> option bss\_transition '1'
> option nasid 'lowercase MAC without colons'
> \`\`\` 
> 
> \### Diffconfig
> 
> \`\`\`text
> 
> \`\`\`
> 
> \### Terms
> 
> \- \[x\] I am reporting an issue for OpenWrt, not an unsupported fork.

try a snapshot.

searching the forum for WR632AX would have gotten you some additional (and interesting/related) threads, but I guess you weren't able to locate the search function ☹

---

<div class="post-metadata">

**Author:** ![system](https://forum.openwrt.org/uploads/default/original/3X/7/4/740520c71f00039bbf001045c682f0ecb25e905a.png) [@system](https://forum.openwrt.org/u/system)\
**Post date:** [October 12, 2026, 2:28pm UTC](https://forum.openwrt.org/t/comfast-cf-wr632ax-boot-loop/254085/3 "2026-10-12T14:28:43Z")

</div>

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.