mesa-panvk-bifrost: iter10 polish — drop sandbox bypass, pin sha256, tighten loader select

iter10 of the panvk-bifrost campaign. Eliminates the cosmetic '--disable-gpu-sandbox' warning at brave-vulkan launch + pins the Mesa tarball hash + makes the Vulkan ICD selection deterministic across filesystems. PKGBUILD changes (pkgrel: 1 -> 2): - install ICD JSON at /usr/share/vulkan/icd.d/00-panvk-bifrost.json (was: /usr/lib/panvk-bifrost/icd.json — required VK_ICD_FILENAMES, which the GPU sandbox would strip, forcing --disable-gpu-sandbox) - libvulkan_panfrost.so install path unchanged at /usr/lib/panvk-bifrost/ - sha256sums[0] pinned to 1d3c3b8a8363b8cc354175bb4a684ad8b035211cc1d6fa17aeb9b9623c513f89 (mesa-26.0.6.tar.xz from archive.mesa3d.org); patches + brave-vulkan + icd.json remain SKIP since they're in-tree (git-tracked) brave-vulkan changes: - dropped --no-sandbox + --disable-gpu-sandbox: env vars MESA_VK_VERSION_OVERRIDE and PAN_I_WANT_A_BROKEN_VULKAN_DRIVER survive the GPU sandbox boundary (Mesa loader reads them pre-seccomp-lockdown) - dropped VK_ICD_FILENAMES (loader auto-picks via icd.d/ directory scan) - added VK_LOADER_DRIVERS_SELECT='00-panvk-bifrost*' for deterministic ICD selection — Vulkan loader's readdir order is implementation-defined per Khronos LoaderDriverInterface, so the '00-' filename prefix is not spec-backed (ext4 happens to give insertion-order, other filesystems may not). VK_LOADER_DRIVERS_SELECT short-circuits readdir ambiguity. (Phase 5 review hardening.) Test result on ohm (pre-push validation): - brave-vulkan launches Brave without sandbox bypass - seccomp-bpf sandboxes activate normally for utility/renderer processes - 'panvk is not a conformant Vulkan implementation' fires ONCE (loader-select excluded stock ICD from enumeration — only patched driver loads) - GPU process boots, no 'Exiting GPU process' error - Brave runs through full test timeout cleanly README updated to reflect the new install layout + simplified wrapper. Campaign artifacts: ~/src/panvk-bifrost/{phase0_findings_iter10.md, phase8_iteration9_close.md (which iter10 polishes)}. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
mesa-panvk-bifrost: new package — Vulkan-compositor Brave for Bifrost SBCs
2026-05-20 12:28:29 +02:00 · 2026-05-20 11:03:59 +02:00 · 2026-05-20 08:54:28 +00:00 · 2026-05-20 10:34:55 +02:00 · 2026-05-20 08:24:19 +00:00 · 2026-05-20 10:21:13 +02:00
48 changed files with 20396 additions and 13 deletions
@@ -784,3 +784,429 @@ jobs:
      - name: wipe secrets
        if: always()
        run: rm -f /root/.ssh/id_ed25519_hertz
  # -------------------------------------------------------------------------
  # ffmpeg-v4l2-request-fourier Debian (aarch64) — debian/<pkg>/build-deb.sh
  # builds the Kwiboo FFmpeg fork natively on the arch-aarch64 runner using
  # the arch toolchain + system libs, then dpkg-deb's the result.  Resulting
  # .deb is rsynced to hertz; reprepro publishes into bookworm + trixie.
  # -------------------------------------------------------------------------
  ffmpeg-v4l2-request-debian:
    needs: ffmpeg-v4l2-request-aarch64
    runs-on: arch-aarch64
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4
      - name: install build-deps (Arch pkg names; build-deb.sh links natively)
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
          retry pacman -Syu --noconfirm --needed \
            dpkg openssh rsync curl base-devel git nasm yasm \
            linux-api-headers mesa alsa-lib bzip2 fontconfig fribidi gmp \
            gnutls lame libass dav1d libdrm freetype2 libpulse libva \
            libvorbis libvpx libwebp x264 x265 libxml2 opus v4l-utils xz zlib
      - name: install hertz deploy ssh key
        env:
          KEY: ${{ secrets.MARFRIT_REPO_HERTZ_KEY }}
        run: |
          mkdir -m700 -p /root/.ssh
          printf '%s\n' "$KEY" > /root/.ssh/id_ed25519_hertz
          chmod 600 /root/.ssh/id_ed25519_hertz
          ssh-keyscan -t ed25519 hertz.fritz.box >> /root/.ssh/known_hosts 2>/dev/null
      - name: build ffmpeg-v4l2-request-fourier .deb
        run: |
          set -e
          cd debian/ffmpeg-v4l2-request-fourier
          ./build-deb.sh
          ls -la *.deb
      - name: upload + publish to suites
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
          cd debian/ffmpeg-v4l2-request-fourier
          DEB=$(ls ffmpeg-v4l2-request-fourier_*.deb | head -1)
          retry rsync -av -e 'ssh -i /root/.ssh/id_ed25519_hertz' "$DEB" \
              marfritrepo@hertz.fritz.box:
          for suite in bookworm trixie; do
              retry ssh -i /root/.ssh/id_ed25519_hertz marfritrepo@hertz.fritz.box \
                  "publish-deb $suite $DEB"
          done
      - name: wipe secrets
        if: always()
        run: rm -f /root/.ssh/id_ed25519_hertz
  # -------------------------------------------------------------------------
  # libva-v4l2-request-fourier Debian (aarch64) — meson build + dpkg-deb wrap.
  # -------------------------------------------------------------------------
  libva-v4l2-request-fourier-debian:
    needs: libva-v4l2-request-fourier-aarch64
    runs-on: arch-aarch64
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4
      - name: install build-deps
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
          retry pacman -Syu --noconfirm --needed \
            dpkg openssh rsync curl base-devel git meson ninja pkgconf \
            libva libdrm systemd-libs
      - name: install hertz deploy ssh key
        env:
          KEY: ${{ secrets.MARFRIT_REPO_HERTZ_KEY }}
        run: |
          mkdir -m700 -p /root/.ssh
          printf '%s\n' "$KEY" > /root/.ssh/id_ed25519_hertz
          chmod 600 /root/.ssh/id_ed25519_hertz
          ssh-keyscan -t ed25519 hertz.fritz.box >> /root/.ssh/known_hosts 2>/dev/null
      - name: build libva-v4l2-request-fourier .deb
        run: |
          set -e
          cd debian/libva-v4l2-request-fourier
          ./build-deb.sh
          ls -la *.deb
      - name: upload + publish to suites
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
          cd debian/libva-v4l2-request-fourier
          DEB=$(ls libva-v4l2-request-fourier_*.deb | head -1)
          retry rsync -av -e 'ssh -i /root/.ssh/id_ed25519_hertz' "$DEB" \
              marfritrepo@hertz.fritz.box:
          for suite in bookworm trixie; do
              retry ssh -i /root/.ssh/id_ed25519_hertz marfritrepo@hertz.fritz.box \
                  "publish-deb $suite $DEB"
          done
      - name: wipe secrets
        if: always()
        run: rm -f /root/.ssh/id_ed25519_hertz
  # -------------------------------------------------------------------------
  # mpv-fourier Debian (aarch64) — meson build links against
  # ffmpeg-v4l2-request-fourier's libavcodec to keep ABI symmetry between
  # the .deb's runtime dep declaration and the binary's actual linkage.
  # We pre-install the Arch sibling package from [marfrit] for that.
  # -------------------------------------------------------------------------
  mpv-fourier-debian:
    needs: mpv-fourier-aarch64
    runs-on: arch-aarch64
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4
      - name: install build-deps
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
          retry pacman -Syu --noconfirm --needed \
            dpkg openssh rsync curl base-devel git meson ninja python-docutils \
            ladspa wayland-protocols vulkan-headers \
            alsa-lib desktop-file-utils glibc hicolor-icon-theme jack lcms2 \
            libarchive libass libbluray libcdio libcdio-paranoia libdisplay-info \
            libdrm libdvdnav libdvdread libegl libgl libglvnd libjpeg-turbo \
            libplacebo libpulse libsixel libva libvdpau libx11 libxext \
            libxkbcommon libxpresent libxrandr libxss libxv luajit mesa mujs \
            libpipewire rubberband sdl2 openal uchardet vapoursynth \
            vulkan-icd-loader wayland zlib
      - name: configure [marfrit] repo + pre-install ffmpeg-v4l2-request-fourier
        run: |
          set -e
          curl -sLo /tmp/marfrit.gpg https://packages.reauktion.de/marfrit.gpg
          pacman-key --add /tmp/marfrit.gpg
          pacman-key --lsign-key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C
          rm -f /tmp/marfrit.gpg
          if ! grep -q '^\[marfrit\]' /etc/pacman.conf; then
            printf '\n[marfrit]\nServer = https://packages.reauktion.de/arch/$arch\nSigLevel = Required\n' >> /etc/pacman.conf
          fi
          pacman -Sy --noconfirm
          rm -f /var/cache/pacman/pkg/ffmpeg-v4l2-request-fourier-*-aarch64.pkg.tar.*
          printf 'y\ny\ny\n' | pacman -S marfrit/ffmpeg-v4l2-request-fourier
      - name: install hertz deploy ssh key
        env:
          KEY: ${{ secrets.MARFRIT_REPO_HERTZ_KEY }}
        run: |
          mkdir -m700 -p /root/.ssh
          printf '%s\n' "$KEY" > /root/.ssh/id_ed25519_hertz
          chmod 600 /root/.ssh/id_ed25519_hertz
          ssh-keyscan -t ed25519 hertz.fritz.box >> /root/.ssh/known_hosts 2>/dev/null
      - name: build mpv-fourier .deb
        run: |
          set -e
          cd debian/mpv-fourier
          ./build-deb.sh
          ls -la *.deb
      - name: upload + publish to suites
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
          cd debian/mpv-fourier
          DEB=$(ls mpv-fourier_*.deb | head -1)
          retry rsync -av -e 'ssh -i /root/.ssh/id_ed25519_hertz' "$DEB" \
              marfritrepo@hertz.fritz.box:
          for suite in bookworm trixie; do
              retry ssh -i /root/.ssh/id_ed25519_hertz marfritrepo@hertz.fritz.box \
                  "publish-deb $suite $DEB"
          done
      - name: wipe secrets
        if: always()
        run: rm -f /root/.ssh/id_ed25519_hertz
  # -------------------------------------------------------------------------
  # daedalus-v4l2 Debian (aarch64) — CMake + Make build, dpkg-deb wrap.
  # Userspace daemon + test tools for the daedalus_v4l2 V4L2-stateless shim.
  # -------------------------------------------------------------------------
  daedalus-v4l2-debian:
    needs: claude-his-debian
    runs-on: arch-aarch64
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4
      - name: install build-deps (sans ffmpeg — see [marfrit] step)
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
          # Do NOT pull stock 'ffmpeg' here: the arch-aarch64 runner has
          # ffmpeg-v4l2-request-fourier pre-installed from the mpv-aarch64
          # job (configured via [marfrit]), and pacman -S ffmpeg would
          # conflict on the libav* drop-in.  Daedalus build only needs
          # libavcodec/libavformat headers, which the fourier package
          # already supplies.  Keep cmake/ninja/pkgconf/libdrm here; the
          # ffmpeg-dev equivalent comes via the next step.
          retry pacman -Syu --noconfirm --needed \
            dpkg openssh rsync curl base-devel git cmake ninja pkgconf \
            libdrm
      - name: ensure ffmpeg-v4l2-request-fourier installed (link-time ABI source)
        run: |
          set -e
          # Idempotent: pre-install the marfrit fourier ffmpeg so cmake
          # finds libavcodec / libavformat / libavutil headers + .so's.
          # Mirrors mpv-fourier-debian's [marfrit] step.
          curl -sLo /tmp/marfrit.gpg https://packages.reauktion.de/marfrit.gpg
          pacman-key --add /tmp/marfrit.gpg
          pacman-key --lsign-key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C
          rm -f /tmp/marfrit.gpg
          if ! grep -q '^\[marfrit\]' /etc/pacman.conf; then
            printf '\n[marfrit]\nServer = https://packages.reauktion.de/arch/$arch\nSigLevel = Required\n' >> /etc/pacman.conf
          fi
          pacman -Sy --noconfirm
          rm -f /var/cache/pacman/pkg/ffmpeg-v4l2-request-fourier-*-aarch64.pkg.tar.*
          printf 'y\ny\ny\n' | pacman -S --needed marfrit/ffmpeg-v4l2-request-fourier
      - name: install hertz deploy ssh key
        env:
          KEY: ${{ secrets.MARFRIT_REPO_HERTZ_KEY }}
        run: |
          mkdir -m700 -p /root/.ssh
          printf '%s\n' "$KEY" > /root/.ssh/id_ed25519_hertz
          chmod 600 /root/.ssh/id_ed25519_hertz
          ssh-keyscan -t ed25519 hertz.fritz.box >> /root/.ssh/known_hosts 2>/dev/null
      - name: build daedalus-v4l2 .deb
        run: |
          set -e
          cd debian/daedalus-v4l2
          ./build-deb.sh
          ls -la *.deb
      - name: upload + publish to suites
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
          cd debian/daedalus-v4l2
          DEB=$(ls daedalus-v4l2_*.deb | head -1)
          retry rsync -av -e 'ssh -i /root/.ssh/id_ed25519_hertz' "$DEB" \
              marfritrepo@hertz.fritz.box:
          for suite in bookworm trixie; do
              retry ssh -i /root/.ssh/id_ed25519_hertz marfritrepo@hertz.fritz.box \
                  "publish-deb $suite $DEB"
          done
      - name: wipe secrets
        if: always()
        run: rm -f /root/.ssh/id_ed25519_hertz
  # -------------------------------------------------------------------------
  # daedalus-v4l2-dkms Debian (Architecture: all) — packages the kernel
  # source tree + dkms.conf. No compilation; just file copy + dpkg-deb.
  # -------------------------------------------------------------------------
  daedalus-v4l2-dkms-debian:
    needs: daedalus-v4l2-debian
    runs-on: arch-aarch64
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4
      - name: install tooling
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
          retry pacman -Syu --noconfirm --needed dpkg openssh rsync curl tar gzip
      - name: install hertz deploy ssh key
        env:
          KEY: ${{ secrets.MARFRIT_REPO_HERTZ_KEY }}
        run: |
          mkdir -m700 -p /root/.ssh
          printf '%s\n' "$KEY" > /root/.ssh/id_ed25519_hertz
          chmod 600 /root/.ssh/id_ed25519_hertz
          ssh-keyscan -t ed25519 hertz.fritz.box >> /root/.ssh/known_hosts 2>/dev/null
      - name: build daedalus-v4l2-dkms .deb
        run: |
          set -e
          cd debian/daedalus-v4l2-dkms
          ./build-deb.sh
          ls -la *.deb
      - name: upload + publish to suites
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
          cd debian/daedalus-v4l2-dkms
          DEB=$(ls daedalus-v4l2-dkms_*.deb | head -1)
          retry rsync -av -e 'ssh -i /root/.ssh/id_ed25519_hertz' "$DEB" \
              marfritrepo@hertz.fritz.box:
          for suite in bookworm trixie; do
              retry ssh -i /root/.ssh/id_ed25519_hertz marfritrepo@hertz.fritz.box \
                  "publish-deb $suite $DEB"
          done
      - name: wipe secrets
        if: always()
        run: rm -f /root/.ssh/id_ed25519_hertz
  # -------------------------------------------------------------------------
  # mesa-panvk-bifrost (aarch64 only) — patched Mesa libvulkan_panfrost.so
  # for Bifrost-gen Mali (panvk-bifrost campaign iter9). Co-installs at
  # /usr/lib/panvk-bifrost/ so stock mesa stays intact; opt-in via the
  # brave-vulkan launcher this package also ships.
  #
  # Build is slow (~30-60min on actrunner-aarch64): full Mesa-from-source.
  # Standalone job — no `needs:` since it doesn't depend on the fourier
  # codec stack. continue-on-error so a build hiccup doesn't block other
  # jobs in the same workflow run.
  # -------------------------------------------------------------------------
  mesa-panvk-bifrost-aarch64:
    runs-on: arch-aarch64
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4
      - name: bootstrap runner (idempotent)
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
          retry pacman -Syu --noconfirm --needed base-devel git rsync gnupg openssh sudo
      - name: import signing key
        env:
          PRIV: ${{ secrets.MARFRIT_REPO_PRIVATE_KEY }}
          PASS: ${{ secrets.MARFRIT_REPO_PASSPHRASE }}
        run: |
          set -e
          gpgconf --homedir /root/.gnupg --kill all 2>/dev/null || true
          rm -rf /root/.gnupg /root/repo_pass
          mkdir -m700 -p /root/.gnupg
          printf '%s' "$PASS" > /root/repo_pass
          chmod 600 /root/repo_pass
          printf '%s\n' "$PRIV" | gpg --batch --import
          echo "92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C:6:" | gpg --import-ownertrust
      - name: install deploy ssh key
        env:
          KEY: ${{ secrets.MARFRIT_REPO_DEPLOY_KEY }}
        run: |
          mkdir -m700 -p /root/.ssh
          printf '%s\n' "$KEY" > /root/.ssh/id_ed25519
          chmod 600 /root/.ssh/id_ed25519
          ssh-keyscan -t ed25519 nc.reauktion.de > /root/.ssh/known_hosts 2>/dev/null
      - name: makepkg mesa-panvk-bifrost
        run: |
          set -e
          rm -rf /tmp/build-mesa-panvk-bifrost
          cp -r arch/mesa-panvk-bifrost /tmp/build-mesa-panvk-bifrost
          chown -R builder:builder /tmp/build-mesa-panvk-bifrost
          cd /tmp/build-mesa-panvk-bifrost
          # MAKEFLAGS for parallel build; runner is multi-core.
          # --skipinteg because sha256sums=SKIP in PKGBUILD (matches the
          # fourier-fork PKGBUILD convention).
          sudo -u builder -H env MAKEFLAGS="-j60" \
            makepkg --nocheck --noconfirm --syncdeps --cleanbuild --skipinteg
          ls -la *.pkg.tar.* | grep -v "\.sig$"
      - name: sign mesa-panvk-bifrost
        run: |
          set -e
          cd /tmp/build-mesa-panvk-bifrost
          for f in *.pkg.tar.xz *.pkg.tar.zst *.pkg.tar.gz; do
            [ -f "$f" ] || continue
            gpg --batch --pinentry-mode loopback --passphrase-file /root/repo_pass \
                --detach-sign --yes -u 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C "$f"
          done
      - name: update aarch64 repo db
        run: |
          set -e
          mkdir -p /tmp/arch-stage-mesa-panvk
          cd /tmp/arch-stage-mesa-panvk
          rm -f *
          for f in marfrit.db.tar.gz marfrit.db.tar.gz.sig marfrit.files.tar.gz marfrit.files.tar.gz.sig; do
            curl -sSLf "https://packages.reauktion.de/arch/aarch64/$f" -o "$f" || rm -f "$f"
          done
          for ext in xz zst gz; do
            ls /tmp/build-mesa-panvk-bifrost/*.pkg.tar.$ext 2>/dev/null && \
              mv /tmp/build-mesa-panvk-bifrost/*.pkg.tar.$ext /tmp/build-mesa-panvk-bifrost/*.pkg.tar.$ext.sig .
          done || true
          export GNUPGHOME=/root/.gnupg
          printf 'pinentry-mode loopback\npassphrase-file /root/repo_pass\n' > /root/.gnupg/gpg.conf
          printf 'allow-loopback-pinentry\n' > /root/.gnupg/gpg-agent.conf
          gpg-connect-agent reloadagent /bye
          pkgs=()
          for ext in xz zst gz; do
            for f in *.pkg.tar.$ext; do [ -f "$f" ] && pkgs+=("$f"); done
          done
          if [ -f marfrit.db.tar.gz ]; then
            for f in "${pkgs[@]}"; do
              name=$(echo "$f" | sed -E 's/-[0-9].*//')
              repo-remove --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \
                marfrit.db.tar.gz "$name" 2>/dev/null || true
            done
          fi
          repo-add --new --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \
            --verify marfrit.db.tar.gz "${pkgs[@]}"
          ln -sf marfrit.db.tar.gz        marfrit.db
          ln -sf marfrit.files.tar.gz     marfrit.files
          ln -sf marfrit.db.tar.gz.sig    marfrit.db.sig
          rm -f marfrit.files.sig
      - name: publish to aarch64
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
          cd /tmp/arch-stage-mesa-panvk
          retry rsync -avL --copy-unsafe-links \
            -e 'ssh -i /root/.ssh/id_ed25519' \
            ./ mfritsche@nc.reauktion.de:arch/aarch64/
      - name: wipe secrets
        if: always()
        run: rm -f /root/repo_pass /root/.ssh/id_ed25519
@@ -0,0 +1,71 @@
 # Maintainer: Markus Fritsche <fritsche.markus@gmail.com>
 #
 # daedalus-v4l2-dkms — DKMS package for the daedalus_v4l2 out-of-tree
 # kernel module (V4L2 stateless decoder shim for Pi 5 / CM5).
 #
 # Pair to daedalus-v4l2 (userspace daemon).  When loaded, the module
 # registers /dev/videoNN (V4L2 m2m) + /dev/mediaNN (media controller) +
 # /dev/daedalus-v4l2 (chardev to the userspace daemon).  Userspace
 # clients drive the V4L2 m2m + request API path; the daemon does the
 # actual FFmpeg-backed decode on /dev/daedalus-v4l2.
 #
 # Project: https://git.reauktion.de/reauktion/daedalus-v4l2
 # Sibling userspace package: daedalus-v4l2
 # Sibling consumer: libva-v4l2-request-fourier
 pkgname=daedalus-v4l2-dkms
 _module=daedalus_v4l2
 # Same pin as arch/daedalus-v4l2 — keep kernel module + daemon
 # bit-versioned together so the chardev wire protocol stays in sync.
 _commit=481279c9bffd19e32c8f3299897e9b63fc5a24aa
 pkgver=0.1.0.r18.481279c
 pkgrel=1  # reset for new upstream pin (481279c — Phase 8.13 close)
 pkgdesc="V4L2 stateless decoder shim kernel module (DKMS) — Pi 5 / CM5"
 arch=('any')
 url="https://git.reauktion.de/reauktion/daedalus-v4l2"
 license=('GPL-2.0-or-later')
 depends=('dkms')
 makedepends=('git')
 install="${pkgname}.install"
 source=("git+https://git.reauktion.de/reauktion/daedalus-v4l2.git#commit=${_commit}"
        "dkms.conf"
        "${pkgname}.install")
 sha256sums=('SKIP'
            'SKIP'
            'SKIP')
 pkgver() {
    cd "${srcdir}/daedalus-v4l2"
    printf '0.1.0.r%s.%s' \
        "$(git rev-list --count HEAD)" \
        "$(git rev-parse --short=7 HEAD)"
 }
 package() {
    local _src="${pkgdir}/usr/src/${_module}-${pkgver}"
    install -dm755 "${_src}"
    # Install the kernel/ subdir and embed the shared proto header in
    # the same tree.  The in-tree Makefile uses
    # `ccflags-y += -I$(src)/../include` (assuming the parent
    # daedalus-v4l2 layout); for DKMS we flatten by copying the header
    # into kernel/include/ and patching the Makefile to point there.
    cp -r "${srcdir}/daedalus-v4l2/kernel/." "${_src}/"
    install -Dm644 "${srcdir}/daedalus-v4l2/include/daedalus_v4l2_proto.h" \
        "${_src}/include/daedalus_v4l2_proto.h"
    sed -i 's|-I\$(src)/\.\./include|-I$(src)/include|' "${_src}/Makefile"
    # dkms.conf at the root of the source tree (DKMS convention).
    # Substitute #MODULE_VERSION# placeholder with the actual pkgver
    # so dkms install/uninstall match what's on disk.
    install -Dm644 "${srcdir}/dkms.conf" "${_src}/dkms.conf"
    sed -i "s/#MODULE_VERSION#/${pkgver}/" "${_src}/dkms.conf"
    # License
    install -Dm644 "${srcdir}/daedalus-v4l2/kernel/daedalus_v4l2_main.c" \
        "${pkgdir}/usr/share/licenses/${pkgname}/SPDX-HEADER"
 }
@@ -0,0 +1,61 @@
 # post-install / post-upgrade hook for daedalus-v4l2-dkms.
 #
 # pacman + the dkms-helpers alpm hook will already attempt
 # `dkms install` on its own.  This script's job is to emit a
 # loud, actionable warning when the module didn't actually
 # build for the running kernel — most commonly because the
 # kernel headers package isn't installed yet.
 #
 # Without this you get a silent failure: the package looks
 # installed but `modprobe daedalus_v4l2` returns ENOENT.
 _check_dkms_built() {
    local name=daedalus_v4l2
    local ver=$1
    local kernelver=$(uname -r)
    if ! command -v dkms >/dev/null 2>&1; then
        return 1  # the hard-dep should have caught this
    fi
    local status
    status=$(dkms status -m "$name" -v "$ver" -k "$kernelver" 2>/dev/null || true)
    if printf '%s\n' "$status" | grep -q -E 'installed|loaded'; then
        return 0  # all good
    fi
    cat >&2 <<EOF
 ==> daedalus-v4l2-dkms: DKMS build did NOT land for kernel $kernelver.
 ==>   dkms status -m $name -v $ver -k $kernelver:
 ==>     $(printf '%s' "$status" | head -1)
 ==>
 ==> Most likely cause: kernel headers package is missing.
 ==>   Arch / ALARM:     pacman -S linux-rpi-headers (or linux-rpi5-headers)
 ==>   Raspberry Pi OS:  apt install linux-headers-rpi-2712
 ==>
 ==> After installing headers, finish the install with:
 ==>   sudo dkms autoinstall $name/$ver
 ==>   sudo modprobe daedalus_v4l2
 ==>
 ==> Until then daedalus_v4l2 will NOT be loadable and the
 ==> userspace daedalus-v4l2 daemon will have nothing to talk to.
 EOF
    return 1
 }
 post_install() {
    _check_dkms_built "$1" || true
 }
 post_upgrade() {
    # New version pinned by the bump may have built fine, but if
    # a kernel-headers package was uninstalled / pruned since the
    # last upgrade we'd silently regress.  Re-check.
    _check_dkms_built "$1" || true
 }
 pre_remove() {
    # The dkms alpm hook handles dkms remove on its own; nothing
    # we need to add here.
    :
 }
@@ -0,0 +1,19 @@
 # DKMS configuration for daedalus_v4l2 — V4L2 stateless decoder shim.
 #
 # Built against /lib/modules/$kernelver/build with the in-tree Makefile.
 # The Makefile uses `obj-m := daedalus_v4l2.o` and links
 # daedalus_v4l2_main.o + daedalus_v4l2_chardev.o into the final .ko.
 PACKAGE_NAME="daedalus_v4l2"
 PACKAGE_VERSION="#MODULE_VERSION#"
 # Single module produced by the Makefile.
 BUILT_MODULE_NAME[0]="daedalus_v4l2"
 DEST_MODULE_LOCATION[0]="/updates"
 # Use the package's own Makefile — it already does
 # `$(MAKE) -C $(KERNELDIR) M=$(PWD) modules`.
 MAKE[0]="make KERNELDIR=/lib/modules/${kernelver}/build all"
 CLEAN="make KERNELDIR=/lib/modules/${kernelver}/build clean"
 AUTOINSTALL="yes"
@@ -0,0 +1,116 @@
 # Maintainer: Markus Fritsche <fritsche.markus@gmail.com>
 #
 # daedalus-v4l2 — userspace daemon + V4L2 m2m test tools.
 #
 # Pair to daedalus-v4l2-dkms (kernel module).  Together they expose
 # /dev/videoNN + /dev/mediaNN as a V4L2 stateless decoder shim on Pi 5 /
 # CM5, decoding VP9 / AV1 / H.264 via dlopen'd FFmpeg in a single-
 # threaded daemon and shipping decoded NV12 / P010 back through dmabuf.
 # Consumed end-to-end by libva-v4l2-request-fourier (>= 1.0.0.r376) so
 # `ffmpeg -hwaccel vaapi` against vp9_small.ivf produces byte-exact NV12.
 #
 # Project: https://git.reauktion.de/reauktion/daedalus-v4l2
 # Sibling kernel package: daedalus-v4l2-dkms
 # Sibling consumer: libva-v4l2-request-fourier
 pkgname=daedalus-v4l2
 _upstreampkg=daedalus-v4l2
 # Pin the daedalus-v4l2 tip.  481279c = "Phase 8.13: byte-exact end-to-
 # end via libva (consumer target hit)" — first commit where the full
 # ffmpeg -hwaccel vaapi → libva → /dev/video0 → daemon path lands a
 # pixel-correct decoded frame back in ffmpeg.  Promote to a later pin
 # only after a future phase closes cleanly.
 _commit=481279c9bffd19e32c8f3299897e9b63fc5a24aa
 # 0.1.0 (pre-1.0) + commit count + short sha.  Bump the .Y on each
 # Phase 8.x close.  pkgver() recomputes at build time.
 pkgver=0.1.0.r18.481279c
 pkgrel=1  # reset for new upstream pin (481279c — Phase 8.13 close)
 pkgdesc="Userspace daemon for the daedalus-v4l2 V4L2 stateless decoder shim (VP9/AV1/H.264 on Pi 5 / CM5)"
 arch=('aarch64')
 url="https://git.reauktion.de/reauktion/daedalus-v4l2"
 license=('BSD-2-Clause' 'GPL-2.0-or-later')
 # Daemon dlopens libavformat.so.61 / libavcodec.so.61 / libavutil.so.59
 # at runtime (Option γ — see daemon/src/ffmpeg_loader.h).  ffmpeg
 # provides those; we don't link them.
 depends=('ffmpeg' 'libdrm')
 # Headers from libav*-dev needed at compile time for type-safe function
 # pointer signatures; pkg-config locates them.
 makedepends=('cmake' 'ninja' 'pkgconf' 'git' 'ffmpeg')
 optdepends=('daedalus-v4l2-dkms: kernel module providing /dev/video0 + /dev/daedalus-v4l2'
            'libva-v4l2-request-fourier: VA-API consumer routing through this daemon')
 install="${pkgname}.install"
 source=("git+https://git.reauktion.de/reauktion/daedalus-v4l2.git#commit=${_commit}"
        "${pkgname}.install")
 sha256sums=('SKIP'
            'SKIP')
 pkgver() {
    cd "${srcdir}/${_upstreampkg}"
    printf '0.1.0.r%s.%s' \
        "$(git rev-list --count HEAD)" \
        "$(git rev-parse --short=7 HEAD)"
 }
 build() {
    cd "${srcdir}/${_upstreampkg}/daemon"
    cmake -B build -G Ninja \
        -DCMAKE_BUILD_TYPE=Release \
        -DCMAKE_INSTALL_PREFIX=/usr
    cmake --build build
    cd "${srcdir}/${_upstreampkg}/tools"
    make
 }
 package() {
    cd "${srcdir}/${_upstreampkg}"
    # Daemon binary
    install -Dm755 daemon/build/daedalus_v4l2_daemon \
        "${pkgdir}/usr/bin/daedalus_v4l2_daemon"
    # Test tools (under /usr/libexec to keep them out of the default PATH
    # — they're for verification, not daily use).
    install -Dm755 tools/test_chardev_pingpong \
        "${pkgdir}/usr/libexec/daedalus-v4l2/test_chardev_pingpong"
    install -Dm755 tools/test_m2m_decode \
        "${pkgdir}/usr/libexec/daedalus-v4l2/test_m2m_decode"
    install -Dm755 tools/test_m2m_stream \
        "${pkgdir}/usr/libexec/daedalus-v4l2/test_m2m_stream"
    # Shared wire-protocol header (kernel ↔ daemon); useful for
    # third-party clients of the chardev.
    install -Dm644 include/daedalus_v4l2_proto.h \
        "${pkgdir}/usr/include/daedalus_v4l2_proto.h"
    # systemd unit + module autoload — without these the daemon never
    # starts and the libva/VAAPI consumer's REQ_DECODE has nobody on
    # the other end of /dev/daedalus-v4l2.
    install -Dm644 packaging/systemd/daedalus-v4l2.service \
        "${pkgdir}/usr/lib/systemd/system/daedalus-v4l2.service"
    install -Dm644 packaging/systemd/daedalus-v4l2.modules-load \
        "${pkgdir}/usr/lib/modules-load.d/daedalus-v4l2.conf"
    # Documentation
    install -Dm644 README.md \
        "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    for d in docs/*.md; do
        install -Dm644 "$d" "${pkgdir}/usr/share/doc/${pkgname}/$(basename "$d")"
    done
    # Licenses: BSD-2-Clause for daemon/tools, GPL for the kernel proto
    # header; the SPDX headers in src/ are the canonical declaration but
    # ship a short note here for package-manager-driven license queries.
    install -dm755 "${pkgdir}/usr/share/licenses/${pkgname}"
    cat > "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE" <<'EOF'
 daedalus-v4l2 userspace components are BSD-2-Clause licensed.
 The shared kernel↔daemon wire protocol header
 (/usr/include/daedalus_v4l2_proto.h) is GPL-2.0-or-later WITH
 Linux-syscall-note for kernel-side compatibility.  See SPDX
 headers on individual source files for the canonical
 per-file declaration.
 EOF
 }
@@ -0,0 +1,42 @@
 # post_install / post_upgrade for daedalus-v4l2.
 #
 # Enables (but doesn't start — leave that to the operator) the
 # daemon service so it comes up on next boot.  Reloads systemd
 # so the new unit file is visible.  Triggers modules-load so the
 # kernel module loads without a reboot if daedalus-v4l2-dkms is
 # also installed.
 _activate() {
    systemctl daemon-reload >/dev/null 2>&1 || true
    systemctl enable daedalus-v4l2.service >/dev/null 2>&1 || true
    # Trigger /usr/lib/modules-load.d/daedalus-v4l2.conf without a
    # reboot.  Safe if the module is already loaded.
    systemd-modules-load >/dev/null 2>&1 || true
    cat >&2 <<EOF
 ==> daedalus-v4l2: service enabled, will start on next boot.
 ==> To start now (requires the kernel module to be loaded):
 ==>   sudo systemctl start daedalus-v4l2.service
 ==> Verify decode path:
 ==>   journalctl -u daedalus-v4l2.service -f
 EOF
 }
 post_install() {
    _activate
 }
 post_upgrade() {
    _activate
    systemctl try-restart daedalus-v4l2.service >/dev/null 2>&1 || true
 }
 pre_remove() {
    systemctl stop daedalus-v4l2.service    >/dev/null 2>&1 || true
    systemctl disable daedalus-v4l2.service >/dev/null 2>&1 || true
 }
 post_remove() {
    systemctl daemon-reload >/dev/null 2>&1 || true
 }
@@ -13,7 +13,7 @@
 pkgname=firefox-fourier
 pkgver=150.0.1
-pkgrel=5
+pkgrel=7
 pkgdesc='Firefox with V4L2 stateless HW video decode unlocked for mainline Linux Rockchip'
 arch=('aarch64' 'x86_64')
 url='https://www.mozilla.org/firefox'
@@ -91,8 +91,11 @@ source=(
  # Vendor-default prefs that gate the patched VAAPI path on RK3399 —
  # widget.dmabuf.force-enabled etc. See marfrit-packages#8 for evidence.
  'rockchip-fourier-defaults.js'
  # Plasma/GNOME start-menu entry — categorises under Internet, picks the
  # 128px firefox icon shipped under /usr/lib/firefox-fourier/browser/.
  'firefox-fourier.desktop'
 )
-sha256sums=('SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP')
+sha256sums=('SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP')
 prepare() {
  cd "${srcdir}/firefox-${pkgver}"
@@ -180,4 +183,11 @@ LAUNCHER
  # VAAPI_VLD` + dmabuf surfaces locking end-to-end.
  install -Dm644 "${srcdir}/rockchip-fourier-defaults.js" \
    "${pkgdir}/usr/lib/firefox-fourier/defaults/preferences/rockchip-fourier-defaults.js"
  # Desktop entry — fileless install would leave the package without a
  # start-menu entry (stock firefox.desktop disappears when our `provides`
  # replaces stock firefox). Plasma & GNOME pick this up via the
  # `Categories=Network;WebBrowser;` line → "Internet" submenu.
  install -Dm644 "${srcdir}/firefox-fourier.desktop" \
    "${pkgdir}/usr/share/applications/firefox-fourier.desktop"
 }
@@ -0,0 +1,22 @@
 [Desktop Entry]
 Version=1.0
 Type=Application
 Name=Firefox (Fourier — V4L2 HW decode)
 GenericName=Web Browser
 Comment=Browse the Web with V4L2 stateless HW video decode (RK3588/RK3566)
 Exec=/usr/bin/firefox-fourier %u
 Icon=/usr/lib/firefox-fourier/browser/chrome/icons/default/default128.png
 Terminal=false
 StartupNotify=true
 StartupWMClass=firefox-fourier
 Categories=Network;WebBrowser;
 MimeType=text/html;text/xml;application/xhtml+xml;application/vnd.mozilla.xul+xml;application/rss+xml;application/rdf+xml;image/gif;image/jpeg;image/png;image/svg+xml;image/webp;image/avif;application/json;application/pdf;audio/flac;audio/ogg;audio/webm;video/ogg;video/webm;x-scheme-handler/http;x-scheme-handler/https;x-scheme-handler/chrome;x-scheme-handler/mailto;
 Actions=new-window;new-private-window;
 [Desktop Action new-window]
 Name=Open a New Window
 Exec=/usr/bin/firefox-fourier --new-window %u
 [Desktop Action new-private-window]
 Name=Open a New Private Window
 Exec=/usr/bin/firefox-fourier --private-window %u
@@ -34,3 +34,20 @@ ac_add_options --with-distribution-id=de.reauktion.fourier
 # Reduce build memory pressure on aarch64 — parallel link is heavy.
 mk_add_options MOZ_PARALLEL_BUILD=8
 # Explicit distcc routing. fermi's makepkg.conf has
 # BUILDENV=(distcc ...) which auto-prepends /usr/lib/distcc/bin to
 # $PATH, but mach's configure picks up CC/CXX from the env directly
 # and the distcc wrappers won't fire unless we set them. Mirrors the
 # ffmpeg-v4l2-request-fourier pattern.
 #
 # Note: only the C/C++ portion of the build distributes; rustc and
 # the host-only build steps stay local. Empirically that's still a
 # 30-40% wall-clock win on a 4-worker pool. DISTCC_HOSTS comes from
 # makepkg.conf ('+zeroconf' by default — Avahi-discovers tesla,
 # dcc1, dcc2, ampere).
 if [[ ":${PATH}:" == *":/usr/lib/distcc/bin:"* ]]; then
    export CC="distcc gcc"
    export CXX="distcc g++"
 fi
@@ -23,20 +23,26 @@
 pkgname=libva-v4l2-request-fourier
 _upstreampkg=libva-v4l2-request
-# Pin the fork tip. 7ac934e = "iter38b: bounds check uses MAX_PROFILES
+# Pin the fork tip. de27e95 = "v4l2: log error_idx + failing ctrl id
-# (11), not MAX_CONFIG_ATTRIBUTES (10)" — fresnel-fourier campaign
+# on S_EXT_CTRLS failure" — Phase 8.13 diagnostic that surfaced the
-# production tip 2026-05-14, sibling iter38 added multi-device probe so
+# real root cause of the libva→daedalus_v4l2 request-completion
-# a single libva session serves rkvdec + hantro without requiring
+# timeout (turned out the EINVAL libva was logging was a harmless
-# LIBVA_V4L2_REQUEST_VIDEO_PATH overrides. Promote to a later pin only
+# H264/HEVC probe; actual VP9 stateless control SET worked all along).
-# after a future iteration closes cleanly.
+#
-_commit=7ac934e0c5420814c7a5fc3e2a2f08251d590d9e
+# Prior pin (7ac934e) was iter38b — fresnel-fourier multi-device probe
 # + MAX_PROFILES bounds-check fix. de27e95 adds the daedalus_v4l2
 # probe slot (b5b3acf), the meson option gate (2146341), and the
 # S_EXT_CTRLS diagnostic (de27e95 itself). Backward-compatible on
 # rkvdec / hantro / cedrus / rpi-hevc-dec hosts — daedalus probe is
 # off by default unless the kernel module is present.
 _commit=de27e95571b67ef34619c23a12db4698f9b3454e
 # Project version from meson.build (1.0.0) + commit count + short sha,
 # matching the ffmpeg-v4l2-request-fourier convention. Recomputed at
 # build time by pkgver() below; the static value here is a placeholder
 # so AUR-style consumers see something coherent before src/ exists.
-pkgver=1.0.0.r348.7ac934e
+pkgver=1.0.0.r376.de27e95
-pkgrel=2
+pkgrel=1
 pkgdesc="VA-API backend for V4L2 stateless decoders (multiplanar fork — fourier umbrella)"
 arch=('aarch64')
 url="https://git.reauktion.de/marfrit/libva-v4l2-request-fourier"
@@ -0,0 +1,19 @@
 # makepkg outputs and intermediate state
 src/
 pkg/
 *.pkg.tar.zst
 *.pkg.tar.zst.sig
 *-build.log*
 *-prepare.log
 *-package_*.log
 *.tar.xz
 *.tar.sign
 *.patch.zst
 *.patch.zst.sig
 logpipe.*
 # build-time artifacts that must never be committed
 src/
 *.tar.xz
 *.tar.zst
 pkg/
@@ -0,0 +1,247 @@
 # Maintainer: Markus Fritsche <fritsche.markus@gmail.com>
 # Forked from: linux-pinetab2 by Danct12 <danct12@disroot.org>
 # Original Contributor: Jan Alexander Steffens (heftig) <heftig@archlinux.org>
 #
 # linux-pinetab2-danctnix-besser: linux-pinetab2 + the BESser bes2600
 # driver patchset.  Soft-upstream fork of linux-pinetab2 — drop-in
 # replacement, same kernel version, only the bes2600 staging driver
 # differs.  See git.reauktion.de/marfrit/besser and
 # git.reauktion.de/marfrit/bes2600-dkms for full provenance.
 #
 # ─────────────────────────────────────────────────────────────────────
 # kernel-agent flow (effective pkgrel=4):
 #
 # The single 0001-bes2600-besser-kernel-agent-cumulative.patch is
 # regenerated by `ka-promote ohm` in
 # git.reauktion.de/marfrit/kernel-agent against fleet/ohm.yaml.  Its
 # b2sum below MUST match the cumulative.b2sum recorded in the
 # co-located manifest.lock.  Sibling manifest.lock pins the source-of-
 # truth manifest sha256 and per-include patch sha256s.
 #
 # To update for a new patch in the manifest:
 #   1. Edit kernel-agent:fleet/ohm.yaml (add/remove includes)
 #   2. `ka-promote ohm` → writes new cumulative.patch + manifest.lock
 #      to kernel-agent/build/ohm/v7.0-danctnix1/
 #   3. Copy both files into this directory (replacing existing ones)
 #   4. Update the b2sum in this PKGBUILD for the cumulative
 #   5. Bump pkgrel
 # ─────────────────────────────────────────────────────────────────────
 pkgbase=linux-pinetab2-danctnix-besser
 pkgver=7.0.danctnix1
 pkgrel=6
 pkgdesc='PineTab2 (BESser bes2600 driver patchset, kernel-agent managed)'
 _srcname=linux-pinetab2
 _srctag=v${pkgver%.*}-${pkgver##*.}
 arch=(aarch64)
 _url_git="https://codeberg.org/DanctNIX/${_srcname}"
 url="${_url_git}/commits/tag/$_srctag"
 license=(GPL-2.0-only)
 makedepends=(
  bc
  cpio
  gettext
  git
  libelf
  pahole
  perl
  python
  tar
  xz
 )
 options=(
  !debug
  !strip
 )
 source=(
  https://cdn.kernel.org/pub/linux/kernel/v${pkgver%%.*}.x/linux-${pkgver%.*}.tar.{xz,sign}
  ${_url_git}/releases/download/${_srctag}/${_srctag}.patch.zst{,.sig}
  0001-bes2600-besser-kernel-agent-cumulative.patch
  config
 )
 validpgpkeys=(
  ABAF11C65A2970B130ABE3C479BE3E4300411886  # Linus Torvalds
  647F28654894E3BD457199BE38DBBDC86092693E  # Greg Kroah-Hartman
  F09A933C0FE0331E558CA4E166CAB7EAA45DD781  # Danct12
 )
 b2sums=('3d9795083c8938f80f480de0d10bfd9c525640e59d5c7f22983de3f12ee42c84c31be902cafb05579ddb1c32bac5ed06b0d4953f9705450be185bd2d9ab08f89'
        'SKIP'
        '71fe98221e802b315e54b4b10d3e8c8f376695a36bae3541d876e5776a37f3fa33c8f8dfa6e51fcbd6f5396add02e5166634165f2351836a0ea0453c172fe56c'
        'SKIP'
        'eb179c03f35a4dbaec2e40036f0033ef04985bb6b14ab22419d68e5caaa5874f2ad14e158f7c5b05added97f60fecde8fb8b7f2a6ced33e031e37352fe776ca6'
        '656a998ab40cb85ee4c00f087b071a91632a6c091da2c84b0f74236b51d2dea6e9db6886625f80ad81dc249d8494ec47cd79d6dd9ea4f5e44f3cde857f861e10')
 export KBUILD_BUILD_HOST=archlinux
 export KBUILD_BUILD_USER=$pkgbase
 export KBUILD_BUILD_TIMESTAMP="$(date -Ru${SOURCE_DATE_EPOCH:+d @$SOURCE_DATE_EPOCH})"
 prepare() {
  cd linux-${pkgver%.*}
  echo "Setting version..."
  echo "-$pkgrel" > localversion.10-pkgrel
  echo "${pkgbase#linux}" > localversion.20-pkgname
  local src
  for src in "${source[@]}"; do
      src="${src%%::*}"
      src="${src##*/}"
      src="${src%.zst}"
      [[ $src = *.patch ]] || continue
      echo "Applying patch: $src..."
      patch -Np1 < "../$src"
  done
  echo "Setting config..."
  cp ../config .config
  make olddefconfig
  diff -u ../config .config || :
  make -s kernelrelease > version
  echo "Prepared $pkgbase version $(<version)"
 }
 build() {
  cd linux-${pkgver%.*}
  make DTC_FLAGS="-@" all
  make -C tools/bpf/bpftool vmlinux.h feature-clang-bpf-co-re=1
 }
 _package() {
  pkgdesc="The $pkgdesc kernel and modules"
  depends=(
    coreutils
    kmod
    mkinitcpio
  )
  optdepends=(
    'wireless-regdb: to set the correct wireless channels of your country'
    'linux-firmware: firmware images needed for some devices'
  )
  provides=(
    KSMBD-MODULE
    WIREGUARD-MODULE
    "linux-pinetab2=$pkgver-$pkgrel"
  )
  conflicts=(linux-pinetab2)
  replaces=(
    wireguard-arch
  )
  cd linux-${pkgver%.*}
  local modulesdir="$pkgdir/usr/lib/modules/$(<version)"
  echo "Installing boot image..."
  # systemd expects to find the kernel here to allow hibernation
  # https://github.com/systemd/systemd/commit/edda44605f06a41fb86b7ab8128dcf99161d2344
  install -Dm644 "$(make -s image_name)" "$modulesdir/vmlinuz"
  # Used by mkinitcpio to name the kernel
  echo "$pkgbase" | install -Dm644 /dev/stdin "$modulesdir/pkgbase"
  echo "Installing modules..."
  ZSTD_CLEVEL=19 make INSTALL_MOD_PATH="$pkgdir/usr" INSTALL_MOD_STRIP=1 \
    DEPMOD=/doesnt/exist modules_install  # Suppress depmod
  echo "Installing device trees..."
  make INSTALL_DTBS_PATH="$pkgdir/boot/dtbs" dtbs_install
  # Removing unnecessary device trees (keep only pinetab2 variants).
  # find -delete is robust to nullglob/cwd quirks where a bash for-loop
  # silently no-op'd in the makepkg environment.
  find "$pkgdir"/boot/dtbs/rockchip/ -mindepth 1 -maxdepth 1 -type f \
       ! -name 'rk3566-pinetab2-*' -delete
  # remove build link
  rm "$modulesdir"/build
 }
 _package-headers() {
  pkgdesc="Headers and scripts for building modules for the $pkgdesc kernel"
  depends=(pahole)
  cd linux-${pkgver%.*}
  local builddir="$pkgdir/usr/lib/modules/$(<version)/build"
  echo "Installing build files..."
  install -Dt "$builddir" -m644 .config Makefile Module.symvers System.map \
    localversion.* version vmlinux tools/bpf/bpftool/vmlinux.h
  install -Dt "$builddir/kernel" -m644 kernel/Makefile
  install -Dt "$builddir/arch/arm64" -m644 arch/arm64/Makefile
  cp -t "$builddir" -a scripts
  # required when DEBUG_INFO_BTF_MODULES is enabled
  install -Dt "$builddir/tools/bpf/resolve_btfids" tools/bpf/resolve_btfids/resolve_btfids
  echo "Installing headers..."
  cp -t "$builddir" -a include
  cp -t "$builddir/arch/arm64" -a arch/arm64/include
  install -Dt "$builddir/arch/arm64/kernel" -m644 arch/arm64/kernel/asm-offsets.s
  install -Dt "$builddir/drivers/md" -m644 drivers/md/*.h
  install -Dt "$builddir/net/mac80211" -m644 net/mac80211/*.h
  # https://bugs.archlinux.org/task/13146
  install -Dt "$builddir/drivers/media/i2c" -m644 drivers/media/i2c/msp3400-driver.h
  # https://bugs.archlinux.org/task/20402
  install -Dt "$builddir/drivers/media/usb/dvb-usb" -m644 drivers/media/usb/dvb-usb/*.h
  install -Dt "$builddir/drivers/media/dvb-frontends" -m644 drivers/media/dvb-frontends/*.h
  install -Dt "$builddir/drivers/media/tuners" -m644 drivers/media/tuners/*.h
  # https://bugs.archlinux.org/task/71392
  install -Dt "$builddir/drivers/iio/common/hid-sensors" -m644 drivers/iio/common/hid-sensors/*.h
  echo "Installing KConfig files..."
  find . -name 'Kconfig*' -exec install -Dm644 {} "$builddir/{}" \;
  echo "Removing unneeded architectures..."
  local arch
  for arch in "$builddir"/arch/*/; do
    [[ $arch = */arm64/ ]] && continue
    echo "Removing $(basename "$arch")"
    rm -r "$arch"
  done
  echo "Removing documentation..."
  rm -r "$builddir/Documentation"
  echo "Removing broken symlinks..."
  find -L "$builddir" -type l -printf 'Removing %P\n' -delete
  echo "Removing loose objects..."
  find "$builddir" -type f -name '*.o' -printf 'Removing %P\n' -delete
  echo "Stripping build tools..."
  local file
  while read -rd '' file; do
    case "$(file -Sib "$file")" in
      application/x-sharedlib\;*)      # Libraries (.so)
        strip -v $STRIP_SHARED "$file" ;;
      application/x-archive\;*)        # Libraries (.a)
        strip -v $STRIP_STATIC "$file" ;;
      application/x-executable\;*)     # Binaries
        strip -v $STRIP_BINARIES "$file" ;;
      application/x-pie-executable\;*) # Relocatable binaries
        strip -v $STRIP_SHARED "$file" ;;
    esac
  done < <(find "$builddir" -type f -perm -u+x ! -name vmlinux -print0)
  echo "Stripping vmlinux..."
  strip -v $STRIP_STATIC "$builddir/vmlinux"
  echo "Adding symlink..."
  mkdir -p "$pkgdir/usr/src"
  ln -sr "$builddir" "$pkgdir/usr/src/$pkgbase"
 }
 pkgname=(
  "$pkgbase"
  "$pkgbase-headers"
 )
 for _p in "${pkgname[@]}"; do
  eval "package_$_p() {
    $(declare -f "_package${_p#$pkgbase}")
    _package${_p#$pkgbase}
  }"
 done
@@ -0,0 +1,52 @@
 # linux-pinetab2-danctnix-besser
 DanctNIX PineTab2 kernel + the BESser bes2600 driver patchset.
 **kernel-agent managed** as of pkgrel=4 (2026-05-18).
 ## TL;DR
 - **What**: drop-in replacement for `linux-pinetab2` with the BESser
  bes2600 patchset applied.
 - **For**: PineTab2 (RK3566) with the on-board BES2600 SDIO WiFi/BT chip.
 - **Install**: `pacman -U linux-pinetab2-danctnix-besser-*.pkg.tar.zst
  linux-pinetab2-danctnix-besser-headers-*.pkg.tar.zst`. It `provides`
  and `conflicts` with `linux-pinetab2`, so it slots in cleanly.
 - **Source of truth for patches**:
  [git.reauktion.de/marfrit/kernel-agent](https://git.reauktion.de/marfrit/kernel-agent)
  `fleet/ohm.yaml`.
 ## How the patch cumulative is built
 1. `kernel-agent/fleet/ohm.yaml` lists the patch series-dir includes
   for this kernel.
 2. `kernel-agent/bin/ka-promote ohm` walks those includes, concatenates
   them into a single `cumulative.patch`, and emits a `manifest.lock`
   recording per-patch sha256s and the cumulative b2sum.
 3. The cumulative is dropped into this directory as
   `0001-bes2600-besser-kernel-agent-cumulative.patch`, the b2sum in
   `PKGBUILD` is updated to match, and `pkgrel` is bumped.
 4. `manifest.lock` is committed alongside the cumulative for an
   audit trail (which patches went in, in what order).
 ## pkgrel history
 | pkgrel | Date       | Notes                                           |
 |--------|------------|-------------------------------------------------|
 | 1–3    | 2026-05-08…05-18 | hand-managed in `marfrit/besser/danctnix-besser-pkgbuild/` (DEPRECATED) |
 | 4      | 2026-05-18 | first kernel-agent-managed release; same source contents as the hand-managed pkgrel=3 (Patch I + SCS workaround folded into single cumulative); fixes pkgrel=3's duplicated `0003-arm64-...patch` source-array bug |
 ## Known caveats
 - **`CONFIG_SHADOW_CALL_STACK=n`** in the config: GCC 15.2.1 fails to
  build `arch/arm64/lib/xor-neon.c` with `arm_neon.h` `#pragma GCC
  target()` blocks and `-fsanitize=shadow-call-stack`. See
  `reference_arm64_scs_arm_neon_gcc15` memory and the Makefile
  workaround patch included in the cumulative. Track upstream GCC
  resolution before re-enabling.
 - The `cumulative-c5x-danctnix` series-dir in kernel-agent is currently
  a single-file interim (the working hand-curated cumulative) because
  the per-series mirrors created in `kernel-agent#17` use DKMS-style
  root paths instead of in-tree staging paths and do not apply
  cleanly. Per-series reconstruction is a separate kernel-agent
  follow-up. The b2sum integrity check in `PKGBUILD` still pins the
  exact bytes shipped.
@@ -0,0 +1,177 @@
 baseline:
  ref: v7.0-danctnix1
  tree: DanctNIX/linux-pinetab2
  upstream_compat: linux-7.0
  url: https://codeberg.org/DanctNIX/linux-pinetab2
 cumulative:
  b2sum: eb179c03f35a4dbaec2e40036f0033ef04985bb6b14ab22419d68e5caaa5874f2ad14e158f7c5b05added97f60fecde8fb8b7f2a6ced33e031e37352fe776ca6
  path: cumulative.patch
  size: 279554
 generated_at: '2026-05-19T13:05:46.476359+00:00'
 host: ohm
 ka_promote_version: 1
 manifest:
  path: fleet/ohm.yaml
  sha256: 9ac04ddd3170418b7b2d2cf7b31ac225a31ed19be4f03e8477bf28b585bae257
 resolved_patches:
 - apply_order: 1
  from_series: true
  include: driver/bes2600/factory-series/0001-bes2600-use-request_firmware-for-factory.txt-read.patch
  sha256: a1bc2d13b258709fa37c9ff428dfdc0659464b436470fa2ec69b07edf7592f6f
  size: 5456
 - apply_order: 2
  from_series: true
  include: driver/bes2600/factory-series/0002-bes2600-default-STANDARD_FACTORY_EFUSE_FLAG-off-for-PineTab2.patch
  sha256: 577d7024ce0b342c4381365872fc29e75a93427ad61223907fead8b829b5a86c
  size: 3499
 - apply_order: 3
  from_series: true
  include: driver/bes2600/factory-thread-dev/0001-bes2600-thread-struct-device-through-factory-request_firmware.patch
  sha256: e3fac725e6addc11147341836600c2c5cd0116abba960f34ba50bb8094581c75
  size: 4406
 - apply_order: 4
  from_series: true
  include: driver/bes2600/pm-gate-on-handshake/0001-bes2600-gate-device-LP-mode-entry-on-successful-handshake.patch
  sha256: 9842c0dd66f59fe28898041ba5a816be56965b0665f202410cd461c3e6565474
  size: 3914
 - apply_order: 5
  from_series: true
  include: driver/bes2600/remove-chardev-user-interface/0001-bes2600-remove-userspace-dev-bes2600-character-device-interface.patch
  sha256: c67d340ae5923aada613ea9c5133e3efa3aeb7986749f4bf3619d1752a1b61fb
  size: 22445
 - apply_order: 6
  from_series: true
  include: driver/bes2600/enable-testmode/0001-bes2600-enable-CONFIG_BES2600_TESTMODE-by-default-fix-bitrot.patch
  sha256: 5dee74e8753d332fd380882994ea43aa907d1ff97466b0c48aedf38d4076e446
  size: 6152
 - apply_order: 7
  from_series: true
  include: driver/bes2600/tx-sdio-dma-oob-danctnix/0001-bes2600-bounce-SDIO-TX-buffers-to-avoid-DMA-OOB-read.patch
  sha256: 0dce2fe35450b8376c2d2a7c007119f28c888c1c30b489a67841039caedeebfc
  size: 4544
 - apply_order: 8
  from_series: true
  include: driver/bes2600/factory-drop-kernel-write-danctnix/0001-bes2600-drop-kernel_write-persistence-from-factory-cali-save.patch
  sha256: a7995b38e210af16b73d284a58ab39b8aecac36ff4a671af3d894b1983f961b3
  size: 5704
 - apply_order: 9
  from_series: true
  include: driver/bes2600/drop-dpd-file-paths-danctnix/0001-bes2600-drop-BES2600_WRITE_DPD_TO_FILE-kernel-file-paths.patch
  sha256: 0cd8780c245c97c65e4845e42d712c6256a0449658641aea18e4c7d400f63e41
  size: 9661
 - apply_order: 10
  from_series: true
  include: driver/bes2600/drop-orphan-file-io-danctnix/0001-bes2600-drop-orphan-DATA_DUMP_OBSERVE-and-access_file-IO.patch
  sha256: fd8c297223e6a985c2898f919ae1ab27eb56ab44f09f44d84d75eb35a187527b
  size: 5327
 - apply_order: 11
  from_series: true
  include: driver/bes2600/pm-timeout-silence-danctnix/0001-bes2600-demote-wait-pm-ind-timeout-from-bes_err-to-bes_devel.patch
  sha256: 3a4fd3255facbcef0419e0e0332cb980316529aa5c225b35bcfd244a42736667
  size: 2332
 - apply_order: 12
  from_series: true
  include: driver/bes2600/scan-defer-on-reject-danctnix/0001-bes2600-defer-scan-and-soften-WARN-on-firmware-reject.patch
  sha256: 55e16c176bc147c371a20f57b3a57da38c719d3b42417e88f9de243e10102d35
  size: 8393
 - apply_order: 13
  from_series: true
  include: driver/bes2600/scan-defer-backoff-tune-danctnix/0001-bes2600-widen-scan-defer-backoff-30s-and-decay-on-quiet.patch
  sha256: 70a5b25baaf41c8090701b069c30cbad378883d828bdd06e4eb560a35bc077f1
  size: 4924
 - apply_order: 14
  from_series: true
  include: driver/bes2600/lmac-recover-via-mmc-hw-reset-danctnix/0001-bes2600-recover-wedged-firmware-via-mmc_hw_reset-on-link-break.patch
  sha256: 3decf33c9684b3aba64004d5ad97ae3d54e1d6dc176d0b0ae539036c65e6dc6c
  size: 10604
 - apply_order: 15
  from_series: true
  include: driver/bes2600/lmac-recover-via-mmc-hw-reset-danctnix/0002-bes2600-handle-multi-function-SDIO-cards-in-mmc_hw_reset-bus_reset.patch
  sha256: a1acfcc401afc699a9c3676b6df2ec0f092e78826a32616268f90b509d538e33
  size: 3321
 - apply_order: 16
  from_series: true
  include: driver/bes2600/pm-state-resync-danctnix/0001-bes2600-gate-PM-indication-completion-on-pending-request-and-track-state.patch
  sha256: 049cf3ff9c01fdd10ff73bd18497e14ef0cd8fd1a65486ba86fbc6c1935a5f8e
  size: 10269
 - apply_order: 17
  from_series: true
  include: driver/bes2600/pm-wake-consume-state-danctnix/0001-bes2600-short-circuit-wake-handshake-when-chip-confirmed-ACTIVE.patch
  sha256: c9d19a73816f4c82b418dcd18008176bbb0c49fd4138be53cad45ae142224112
  size: 8100
 - apply_order: 18
  from_series: true
  include: driver/bes2600/pm-detect-firmware-unsupported-danctnix/0001-bes2600-self-detect-firmware-does-not-honor-PSM-skip-cycle.patch
  sha256: 196dc9d51ffea268718a290d434b6237fb60119f10c2b050a58724c8a775c7a8
  size: 9041
 - apply_order: 19
  from_series: true
  include: driver/bes2600/decrypt-storm-fast-recover-danctnix/0001-bes2600-pre-empt-AP-deauth-6-mac80211-reassoc-on-decrypt-fail-storm.patch
  sha256: b57ed316005f402c95ccae8ab24ac761bdf34162d73f108f5790af8f8ad2d1fe
  size: 9249
 - apply_order: 20
  from_series: true
  include: driver/bes2600/connection-loss-fast-recover-danctnix/0001-bes2600-bus_reset-on-connection-loss-storm-to-dodge-assoc-comeback-blackhole.patch
  sha256: cd1eaff97c3f08c58e7b1588e19a12200e8bb2a1f39afe554284f1d818610a67
  size: 12184
 - apply_order: 21
  from_series: true
  include: driver/bes2600/cw1200-fix-backports-danctnix/0001-bes2600-replace-atomic_add-with-atomic_inc-cw1200-backport.patch
  sha256: 3876c9e512f556c7f2e8d4cfaba1d7df2945ee48af8edfab5f8d09d9de9adf23
  size: 3080
 - apply_order: 22
  from_series: true
  include: driver/bes2600/cw1200-fix-backports-danctnix/0002-bes2600-fix-missing-destroy_workqueue-on-error-in-init_common.patch
  sha256: 2b82ecb127748349780404479205b952337c244e715278e6d40471c6ecad7602
  size: 2230
 - apply_order: 23
  from_series: true
  include: driver/bes2600/cw1200-fix-backports-danctnix/0003-bes2600-fix-concurrency-UAF-in-bes2600_hw_scan-and-sched_scan.patch
  sha256: 4c1850ad003ddcac543d3d61edd15c18ccd0cc601367cf4c6dd31e1fbb39ab16
  size: 4476
 - apply_order: 24
  from_series: true
  include: driver/bes2600/sdio-rx-no-relay-danctnix/0001-bes2600-drop-sdio_rx_work-relay-IRQ-bh-direct-no-relay-architecture.patch
  sha256: f1182150c5893f2497f942900b34c9c4aeb8d5901d9786ae2753dcce38ed6c78
  size: 19313
 - apply_order: 25
  from_series: true
  include: driver/bes2600/license-spdx-restore-attribution-danctnix/0001-bes2600-Patch-G-restore-SPDX-identifiers-ST-Ericsson-attribution.patch
  sha256: 91dadab0b58f8b8ad2dca80fd04796d478ecb83ce94a1e4b6e97ef8634d97ef1
  size: 41521
 - apply_order: 26
  from_series: true
  include: driver/bes2600/ba-lock-atomic-danctnix/0001-bes2600-Patch-D-atomicize-ba_lock-counters-drop-the-spinlock.patch
  sha256: a5d4ed2bf545458a756e65670c7eed31997bd0be9262344a10313bee31ea4963
  size: 11987
 - apply_order: 27
  from_series: true
  include: driver/bes2600/ps-state-lock-skip-pm-disabled-danctnix/0001-bes2600-Patch-E-skip-ps_state_lock-when-PSM-known-disabled.patch
  sha256: 18040a563b37cc95c558703f01bfbf6b7fa23a52f2f4f0f8f1254ad4fa0fe0d6
  size: 3396
 - apply_order: 28
  from_series: true
  include: driver/bes2600/rx-list-batch-delivery-danctnix/0001-bes2600-Patch-C2-replace-ieee80211_rx_irqsafe-with-ieee80211_rx_ni.patch
  sha256: ffeffd085a9d052c126a717b845d50120ea302e76c12e53c0c3c891291cababf
  size: 8377
 - apply_order: 29
  from_series: true
  include: driver/bes2600/bh-c-fossil-cleanup-danctnix/0001-bes2600-Patch-H-bh.c-hygiene-cleanup-drop-fossil-blocks-dead-stubs.patch
  sha256: 8fb0c799e3a8ee5ad7bfb647fceaf370c6a1a5f24d8621776fd07bf18a976f81
  size: 21082
 - apply_order: 30
  from_series: true
  include: driver/bes2600/scan-filter-5ghz-danctnix/0001-bes2600-filter-5-GHz-scans-at-the-driver-boundary.patch
  sha256: 31e67569e00daead0784214aced1e077d3270cf1407baa0b330d474e17ec3931
  size: 7735
 - apply_order: 31
  from_series: true
  include: arch/arm64/scs-arm-neon-build-fix/0001-arm64-xor-neon-ffixed-x18-build-fix.patch
  sha256: 105e32edc54743d8107c4dcd846833ae97d2df5f918aebc9fe3e67d6f23249cc
  size: 1562
 - apply_order: 32
  from_series: true
  include: driver/bes2600/queue-pending-record-lock-bh-danctnix/0001-bes2600-take-pending-record-lock-with-bh.patch
  sha256: e0894371c43f750590e1704ae3c77b27b6910548afa4a5b61ebc4d9919580ca2
  size: 5270
 schema_version: 1
@@ -0,0 +1,57 @@
 From: claude-noether (on behalf of mfritsche)
 Date: 2026-05-19
 Subject: panvk: expose VK_KHR/EXT_robustness2 + nullDescriptor on Bifrost (PAN_ARCH 6/7)
 Without this, Mesa's Zink driver refuses to use PanVk-Bifrost as its Vulkan
 backend, falling back silently to llvmpipe (software rasterizer) for all
 GL-via-Zink on Bifrost SBCs. That defeats the entire purpose of having a
 Vulkan driver on Bifrost — GL acceleration via Zink is the most natural
 near-term consumer.
 panvk_vX_nir_lower_descriptors.c:1309 and panvk_vX_shader.c:1355 already
 plumb dev->vk.enabled_features.nullDescriptor arch-agnostically — the gate
 at panvk_vX_physical_device.c was set conservatively when Bifrost was
 unmaintained, not because of hardware incapability.
 iter1–7 of the panvk-bifrost campaign proved fundamental driver functions
 on Mali-G52 r1 MC1 (PAN_ARCH=7). This patch is the iter8 follow-up.
 robustBufferAccess2 and robustImageAccess2 are NOT flipped — they're
 independent rb2 features Zink doesn't require, gated differently
 (robustBufferAccess2 = PAN_ARCH >= 11, robustImageAccess2 = false), and
 out of scope for iter8.
 ---
 src/panfrost/vulkan/panvk_vX_physical_device.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
 diff --git a/src/panfrost/vulkan/panvk_vX_physical_device.c b/src/panfrost/vulkan/panvk_vX_physical_device.c
 --- a/src/panfrost/vulkan/panvk_vX_physical_device.c
 +++ b/src/panfrost/vulkan/panvk_vX_physical_device.c
@@ -91,7 +91,7 @@ get_device_extensions(const struct panvk_physical_device *device,
       .KHR_pipeline_binary = true,
       .KHR_pipeline_executable_properties = true,
       .KHR_pipeline_library = true,
 -      .KHR_robustness2 = PAN_ARCH >= 10,
 +      .KHR_robustness2 = true,
       .KHR_sampler_mirror_clamp_to_edge = true,
       .KHR_sampler_ycbcr_conversion = true,
       .KHR_separate_depth_stencil_layouts = true,
@@ -168,7 +168,7 @@ get_device_extensions(const struct panvk_physical_device *device,
       .EXT_queue_family_foreign = true,
       .EXT_robustness = pan_arch(device->kmod.dev->props.gpu_id) >= 9,
       .EXT_image_robustness = true,
 -      .EXT_robustness2 = PAN_ARCH >= 10,
 +      .EXT_robustness2 = true,
       .EXT_sampler_filter_minmax = PAN_ARCH >= 10,
       .EXT_scalar_block_layout = true,
       .EXT_separate_stencil_usage = true,
@@ -493,7 +493,7 @@ get_device_features(const struct panvk_physical_device *device,
       /* VK_KHR_robustness2 */
       .robustBufferAccess2 = PAN_ARCH >= 11,
       .robustImageAccess2 = false,
 -      .nullDescriptor = PAN_ARCH >= 10,
 +      .nullDescriptor = true,
       /* VK_KHR_shader_clock */
       .shaderSubgroupClock = device->kmod.dev->props.gpu_can_query_timestamp,
@@ -0,0 +1,47 @@
 From: claude-noether (on behalf of mfritsche)
 Date: 2026-05-20
 Subject: panvk: expose Vulkan 1.1 + 1.2 on Bifrost (PAN_ARCH 6/7)
 ANGLE (Chromium's GL stack) requires apiVersion >= 1.1 to initialize. Without
 this, Brave / Chromium's GPU process fails at GL info collection:
  vk_renderer.cpp:2659 (initialize): ANGLE Requires a minimum Vulkan device
                                     version of 1.1
  Display::initialize error 0: Internal Vulkan error (-9): The requested
                               version of Vulkan is not supported by the driver
 Stack-up with iter8's robustness2 patch enables ANGLE → PanVk-Bifrost →
 Skia (via --enable-features=Vulkan) on Bifrost SBCs.
 PanVk-Bifrost already supports the bulk of 1.1-promoted features as extensions
 (multiview, maintenance1-3, descriptor update template, 16-bit storage,
 descriptor update template, sampler ycbcr, variable pointers, etc. — all
 visible in iter0 vulkaninfo). The version bump primarily bundles them.
 Risk: Vulkan 1.1 has features beyond what iter1–7 exercised (protected memory,
 full subgroup ops). Specific app failures will be characterizable.
 1.2 is also flipped — Brave's Vulkan path may want descriptor indexing,
 buffer device address, etc. (all listed in iter0 vulkaninfo as supported
 extensions, just gated as 1.0-with-extensions, not 1.2-core).
 ---
 src/panfrost/vulkan/panvk_vX_physical_device.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/src/panfrost/vulkan/panvk_vX_physical_device.c b/src/panfrost/vulkan/panvk_vX_physical_device.c
 --- a/src/panfrost/vulkan/panvk_vX_physical_device.c
 +++ b/src/panfrost/vulkan/panvk_vX_physical_device.c
@@ -38,8 +38,8 @@ get_device_extensions(const struct panvk_physical_device *device,
                       struct vk_device_extension_table *ext)
 {
    *ext = (struct vk_device_extension_table){
 -      .KHR_8bit_storage = true,
 -      .KHR_16bit_storage = true,
 -      bool has_vk1_1 = PAN_ARCH >= 10;
 -      bool has_vk1_2 = PAN_ARCH >= 10;
 +      .KHR_8bit_storage = true,
 +      .KHR_16bit_storage = true,
 +      bool has_vk1_1 = true;
 +      bool has_vk1_2 = true;
       *ext = (struct vk_device_extension_table){
@@ -0,0 +1,165 @@
 # Maintainer: Markus Fritsche <fritsche.markus@gmail.com>
 #
 # mesa-panvk-bifrost — patched Mesa libvulkan_panfrost.so that exposes
 # Bifrost-gen Mali (Mali-G31/G52/G72/G76, PAN_ARCH 6/7) to Chromium-family
 # browsers' Vulkan compositor.
 #
 # Campaign: ~/src/panvk-bifrost/ — iter9 close (technical milestone
 # 2026-05-20, operator-confirmed Brave window). Goal close requires
 # this package built + published + installable per the
 # feedback_package_done_means_installable.md 3-point check.
 #
 # What it does:
 #   - Builds Mesa 26.0.6 (matching ohm's stock mesa pkg) with two
 #     patches against src/panfrost/vulkan/panvk_vX_physical_device.c:
 #     (1) expose VK_KHR/EXT_robustness2 + nullDescriptor on PAN_ARCH 6/7
 #     (2) set has_vk1_1/has_vk1_2 to true on Bifrost
 #   - Installs the patched libvulkan_panfrost.so to /usr/lib/panvk-bifrost/
 #     (NOT /usr/lib — co-installs alongside stock mesa).
 #   - Registers a custom ICD JSON at a non-default path so the system
 #     Vulkan loader only picks up our driver when VK_ICD_FILENAMES is set.
 #   - Ships /usr/bin/brave-vulkan launcher that wires up env vars + flags.
 #
 # Co-existence: stock /usr/lib/libvulkan_panfrost.so is untouched. Stock
 # /usr/share/vulkan/icd.d/panfrost_icd.json is untouched. Users opt in
 # via brave-vulkan (or by setting VK_ICD_FILENAMES manually).
 #
 # Build target: arch-aarch64 runner via marfrit-packages Gitea Actions.
 # Mesa build is slow (~30-60min on Cortex-A55). Build deps installed
 # inside the runner via pacman -S in the workflow.
 pkgname=mesa-panvk-bifrost
 _mesaver=26.0.6
 pkgver=26.0.6.r2
 pkgrel=2
 pkgdesc="Patched Mesa libvulkan_panfrost.so exposing Bifrost-gen Mali to Vulkan apps (panvk-bifrost campaign)"
 arch=('aarch64')
 url="https://github.com/marfrit/panvk-bifrost"
 license=('MIT')
 # We co-install at /usr/lib/panvk-bifrost/ so no conflicts with stock mesa.
 # We DO provide a script that requires brave to be installed.
 depends=(
    'mesa'              # for shared mesa runtime libs (libgallium-mesa etc.)
    'libdrm'
    'wayland'
    'libxcb'
    'libx11'
    'libxshmfence'
    'zlib'
    'zstd'
    'libdisplay-info'
    'expat'
    'systemd-libs'      # libudev
    'spirv-tools'
 )
 optdepends=(
    'brave-bin: for the brave-vulkan launcher script'
 )
 makedepends=(
    'meson'
    'ninja'
    'pkgconf'
    'bison'
    'flex'
    'python'
    'python-yaml'
    'python-mako'
    'glslang'
    'spirv-tools'
    'llvm'
    'clang'
    'libclc'
    'spirv-llvm-translator'
    'vulkan-headers'
    'wayland-protocols'
 )
 source=(
    "https://archive.mesa3d.org/mesa-${_mesaver}.tar.xz"
    "0001-panvk-expose-robustness2-nullDescriptor-bifrost.patch"
    "0002-panvk-expose-vulkan-1.1-1.2-on-bifrost.patch"
    "brave-vulkan"
    "icd.json"
 )
 sha256sums=(
    '1d3c3b8a8363b8cc354175bb4a684ad8b035211cc1d6fa17aeb9b9623c513f89'  # mesa-26.0.6.tar.xz from archive.mesa3d.org, pinned 2026-05-20 (iter10)
    'SKIP'
    'SKIP'
    'SKIP'
    'SKIP'
 )
 prepare() {
    cd "mesa-${_mesaver}"
    # iter8 patch: robustness2 + nullDescriptor exposure on Bifrost.
    # Three hunks in panvk_vX_physical_device.c. Apply via sed since
    # the upstream context drifts between Mesa releases and unified-diff
    # patching is brittle (we hit hunk-rejects during manual application).
    sed -i 's|\.KHR_robustness2 = PAN_ARCH >= 10,|.KHR_robustness2 = true,|' src/panfrost/vulkan/panvk_vX_physical_device.c
    sed -i 's|\.EXT_robustness2 = PAN_ARCH >= 10,|.EXT_robustness2 = true,|' src/panfrost/vulkan/panvk_vX_physical_device.c
    sed -i 's|\.nullDescriptor = PAN_ARCH >= 10,|.nullDescriptor = true,|' src/panfrost/vulkan/panvk_vX_physical_device.c
    # iter9 patch: bump api version to 1.1/1.2 for Bifrost. NOTE: this only
    # affects extension exposure flags, NOT the reported apiVersion (which
    # is set by get_api_version() further down and gated separately).
    # The brave-vulkan launcher sets MESA_VK_VERSION_OVERRIDE=1.2 at runtime
    # to deal with the latter — no source change needed for that path.
    sed -i 's|bool has_vk1_1 = PAN_ARCH >= 10;|bool has_vk1_1 = true;|' src/panfrost/vulkan/panvk_vX_physical_device.c
    sed -i 's|bool has_vk1_2 = PAN_ARCH >= 10;|bool has_vk1_2 = true;|' src/panfrost/vulkan/panvk_vX_physical_device.c
    # Sanity-check the patches landed.
    grep -q "KHR_robustness2 = true," src/panfrost/vulkan/panvk_vX_physical_device.c
    grep -q "EXT_robustness2 = true," src/panfrost/vulkan/panvk_vX_physical_device.c
    grep -q "nullDescriptor = true," src/panfrost/vulkan/panvk_vX_physical_device.c
    grep -q "has_vk1_1 = true;" src/panfrost/vulkan/panvk_vX_physical_device.c
    grep -q "has_vk1_2 = true;" src/panfrost/vulkan/panvk_vX_physical_device.c
 }
 build() {
    cd "mesa-${_mesaver}"
    # Minimal Mesa build — only the panvk Vulkan driver. No GLES/GLX/EGL/
    # gallium drivers — keeps the build narrower and avoids pulling in
    # the entire Mesa runtime in this package's dep graph.
    meson setup build/ \
        --prefix=/usr \
        --libdir=lib \
        --buildtype=release \
        -Dvulkan-drivers=panfrost \
        -Dgallium-drivers= \
        -Dplatforms=wayland,x11 \
        -Dglx=disabled \
        -Degl=disabled \
        -Dgles1=disabled \
        -Dgles2=disabled \
        -Dvulkan-layers= \
        -Dtools= \
        -Dgallium-rusticl=false \
        -Dmicrosoft-clc=disabled
    meson compile -C build
 }
 package() {
    cd "${srcdir}/mesa-${_mesaver}"
    # Patched lib — co-install path, NOT /usr/lib (to avoid clashing
    # with stock mesa's libvulkan_panfrost.so binary).
    install -Dm755 build/src/panfrost/vulkan/libvulkan_panfrost.so \
        "$pkgdir/usr/lib/panvk-bifrost/libvulkan_panfrost.so"
    # ICD JSON at the standard Vulkan loader search path. The '00-'
    # filename prefix gives optical priority but is NOT spec-backed —
    # Vulkan loader readdir-order is implementation-defined per Khronos
    # LoaderDriverInterface. The brave-vulkan wrapper sets
    # VK_LOADER_DRIVERS_SELECT='00-panvk-bifrost*' to make the selection
    # deterministic across filesystems. This avoids the VK_ICD_FILENAMES
    # full-path override (whose GPU-sandbox survival is fragile) while
    # still letting the loader work normally. iter10 result + Phase 5
    # hardening.
    install -Dm644 "$srcdir/icd.json" \
        "$pkgdir/usr/share/vulkan/icd.d/00-panvk-bifrost.json"
    # The brave-vulkan launcher wires up env + flags. iter10: no longer
    # sets VK_ICD_FILENAMES, no longer passes --no-sandbox /
    # --disable-gpu-sandbox.
    install -Dm755 "$srcdir/brave-vulkan" "$pkgdir/usr/bin/brave-vulkan"
 }
@@ -0,0 +1,86 @@
 # mesa-panvk-bifrost
 Patched Mesa `libvulkan_panfrost.so` exposing Bifrost-gen Mali GPUs
 (Mali-G31/G52/G72/G76, PAN_ARCH 6/7) to Chromium-family browsers'
 Vulkan compositor.
 Result of the **panvk-bifrost** campaign ([`~/src/panvk-bifrost/`](../../../panvk-bifrost/)),
 iter9 close 2026-05-20 (technical milestone — operator-confirmed Brave
 window) followed by this package as the actual delivery.
 ## What it solves
 Stock Chromium / Brave on Bifrost SBCs (PineTab2, etc.) currently dies
 at GL bindings init:
 ```
 ERROR: ui/gl/gl_context_egl.cc:120  GLES3 is unsupported and ES version fallback is disabled
 ERROR: ui/gl/init/gl_factory.cc:111  Requested GL implementation not found
 ERROR: components/viz/service/main/viz_main_impl.cc:189  Exiting GPU process due to errors during initialization
 ```
 This package makes Brave's **Vulkan compositor path** work on Bifrost,
 side-stepping the failing GL stack. Browser chrome and standard page
 rendering work.
 ## Known limitations (not addressed)
 - **WebGL / WebGL2** in-page: blocked. ANGLE needs `VK_EXT_transform_feedback`
  to expose GLES3 contexts; PanVk-Bifrost doesn't currently support that.
  Sites using WebGL will degrade or refuse.
 - **VAAPI hardware video decode**: unrelated to this package — see the
  `libva-v4l2-request-fourier` package for that path.
 ## Install
 ```sh
 # Ensure [marfrit] is in /etc/pacman.conf, then:
 sudo pacman -Sy mesa-panvk-bifrost
 ```
 ## Use
 ```sh
 brave-vulkan                                    # launches Brave with Vulkan
 brave-vulkan https://www.example.com
 brave-vulkan --your-flags-here                  # extra args passed through
 ```
 The launcher sets:
 - `PAN_I_WANT_A_BROKEN_VULKAN_DRIVER=1` (Mesa upstream gate)
 - `MESA_VK_VERSION_OVERRIDE=1.2` (apiVersion bump for ANGLE)
 - Brave flags: `--use-gl=disabled --enable-features=Vulkan --use-vulkan=native --ozone-platform=x11 --ignore-gpu-blocklist`
 iter10 dropped `VK_ICD_FILENAMES` (ICD now at `/usr/share/vulkan/icd.d/00-panvk-bifrost.json` so the Vulkan loader auto-picks it, pinned deterministically via `VK_LOADER_DRIVERS_SELECT='00-panvk-bifrost*'`) and `--no-sandbox` / `--disable-gpu-sandbox` (env vars survive the GPU sandbox boundary without bypass).
 ## What's in the package
 - `/usr/lib/panvk-bifrost/libvulkan_panfrost.so` — patched Mesa Vulkan driver (Mesa 26.0.6 + 2 sed-applied patches)
 - `/usr/share/vulkan/icd.d/00-panvk-bifrost.json` — Vulkan ICD JSON pointing at the patched .so (Vulkan loader picks it deterministically via `VK_LOADER_DRIVERS_SELECT='00-panvk-bifrost*'` set by the launcher)
 - `/usr/bin/brave-vulkan` — launcher script
 System Mesa's binary `/usr/lib/libvulkan_panfrost.so` is untouched. The
 stock `panfrost_icd.json` is also untouched and continues to enumerate
 the same Mali-G52 device — apps see both drivers in
 `vkEnumeratePhysicalDevices` and pick by index (ANGLE picks first, which
 becomes ours by alphabetical priority).
 ## Co-existence
 Both stock Mesa and this package can be installed. Stock Vulkan apps
 (`vulkaninfo`, `vkcube`, etc.) use the stock driver by default. Only
 apps started via `brave-vulkan` (or with `VK_ICD_FILENAMES` manually
 set to our path) use the patched driver.
 ## Campaign close criterion
 Per [`feedback_package_done_means_installable`](file:///home/mfritsche/.claude/projects/-home-mfritsche-src/memory/feedback_package_done_means_installable.md)
 three-point check:
 1. PR merged to `marfrit-packages`
 2. CI green AND `packages.reauktion.de/arch/aarch64/mesa-panvk-bifrost-*.pkg.tar.zst` exists
 3. `pacman -Ss mesa-panvk-bifrost` on a fresh consumer host (e.g. ohm
   after `pacman -Syu` from clean state) returns the package + brave-vulkan launches
 When all three pass, panvk-bifrost iter9 closes.
@@ -0,0 +1,68 @@
 #!/bin/bash
 # brave-vulkan — launch Brave with the PanVk-Bifrost Vulkan compositor on
 # Bifrost SBCs (PineTab2 / Mali-G52 r1 MC1 and similar).
 #
 # Side-steps the GL stack failures stock Brave hits on Bifrost
 # (the README "Consumer-side benefit" path of the panvk-bifrost campaign).
 #
 # Provided by the mesa-panvk-bifrost package. See:
 #   /usr/share/doc/mesa-panvk-bifrost/README
 #   ~/src/panvk-bifrost/phase8_iteration{9,10}_close.md
 #
 # Usage: brave-vulkan [brave args...]
 # Equivalent to: brave [VULKAN_FLAGS] [your args]
 #
 # iter10 changes vs iter9:
 #   - dropped VK_ICD_FILENAMES env (ICD now at /usr/share/vulkan/icd.d/
 #     with '00-' prefix so the Vulkan loader auto-picks ours first)
 #   - dropped --no-sandbox / --disable-gpu-sandbox (env vars survive the
 #     GPU sandbox boundary, no bypass needed)
 set -e
 # Pin the Vulkan ICD selection to our package's ICD. The Vulkan loader's
 # readdir-order in /usr/share/vulkan/icd.d/ is implementation-defined
 # per Khronos LoaderDriverInterface — the '00-' filename prefix is NOT
 # spec-backed. VK_LOADER_DRIVERS_SELECT short-circuits the directory
 # enumeration and picks our ICD deterministically. (Phase 5 review
 # hardening, iter10.)
 export VK_LOADER_DRIVERS_SELECT='00-panvk-bifrost*'
 # PanVk's "I know it's not conformant" gate — the patched driver still
 # refuses to enumerate Bifrost without this env var (upstream Mesa choice
 # for v6/v7, kept for compatibility).
 export PAN_I_WANT_A_BROKEN_VULKAN_DRIVER=1
 # Override apiVersion to 1.2 — ANGLE (Chromium's GL stack) requires
 # device.apiVersion >= 1.1. Source patches don't move get_api_version()'s
 # PAN_ARCH>=10 hardcode; the env var override does.
 export MESA_VK_VERSION_OVERRIDE=1.2
 # Find the live Plasma session's Xauthority. On a fresh boot the suffix
 # is randomized; pgrep the Xwayland args to find the current one.
 if [ -z "${XAUTHORITY:-}" ]; then
    XAUTHF=$(pgrep -fa Xwayland 2>/dev/null | grep -oE "/run/user/$(id -u)/xauth_[A-Za-z0-9]+" | head -1)
    if [ -n "$XAUTHF" ]; then
        export XAUTHORITY="$XAUTHF"
    fi
 fi
 # Standard session env if not already set
 : "${XDG_RUNTIME_DIR:=/run/user/$(id -u)}"
 export XDG_RUNTIME_DIR
 # Default to the active Plasma Wayland session if WAYLAND_DISPLAY unset
 : "${WAYLAND_DISPLAY:=wayland-0}"
 export WAYLAND_DISPLAY
 # Default to the XWayland :1 unless DISPLAY is set
 : "${DISPLAY:=:1}"
 export DISPLAY
 exec brave \
    --use-gl=disabled \
    --enable-features=Vulkan \
    --use-vulkan=native \
    --ozone-platform=x11 \
    --ignore-gpu-blocklist \
    "$@"
@@ -0,0 +1,7 @@
 {
    "ICD": {
        "api_version": "1.4.335",
        "library_path": "/usr/lib/panvk-bifrost/libvulkan_panfrost.so"
    },
    "file_format_version": "1.0.1"
 }
@@ -28,7 +28,7 @@ pkgname=(qt6-base-fourier
         qt6-xcb-private-headers-fourier)
 _pkgver=6.11.1
 pkgver=${_pkgver/-/}
-pkgrel=1
+pkgrel=2
 epoch=1
 arch=(aarch64 x86_64)
 url='https://www.qt.io'
@@ -188,7 +188,7 @@ package_qt6-xcb-private-headers-fourier() {
  conflicts=(qt6-xcb-private-headers)
  replaces=(qt6-xcb-private-headers)
-  depends=("qt6-base-fourier=$pkgver")
+  depends=("qt6-base-fourier=$epoch:$pkgver")
  optdepends=()
  groups=()
@@ -0,0 +1,174 @@
 #!/bin/bash
 # Build daedalus-v4l2-dkms_<ver>_all.deb (kernel module via DKMS).
 #
 # Installs kernel/ source tree to /usr/src/daedalus_v4l2-${PKGVER}/
 # plus a dkms.conf.  Postinst registers with DKMS (dkms add + build +
 # install).  Prerm deregisters.  Result: the daedalus_v4l2 module
 # auto-rebuilds against any installed kernel headers without users
 # needing to remember to dkms-add it.
 #
 # Architecture: all.  The kernel module itself is per-kernel-version,
 # but the SOURCE package is arch-independent.
 #
 # Sibling Arch package: ../../arch/daedalus-v4l2-dkms/PKGBUILD
 # Sibling userspace package: ../daedalus-v4l2/build-deb.sh
 set -euo pipefail
 UPSTREAM_COMMIT=481279c9bffd19e32c8f3299897e9b63fc5a24aa
 PKGVER=0.1.0+r18+g481279c
 PKGREL=1  # reset for new upstream pin (481279c — Phase 8.13 close)
 MODULE_NAME=daedalus_v4l2
 HERE=$(dirname "$(readlink -f "$0")")
 # Reproducible build.  2026-05-18 23:00 UTC — Phase 8.13 close.
 export SOURCE_DATE_EPOCH=1779231600
 work=$(mktemp -d)
 trap "rm -rf $work" EXIT
 cd "$work"
 curl -sSLfo daedalus-v4l2.tar.gz \
    "https://git.reauktion.de/reauktion/daedalus-v4l2/archive/${UPSTREAM_COMMIT}.tar.gz"
 tar xzf daedalus-v4l2.tar.gz
 SRCDIR=daedalus-v4l2
 ROOT="$work/pkgroot"
 SRCROOT="$ROOT/usr/src/${MODULE_NAME}-${PKGVER}"
 mkdir -p "$SRCROOT/include" \
         "$ROOT/DEBIAN" \
         "$ROOT/usr/share/doc/daedalus-v4l2-dkms"
 # Copy kernel/ source files to the DKMS source dir.
 cp -r "$work/$SRCDIR/kernel/." "$SRCROOT/"
 # Embed the shared protocol header inline (rather than referencing
 # ../include/ which doesn't exist after DKMS extracts the tree).
 # Patch the Makefile to find it at $SRCROOT/include/ instead.
 install -m 644 "$work/$SRCDIR/include/daedalus_v4l2_proto.h" \
    "$SRCROOT/include/daedalus_v4l2_proto.h"
 sed -i 's|-I\$(src)/\.\./include|-I$(src)/include|' "$SRCROOT/Makefile"
 # Generate dkms.conf with the actual version substituted.
 cat > "$SRCROOT/dkms.conf" <<EOF
 PACKAGE_NAME="${MODULE_NAME}"
 PACKAGE_VERSION="${PKGVER}"
 BUILT_MODULE_NAME[0]="${MODULE_NAME}"
 DEST_MODULE_LOCATION[0]="/updates"
 MAKE[0]="make KERNELDIR=/lib/modules/\${kernelver}/build all"
 CLEAN="make KERNELDIR=/lib/modules/\${kernelver}/build clean"
 AUTOINSTALL="yes"
 EOF
 # Doc
 install -m 644 "$work/$SRCDIR/README.md" \
    "$ROOT/usr/share/doc/daedalus-v4l2-dkms/README.md"
 install -Dm644 "$HERE/debian/copyright" "$ROOT/usr/share/doc/daedalus-v4l2-dkms/copyright"
 install -Dm644 "$HERE/debian/changelog" "$ROOT/usr/share/doc/daedalus-v4l2-dkms/changelog.Debian"
 gzip -9 -n "$ROOT/usr/share/doc/daedalus-v4l2-dkms/changelog.Debian"
 # DKMS post-install / pre-remove hooks.
 cat > "$ROOT/DEBIAN/postinst" <<EOF
 #!/bin/sh
 set -e
 NAME=${MODULE_NAME}
 VERSION=${PKGVER}
 KERNELVER=\$(uname -r)
 # Yellow + bold ANSI for the warning so it stands out in apt's
 # stream of "Setting up" lines.  Disable colour on non-TTY.
 if [ -t 1 ]; then
    Y=\$(printf '\\033[1;33m'); R=\$(printf '\\033[0m')
 else
    Y=''; R=''
 fi
 warn() {
    printf '%s==> daedalus-v4l2-dkms: %s%s\\n' "\$Y" "\$1" "\$R" >&2
 }
 if [ "\$1" = "configure" ]; then
    if ! command -v dkms >/dev/null 2>&1; then
        warn "dkms not installed; module \$NAME/\$VERSION not registered."
        warn "Install 'dkms' then run: dkms add \$NAME/\$VERSION && dkms autoinstall"
        exit 0
    fi
    dkms add "\$NAME/\$VERSION" 2>/dev/null || true
    # Don't let autoinstall failure mask the actual problem behind '|| true'.
    # Run it, capture the result, then verify post-condition.
    autoinstall_rc=0
    dkms autoinstall "\$NAME/\$VERSION" || autoinstall_rc=\$?
    # Verify the module actually built + installed for the running kernel.
    status=\$(dkms status -m "\$NAME" -v "\$VERSION" -k "\$KERNELVER" 2>/dev/null || true)
    if ! printf '%s\\n' "\$status" | grep -q -E 'installed|loaded'; then
        warn ""
        warn "DKMS build did NOT land for kernel \$KERNELVER."
        warn "  dkms status -m \$NAME -v \$VERSION -k \$KERNELVER:"
        warn "    \$(printf '%s' "\$status" | head -1)"
        warn ""
        warn "Most likely cause: kernel headers package is missing."
        warn "  Raspberry Pi OS / Pi 5:  apt install linux-headers-rpi-2712"
        warn "  Debian generic:          apt install linux-headers-\$KERNELVER"
        warn ""
        warn "After installing headers, finish the install with:"
        warn "  sudo dkms autoinstall \$NAME/\$VERSION"
        warn "  sudo modprobe daedalus_v4l2"
        warn ""
        warn "Until then daedalus_v4l2 will NOT be loadable and the"
        warn "userspace daedalus-v4l2 daemon will have nothing to talk to."
    fi
 fi
 #DEBHELPER#
 EOF
 chmod 755 "$ROOT/DEBIAN/postinst"
 cat > "$ROOT/DEBIAN/prerm" <<EOF
 #!/bin/sh
 set -e
 NAME=${MODULE_NAME}
 VERSION=${PKGVER}
 if [ "\$1" = "remove" ] && command -v dkms >/dev/null 2>&1; then
    dkms remove "\$NAME/\$VERSION" --all || true
 fi
 #DEBHELPER#
 EOF
 chmod 755 "$ROOT/DEBIAN/prerm"
 cat > "$ROOT/DEBIAN/control" <<EOF
 Package: daedalus-v4l2-dkms
 Version: ${PKGVER}-${PKGREL}
 Section: kernel
 Priority: optional
 Architecture: all
 Depends: dkms (>= 2.1.0.0)
 Recommends: daedalus-v4l2, linux-headers-rpi-2712 | linux-headers-rpi | linux-headers-generic | linux-headers
 Maintainer: Markus Fritsche <mfritsche@reauktion.de>
 Homepage: https://git.reauktion.de/reauktion/daedalus-v4l2
 Description: V4L2 stateless decoder shim kernel module (DKMS) — Pi 5 / CM5
 Out-of-tree V4L2 m2m kernel module for the daedalus-v4l2 stack on
 Raspberry Pi 5 / CM5.  Registers /dev/videoNN (V4L2 stateless m2m
 decoder), /dev/mediaNN (media controller with request API), and
 /dev/daedalus-v4l2 (chardev bridge to the userspace daemon).
 .
 The actual decode happens in the userspace daemon shipped by the
 daedalus-v4l2 package — this module is just the kernel-side V4L2
 plumbing.  Install both to actually serve VAAPI / V4L2 clients.
 .
 Built via DKMS against the running kernel's headers.
 EOF
 DEB_OUT="daedalus-v4l2-dkms_${PKGVER}-${PKGREL}_all.deb"
 dpkg-deb --root-owner-group --build "$ROOT" "$HERE/$DEB_OUT"
 echo "built: $HERE/$DEB_OUT"
@@ -0,0 +1,36 @@
 daedalus-v4l2-dkms (0.1.0+r18+g481279c-1) bookworm trixie; urgency=medium
  * Bump to 481279c in lockstep with the userspace daedalus-v4l2
    package (which ships the new systemd unit + modules-load.d
    drop-in).  No kernel-module behaviour change in this commit —
    bump is purely to keep DKMS pkgver and userspace pkgver aligned
    so /etc/modules-load.d/daedalus-v4l2.conf has a module to load.
 -- Markus Fritsche <mfritsche@reauktion.de>  Wed, 20 May 2026 16:00:00 +0000
 daedalus-v4l2-dkms (0.1.0+r17+gf0cd29a-1) bookworm trixie; urgency=medium
  * Bump to f0cd29a — Linux 6.18 compatibility fix.  v4l2_fh_add /
    v4l2_fh_del gained a `struct file *filp` second argument at
    v6.18; module source now uses LINUX_VERSION_CODE conditional so
    it builds against 6.12 (Pi 5 stock RPi-2712 kernel) AND 6.18+
    (RPi-2712 / arm64).  Verified DKMS rebuild on higgs
    (6.18.29+rpt-rpi-2712) succeeds + /dev/daedalus-v4l2 appears.
  * Recommends widened so apt pulls the right kernel-headers
    metapackage on RPi OS: linux-headers-rpi-2712 first, then
    linux-headers-rpi, then linux-headers-generic, then
    linux-headers.
 -- Markus Fritsche <mfritsche@reauktion.de>  Tue, 20 May 2026 10:30:00 +0000
 daedalus-v4l2-dkms (0.1.0+r16+gf55b2cd-1) bookworm trixie; urgency=medium
  * Initial Debian DKMS packaging for the daedalus_v4l2 kernel module.
  * Pinned to f55b2cd (Phase 8.13 close): kernel-side framework
    integration (V4L2 m2m, dmabuf-export, media controller, request
    API, NV12 single-plane + NV12M + P010 CAPTURE) that closes the
    libva→/dev/video0→daemon round-trip with byte-exact pixels.
  * Auto-builds via DKMS against the running kernel's headers.
  * Companion userspace package: daedalus-v4l2 (daemon + tools).
 -- Markus Fritsche <mfritsche@reauktion.de>  Mon, 18 May 2026 23:00:00 +0000
@@ -0,0 +1,24 @@
 Source: daedalus-v4l2-dkms
 Section: kernel
 Priority: optional
 Maintainer: Markus Fritsche <mfritsche@reauktion.de>
 Build-Depends: debhelper-compat (= 13)
 Standards-Version: 4.6.2
 Homepage: https://git.reauktion.de/reauktion/daedalus-v4l2
 Package: daedalus-v4l2-dkms
 Architecture: all
 Depends: ${misc:Depends}, dkms (>= 2.1.0.0)
 Recommends: daedalus-v4l2,
            linux-headers-rpi-2712 | linux-headers-rpi | linux-headers-generic | linux-headers
 Description: V4L2 stateless decoder shim kernel module (DKMS) — Pi 5 / CM5
 Out-of-tree V4L2 m2m kernel module for the daedalus-v4l2 stack on
 Raspberry Pi 5 / CM5. Registers /dev/videoNN (V4L2 stateless m2m
 decoder), /dev/mediaNN (media controller with request API), and
 /dev/daedalus-v4l2 (chardev bridge to the userspace daemon).
 .
 The actual decode happens in the userspace daemon shipped by the
 daedalus-v4l2 package — this module is just the kernel-side V4L2
 plumbing. Install both to actually serve VAAPI / V4L2 clients.
 .
 Built via DKMS against the running kernel's headers.
@@ -0,0 +1,21 @@
 Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
 Upstream-Name: daedalus-v4l2
 Upstream-Contact: Markus Fritsche <fritsche.markus@gmail.com>
 Source: https://git.reauktion.de/reauktion/daedalus-v4l2
 Files: *
 Copyright: 2026 Markus Fritsche <fritsche.markus@gmail.com>
 License: GPL-2.0-or-later
 Comment:
 Kernel module (loadable into the Linux kernel) — GPL-2.0-or-later.
 The shared protocol header carries an additional Linux-syscall-note
 exception so userspace inclusion is BSD-clean.
 License: GPL-2.0-or-later
 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; either version 2 of the License, or
 (at your option) any later version.
 .
 On Debian systems, the complete text of the GNU General Public
 License v2 can be found in `/usr/share/common-licenses/GPL-2'.
@@ -0,0 +1,181 @@
 #!/bin/bash
 # Build daedalus-v4l2_<ver>_arm64.deb (userspace daemon + test tools).
 #
 # Mirrors arch/daedalus-v4l2 (Arch Linux build).  The companion DKMS
 # package (debian/daedalus-v4l2-dkms) carries the kernel module
 # separately so apt/dpkg can split kernel-version-tied and userspace
 # upgrade cadence.
 #
 # Sibling Arch package: ../../arch/daedalus-v4l2/PKGBUILD
 # Sibling DKMS package: ../daedalus-v4l2-dkms/build-deb.sh
 # Upstream repo: https://git.reauktion.de/reauktion/daedalus-v4l2
 set -euo pipefail
 # Same pin as the Arch PKGBUILD.  481279c = "Phase 8.13: byte-exact
 # end-to-end via libva (consumer target hit)" — first commit where the
 # full ffmpeg -hwaccel vaapi → libva → /dev/video0 → daemon path lands
 # a pixel-correct decoded frame back in ffmpeg.
 UPSTREAM_COMMIT=481279c9bffd19e32c8f3299897e9b63fc5a24aa
 PKGVER=0.1.0+r18+g481279c
 PKGREL=1  # reset for new upstream pin (481279c — Phase 8.13 close)
 HERE=$(dirname "$(readlink -f "$0")")
 # Reproducible build.  2026-05-18 23:00 UTC — Phase 8.13 close.
 export SOURCE_DATE_EPOCH=1779231600
 work=$(mktemp -d)
 trap "rm -rf $work" EXIT
 cd "$work"
 curl -sSLfo daedalus-v4l2.tar.gz \
    "https://git.reauktion.de/reauktion/daedalus-v4l2/archive/${UPSTREAM_COMMIT}.tar.gz"
 tar xzf daedalus-v4l2.tar.gz
 SRCDIR=daedalus-v4l2
 # Build daemon (CMake)
 cd "$SRCDIR/daemon"
 cmake -B build -G Ninja \
    -DCMAKE_BUILD_TYPE=Release \
    -DCMAKE_INSTALL_PREFIX=/usr
 cmake --build build
 # Build test tools (in-tree Makefile)
 cd "$work/$SRCDIR/tools"
 make
 # Stage
 ROOT="$work/pkgroot"
 mkdir -p "$ROOT/DEBIAN" \
         "$ROOT/usr/bin" \
         "$ROOT/usr/libexec/daedalus-v4l2" \
         "$ROOT/usr/include" \
         "$ROOT/usr/share/doc/daedalus-v4l2" \
         "$ROOT/lib/systemd/system" \
         "$ROOT/usr/lib/modules-load.d"
 install -m 755 "$work/$SRCDIR/daemon/build/daedalus_v4l2_daemon" \
    "$ROOT/usr/bin/daedalus_v4l2_daemon"
 install -m 755 "$work/$SRCDIR/tools/test_chardev_pingpong" \
    "$ROOT/usr/libexec/daedalus-v4l2/test_chardev_pingpong"
 install -m 755 "$work/$SRCDIR/tools/test_m2m_decode" \
    "$ROOT/usr/libexec/daedalus-v4l2/test_m2m_decode"
 install -m 755 "$work/$SRCDIR/tools/test_m2m_stream" \
    "$ROOT/usr/libexec/daedalus-v4l2/test_m2m_stream"
 install -m 644 "$work/$SRCDIR/include/daedalus_v4l2_proto.h" \
    "$ROOT/usr/include/daedalus_v4l2_proto.h"
 # systemd unit + module autoload — without these the daemon never
 # starts and the libva/VAAPI consumer's REQ_DECODE has nobody on
 # the other end of /dev/daedalus-v4l2.
 install -m 644 "$work/$SRCDIR/packaging/systemd/daedalus-v4l2.service" \
    "$ROOT/lib/systemd/system/daedalus-v4l2.service"
 install -m 644 "$work/$SRCDIR/packaging/systemd/daedalus-v4l2.modules-load" \
    "$ROOT/usr/lib/modules-load.d/daedalus-v4l2.conf"
 install -m 644 "$work/$SRCDIR/README.md" \
    "$ROOT/usr/share/doc/daedalus-v4l2/README.md"
 for d in "$work/$SRCDIR/docs/"*.md; do
    install -m 644 "$d" "$ROOT/usr/share/doc/daedalus-v4l2/$(basename "$d")"
 done
 install -Dm644 "$HERE/debian/copyright" "$ROOT/usr/share/doc/daedalus-v4l2/copyright"
 install -Dm644 "$HERE/debian/changelog" "$ROOT/usr/share/doc/daedalus-v4l2/changelog.Debian"
 gzip -9 -n "$ROOT/usr/share/doc/daedalus-v4l2/changelog.Debian"
 # DEBIAN/postinst — enable service + reload modules-load.d so the
 # kernel module loads now if daedalus-v4l2-dkms is also installed.
 # Does NOT auto-start the service — that requires /dev/daedalus-v4l2
 # to already exist (the ConditionPathExists= in the .service file)
 # which may not be true on the very first install before the user
 # reboots or manually modprobes.  Operator decides when to start.
 cat > "$ROOT/DEBIAN/postinst" <<'POSTINST'
 #!/bin/sh
 set -e
 if [ "$1" = "configure" ]; then
    # Reload systemd so the new unit file is visible.
    if command -v systemctl >/dev/null 2>&1; then
        systemctl daemon-reload >/dev/null 2>&1 || true
        systemctl enable daedalus-v4l2.service >/dev/null 2>&1 || true
    fi
    # Trigger /usr/lib/modules-load.d/daedalus-v4l2.conf without a
    # reboot.  Harmless if the module is already loaded; logs to
    # journal if it can't load (most common cause: dkms hasn't built
    # the module yet for the running kernel — see daedalus-v4l2-dkms
    # postinst for the loud-warning path).
    if command -v systemd-modules-load >/dev/null 2>&1; then
        systemd-modules-load >/dev/null 2>&1 || true
    fi
    # Auto-start if /dev/daedalus-v4l2 came up (i.e. module loaded
    # successfully).  ConditionPathExists in the unit file means
    # `systemctl start` is a no-op if the device isn't there yet —
    # avoids spurious failures during apt install on a host where
    # daedalus-v4l2-dkms hasn't built yet.
    if [ -e /dev/daedalus-v4l2 ] && command -v systemctl >/dev/null 2>&1; then
        systemctl start daedalus-v4l2.service >/dev/null 2>&1 || true
    fi
 fi
 #DEBHELPER#
 POSTINST
 chmod 755 "$ROOT/DEBIAN/postinst"
 cat > "$ROOT/DEBIAN/prerm" <<'PRERM'
 #!/bin/sh
 set -e
 if [ "$1" = "remove" ] && command -v systemctl >/dev/null 2>&1; then
    systemctl stop    daedalus-v4l2.service >/dev/null 2>&1 || true
    systemctl disable daedalus-v4l2.service >/dev/null 2>&1 || true
 fi
 #DEBHELPER#
 PRERM
 chmod 755 "$ROOT/DEBIAN/prerm"
 cat > "$ROOT/DEBIAN/postrm" <<'POSTRM'
 #!/bin/sh
 set -e
 if command -v systemctl >/dev/null 2>&1; then
    systemctl daemon-reload >/dev/null 2>&1 || true
 fi
 #DEBHELPER#
 POSTRM
 chmod 755 "$ROOT/DEBIAN/postrm"
 cat > "$ROOT/DEBIAN/control" <<EOF
 Package: daedalus-v4l2
 Version: ${PKGVER}-${PKGREL}
 Section: video
 Priority: optional
 Architecture: arm64
 Depends: ffmpeg-v4l2-request-fourier (>= 2:8.1+rfourier), libdrm2
 Recommends: daedalus-v4l2-dkms
 Maintainer: Markus Fritsche <mfritsche@reauktion.de>
 Homepage: https://git.reauktion.de/reauktion/daedalus-v4l2
 Description: Userspace daemon for the daedalus_v4l2 stateless decoder shim
 daedalus-v4l2 ships the userspace daemon that backs the daedalus_v4l2
 out-of-tree V4L2 kernel module on Raspberry Pi 5 / CM5.  Together they
 expose /dev/videoNN + /dev/mediaNN as a V4L2 stateless decoder for
 VP9, AV1, and H.264 — actual decoding happens in this single-threaded
 daemon via dlopen'd FFmpeg, with decoded NV12 / P010 frames shipped
 back through dmabuf.
 .
 Consumed end-to-end by libva-v4l2-request-fourier (>= 1.0.0+r376) so
 that 'ffmpeg -hwaccel vaapi' against vp9_small.ivf produces a
 byte-exact NV12 frame.
 .
 The kernel module ships separately in daedalus-v4l2-dkms; install
 both to actually serve V4L2 clients.
 EOF
 DEB_OUT="daedalus-v4l2_${PKGVER}-${PKGREL}_arm64.deb"
 dpkg-deb --root-owner-group --build "$ROOT" "$HERE/$DEB_OUT"
 echo "built: $HERE/$DEB_OUT"
@@ -0,0 +1,38 @@
 daedalus-v4l2 (0.1.0+r18+g481279c-1) bookworm trixie; urgency=medium
  * Bump to 481279c.  Upstream landed the systemd unit + modules-load.d
    drop-in (packaging/systemd/daedalus-v4l2.{service,modules-load}).
  * Package now ships /lib/systemd/system/daedalus-v4l2.service and
    /usr/lib/modules-load.d/daedalus-v4l2.conf.
  * postinst: daemon-reload, enable the service, trigger
    systemd-modules-load, and start if /dev/daedalus-v4l2 is already
    present.  Operator no longer needs to remember the modprobe +
    systemctl-enable dance after install.
  * prerm/postrm: stop + disable + daemon-reload.
 -- Markus Fritsche <mfritsche@reauktion.de>  Wed, 20 May 2026 16:00:00 +0000
 daedalus-v4l2 (0.1.0+r17+gf0cd29a-1) bookworm trixie; urgency=medium
  * Bump to f0cd29a alongside daedalus-v4l2-dkms.  No userspace
    change — the daemon binary in this release is bit-identical to
    the f55b2cd one (the f0cd29a commit only touches kernel/).  Bump
    keeps the userspace + DKMS pkgver lockstep so depmod /
    LIBVA_DRIVER_NAME selection stays correct on hosts that
    upgrade.
 -- Markus Fritsche <mfritsche@reauktion.de>  Tue, 20 May 2026 10:30:00 +0000
 daedalus-v4l2 (0.1.0+r16+gf55b2cd-1) bookworm trixie; urgency=medium
  * Initial Debian packaging for the daedalus-v4l2 userspace daemon.
  * Pinned to f55b2cd (Phase 8.13 close): first commit where the full
    ffmpeg -hwaccel vaapi → libva-v4l2-request-fourier → /dev/video0
    → daemon path lands a pixel-correct decoded NV12 frame back in
    ffmpeg.
  * Codecs: VP9, AV1, H.264 (all via dlopen'd FFmpeg 7.1.3).
  * Capture formats: NV12M (2 plane), NV12 (1 plane, for libva),
    P010 (10-bit single plane).
  * Companion package: daedalus-v4l2-dkms (kernel module).
 -- Markus Fritsche <mfritsche@reauktion.de>  Mon, 18 May 2026 23:00:00 +0000
@@ -0,0 +1,34 @@
 Source: daedalus-v4l2
 Section: video
 Priority: optional
 Maintainer: Markus Fritsche <mfritsche@reauktion.de>
 Build-Depends: debhelper-compat (= 13),
               cmake,
               ninja-build,
               pkg-config,
               libavformat-dev (>= 7.1),
               libavcodec-dev (>= 7.1),
               libavutil-dev (>= 7.1)
 Standards-Version: 4.6.2
 Homepage: https://git.reauktion.de/reauktion/daedalus-v4l2
 Package: daedalus-v4l2
 Architecture: arm64
 Depends: ${misc:Depends}, ${shlibs:Depends},
         ffmpeg (>= 7.1),
         libdrm2
 Recommends: daedalus-v4l2-dkms
 Description: Userspace daemon for the daedalus_v4l2 stateless decoder shim
 daedalus-v4l2 ships the userspace daemon that backs the daedalus_v4l2
 out-of-tree V4L2 kernel module on Raspberry Pi 5 / CM5. Together they
 expose /dev/videoNN + /dev/mediaNN as a V4L2 stateless decoder for
 VP9, AV1, and H.264 — actual decoding happens in this single-threaded
 daemon via dlopen'd FFmpeg, with decoded NV12 / P010 frames shipped
 back through dmabuf.
 .
 Consumed end-to-end by libva-v4l2-request-fourier (>= 1.0.0+r376) so
 that 'ffmpeg -hwaccel vaapi' against vp9_small.ivf produces a
 byte-exact NV12 frame.
 .
 The kernel module ships separately in daedalus-v4l2-dkms; install
 both to actually serve V4L2 clients.
@@ -0,0 +1,40 @@
 Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
 Upstream-Name: daedalus-v4l2
 Upstream-Contact: Markus Fritsche <fritsche.markus@gmail.com>
 Source: https://git.reauktion.de/reauktion/daedalus-v4l2
 Files: *
 Copyright: 2026 Markus Fritsche <fritsche.markus@gmail.com>
 License: BSD-2-Clause
 Files: include/daedalus_v4l2_proto.h
 Copyright: 2026 Markus Fritsche <fritsche.markus@gmail.com>
 License: GPL-2.0-or-later WITH Linux-syscall-note
 Comment:
 Shared kernel↔daemon wire-protocol header. GPL-2.0-or-later (matches
 the kernel module that includes it) with the standard
 Linux-syscall-note exception so userspace inclusion is BSD-clean.
 License: BSD-2-Clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions
 are met:
 .
 1. Redistributions of source code must retain the above copyright
    notice, this list of conditions and the following disclaimer.
 2. Redistributions in binary form must reproduce the above copyright
    notice, this list of conditions and the following disclaimer in
    the documentation and/or other materials provided with the
    distribution.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES ARE DISCLAIMED.
 License: GPL-2.0-or-later
 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; either version 2 of the License, or
 (at your option) any later version.
 .
 On Debian systems, the complete text of the GNU General Public
 License v2 can be found in `/usr/share/common-licenses/GPL-2'.
@@ -0,0 +1,166 @@
 --- a/libavutil/hwcontext_v4l2request.c
 +++ b/libavutil/hwcontext_v4l2request.c
@@ -19,12 +19,13 @@
 #include "config.h"
 #include <fcntl.h>
 #include <linux/dma-buf.h>
 #include <linux/media.h>
 #include <sys/ioctl.h>
 +#include <sys/stat.h>
 #include <sys/mman.h>
 #include <unistd.h>
 #include <drm_fourcc.h>
 #include <libudev.h>
@@ -690,12 +691,125 @@
     }
     udev_enumerate_unref(enumerate);
     return ret;
 }
 +/*
 + * Brute-force fallback used when libudev's scan fails (e.g. inside firefox's
 + * RDD sandbox where Mozilla's broker rejects fd-relative openat used by
 + * systemd's chase() symlink resolver). Iterates /dev/video[0..63], picks the
 + * one whose major/minor matches the requested devnum.
 + */
 +static char *v4l2request_devnum_to_video_path_brute(dev_t devnum)
 +{
 +    char path[32];
 +    struct stat st;
 +    for (int i = 0; i < 64; i++) {
 +        snprintf(path, sizeof(path), "/dev/video%d", i);
 +        if (stat(path, &st) < 0)
 +            continue;
 +        if (st.st_rdev == devnum)
 +            return av_strdup(path);
 +    }
 +    return NULL;
 +}
 +
 +/* Brute-force version of v4l2request_probe_video_devices: replaces the
 + * udev_device_new_from_devnum + udev_device_get_devnode flow with
 + * stat()-based major/minor matching against /dev/video[0..63]. */
 +static int v4l2request_probe_video_devices_brute(AVHWFramesContext *hwfc,
 +                                                 uint32_t pixelformat,
 +                                                 uint32_t buffersize)
 +{
 +    AVV4L2RequestFramesContext *fctx = hwfc->hwctx;
 +    AVV4L2RequestFramesContextInternal *fctxi = fctx->internal;
 +    struct media_device_info device_info;
 +    struct media_v2_topology topology = {0};
 +    struct media_v2_interface *interfaces;
 +    char *path;
 +    dev_t devnum;
 +    int ret;
 +
 +    if (ioctl(fctxi->media_fd, MEDIA_IOC_DEVICE_INFO, &device_info) < 0)
 +        return AVERROR(errno);
 +
 +    if (ioctl(fctxi->media_fd, MEDIA_IOC_G_TOPOLOGY, &topology) < 0)
 +        return AVERROR(errno);
 +
 +    if (!topology.num_interfaces)
 +        return AVERROR(ENOENT);
 +
 +    interfaces = av_calloc(topology.num_interfaces,
 +                           sizeof(struct media_v2_interface));
 +    if (!interfaces)
 +        return AVERROR(ENOMEM);
 +
 +    topology.ptr_interfaces = (__u64)(uintptr_t)interfaces;
 +    if (ioctl(fctxi->media_fd, MEDIA_IOC_G_TOPOLOGY, &topology) < 0) {
 +        ret = AVERROR(errno);
 +        goto fail;
 +    }
 +
 +    ret = AVERROR(ENOENT);
 +    for (unsigned i = 0; i < topology.num_interfaces; i++) {
 +        if (interfaces[i].intf_type != MEDIA_INTF_T_V4L_VIDEO)
 +            continue;
 +
 +        devnum = makedev(interfaces[i].devnode.major,
 +                         interfaces[i].devnode.minor);
 +        path = v4l2request_devnum_to_video_path_brute(devnum);
 +        if (!path)
 +            continue;
 +
 +        ret = v4l2request_probe_video_device(hwfc, path, pixelformat, buffersize);
 +        if (!ret) {
 +            av_log(hwfc, AV_LOG_INFO,
 +                   "Using V4L2 media driver %s (brute-force) for %s\n",
 +                   device_info.driver, av_fourcc2str(pixelformat));
 +            av_free(path);
 +            break;
 +        }
 +        av_free(path);
 +    }
 +
 +fail:
 +    av_free(interfaces);
 +    return ret;
 +}
 +
 +/* Brute-force fallback for v4l2request_probe_media_devices(). Iterates
 + * /dev/media[0..15], opens each, probes via topology+stat. */
 +static int v4l2request_probe_media_devices_brute(AVHWFramesContext *hwfc,
 +                                                 uint32_t pixelformat,
 +                                                 uint32_t buffersize)
 +{
 +    AVV4L2RequestFramesContext *fctx = hwfc->hwctx;
 +    AVV4L2RequestFramesContextInternal *fctxi = fctx->internal;
 +    char path[32];
 +    int ret = AVERROR(ENOENT);
 +
 +    for (int i = 0; i < 16; i++) {
 +        snprintf(path, sizeof(path), "/dev/media%d", i);
 +
 +        fctxi->media_fd = open(path, O_RDWR);
 +        if (fctxi->media_fd < 0)
 +            continue;
 +
 +        ret = v4l2request_probe_video_devices_brute(hwfc, pixelformat,
 +                                                    buffersize);
 +        if (!ret)
 +            return 0;
 +
 +        close(fctxi->media_fd);
 +        fctxi->media_fd = -1;
 +    }
 +
 +    return ret;
 +}
 +
 static int v4l2request_open_decoder(AVHWFramesContext *hwfc)
 {
     AVV4L2RequestFramesContext *fctx = hwfc->hwctx;
     uint32_t buffersize;
     struct udev *udev;
     int ret;
@@ -712,12 +826,23 @@
     buffersize = FFMAX(hwfc->width * hwfc->height * 3 / 2, 256 * 1024);
     // Probe all media devices (auto-detection)
     ret = v4l2request_probe_media_devices(hwfc, udev, fctx->pixelformat, buffersize);
 +    // Brute-force fallback when libudev fails. Firefox-fourier hits this
 +    // because Mozilla's RDD sandbox blocks fd-relative openat used by
 +    // systemd's chase() symlink resolver inside udev_enumerate_scan_devices.
 +    if (ret < 0) {
 +        av_log(hwfc, AV_LOG_INFO,
 +               "libudev probe failed (%d), falling back to brute-force /dev/media*\n",
 +               ret);
 +        ret = v4l2request_probe_media_devices_brute(hwfc, fctx->pixelformat,
 +                                                    buffersize);
 +    }
 +
     udev_unref(udev);
     return ret;
 }
 static AVBufferRef *v4l2request_v4l2_buffer_alloc(AVHWFramesContext *hwfc,
                                                   struct v4l2_format *format)
@@ -0,0 +1,178 @@
 From 0cd6e669735e453ec8772f111065bbb2f70a5bc6 Mon Sep 17 00:00:00 2001
 From: Markus Fritsche <mfritsche@reauktion.de>
 Date: Mon, 18 May 2026 07:27:10 +0000
 Subject: [PATCH] avutil/hwcontext_v4l2request: unpack NV15 to P010 in
 transfer_data_from
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 V4L2_PIX_FMT_NV15 (RK3399/RK3588 rkvdec 10-bit 4:2:0 capture) is mapped to
 sw_format = AV_PIX_FMT_YUV420P10 in v4l2request_capture_pixelformats[]. The
 existing transfer_get_formats explicitly blanked the format list for that
 sw_format, so 'ffmpeg -hwaccel v4l2request -vf hwdownload,format=p010le' on
 a Hi10P / Main10 input failed at filter init with EINVAL before reaching
 the actual decode (which itself succeeds — 2 frames decoded cleanly).
 Expose AV_PIX_FMT_P010 as the transfer target for NV15-backed surfaces and
 unpack the packed 10-bit samples into the standard high-bits-of-16 layout
 inside transfer_data_from. Luma and chroma share the same packing format
 (5 bytes per 4 samples, little endian); chroma plane is W × H/2 samples
 for 4:2:0.
 The other 'needs custom unpack' sw_formats (YUV420P / Allwinner NV12_32L32
 tiled and YUV422P10 / rkvdec NV20) keep the original ENOSYS path because
 they need different unpack code that isn't covered by this patch.
 Closes marfrit/marfrit-packages#21.
 ---
 libavutil/hwcontext_v4l2request.c | 111 +++++++++++++++++++++++++++++-
 1 file changed, 110 insertions(+), 1 deletion(-)
 diff --git a/libavutil/hwcontext_v4l2request.c b/libavutil/hwcontext_v4l2request.c
 index b6633d9081..3842160dfb 100644
 --- a/libavutil/hwcontext_v4l2request.c
 +++ b/libavutil/hwcontext_v4l2request.c
@@ -1073,6 +1073,56 @@ fail:
     return ret;
 }
 +/*
 + * Unpack one NV15-packed 10-bit plane (5 bytes per 4 samples, little endian)
 + * into a P010-style plane (10 bits in the high bits of a 16-bit container).
 + * `dst_stride` is in bytes; `src_stride` is bytes per row of NV15 data.
 + */
 +static void v4l2request_nv15_unpack_plane_to_p010(const uint8_t *src,
 +                                                  uint16_t *dst,
 +                                                  unsigned width,
 +                                                  unsigned height,
 +                                                  unsigned src_stride,
 +                                                  unsigned dst_stride)
 +{
 +    for (unsigned y = 0; y < height; y++) {
 +        const uint8_t *s = src + y * src_stride;
 +        uint16_t *d = (uint16_t *)((uint8_t *)dst + y * dst_stride);
 +        unsigned x;
 +
 +        for (x = 0; x + 4 <= width; x += 4) {
 +            uint16_t a = (uint16_t)s[0] | ((uint16_t)(s[1] & 0x03) << 8);
 +            uint16_t b = ((uint16_t)s[1] >> 2) | ((uint16_t)(s[2] & 0x0F) << 6);
 +            uint16_t c = ((uint16_t)s[2] >> 4) | ((uint16_t)(s[3] & 0x3F) << 4);
 +            uint16_t e = ((uint16_t)s[3] >> 6) | ((uint16_t)s[4] << 2);
 +
 +            d[0] = (uint16_t)(a << 6);
 +            d[1] = (uint16_t)(b << 6);
 +            d[2] = (uint16_t)(c << 6);
 +            d[3] = (uint16_t)(e << 6);
 +
 +            d += 4;
 +            s += 5;
 +        }
 +
 +        if (x < width) {
 +            unsigned rem = width - x;
 +            uint16_t pix[4] = { 0, 0, 0, 0 };
 +
 +            pix[0] = (uint16_t)s[0] | ((uint16_t)(s[1] & 0x03) << 8);
 +            if (rem >= 2)
 +                pix[1] = ((uint16_t)s[1] >> 2) | ((uint16_t)(s[2] & 0x0F) << 6);
 +            if (rem >= 3)
 +                pix[2] = ((uint16_t)s[2] >> 4) | ((uint16_t)(s[3] & 0x3F) << 4);
 +            if (rem >= 4)
 +                pix[3] = ((uint16_t)s[3] >> 6) | ((uint16_t)s[4] << 2);
 +
 +            for (unsigned j = 0; j < rem; j++)
 +                d[j] = (uint16_t)(pix[j] << 6);
 +        }
 +    }
 +}
 +
 static int v4l2request_transfer_get_formats(AVHWFramesContext *hwfc,
                                             enum AVHWFrameTransferDirection dir,
                                             enum AVPixelFormat **formats)
@@ -1082,6 +1132,22 @@ static int v4l2request_transfer_get_formats(AVHWFramesContext *hwfc,
     if (dir == AV_HWFRAME_TRANSFER_DIRECTION_TO)
         return AVERROR(ENOSYS);
 +    /*
 +     * NV15-backed surfaces (sw_format = YUV420P10) are exposed as P010 to
 +     * downstream filters: the unpack below converts the packed 10-bit
 +     * samples into the standard high-bits-of-16 layout. Hi10P / Main10
 +     * VAAPI/v4l2-request decode reaches userspace through this path.
 +     */
 +    if (hwfc->sw_format == AV_PIX_FMT_YUV420P10) {
 +        fmts = av_malloc_array(2, sizeof(*fmts));
 +        if (!fmts)
 +            return AVERROR(ENOMEM);
 +        fmts[0] = AV_PIX_FMT_P010;
 +        fmts[1] = AV_PIX_FMT_NONE;
 +        *formats = fmts;
 +        return 0;
 +    }
 +
     fmts = av_malloc_array(2, sizeof(*fmts));
     if (!fmts)
         return AVERROR(ENOMEM);
@@ -1089,8 +1155,13 @@ static int v4l2request_transfer_get_formats(AVHWFramesContext *hwfc,
     fmts[0] = hwfc->sw_format;
     fmts[1] = AV_PIX_FMT_NONE;
 +    /*
 +     * Tiled-NV12-32L32 (Allwinner) and NV20 (rkvdec 4:2:2 10-bit) still need
 +     * dedicated unpacks before hwdownload can consume them; leave them as
 +     * "no transfer formats" so the filter graph reports the limitation
 +     * rather than silently producing garbage.
 +     */
     if (hwfc->sw_format == AV_PIX_FMT_YUV420P ||
 -        hwfc->sw_format == AV_PIX_FMT_YUV420P10 ||
         hwfc->sw_format == AV_PIX_FMT_YUV422P10)
         fmts[0] = AV_PIX_FMT_NONE;
@@ -1110,6 +1181,44 @@ static int v4l2request_transfer_data_from(AVHWFramesContext *hwfc,
     map = av_frame_alloc();
     if (!map)
         return AVERROR(ENOMEM);
 +
 +    /*
 +     * For NV15→P010, map the raw NV15 bytes (sw_format) and unpack into
 +     * dst's P010 storage. Otherwise fall through to the original byte-copy
 +     * path used for 1:1 sw_format matches (NV12, NV16, AFBC handled by DRM).
 +     */
 +    if (hwfc->sw_format == AV_PIX_FMT_YUV420P10) {
 +        /*
 +         * Only P010 is advertised by transfer_get_formats for this sw_format;
 +         * a caller that bypasses get_formats and asks for anything else would
 +         * silently corrupt output via av_frame_copy on NV15-packed bytes.
 +         * Reject explicitly.
 +         */
 +        if (dst->format != AV_PIX_FMT_P010) {
 +            ret = AVERROR(ENOSYS);
 +            goto fail;
 +        }
 +
 +        map->format = hwfc->sw_format;
 +        ret = v4l2request_map_frame(hwfc, map, src);
 +        if (ret)
 +            goto fail;
 +
 +        v4l2request_nv15_unpack_plane_to_p010(map->data[0],
 +                                              (uint16_t *)dst->data[0],
 +                                              dst->width, dst->height,
 +                                              map->linesize[0],
 +                                              dst->linesize[0]);
 +        /* NV15 chroma plane is W × H/2 samples (4:2:0, UV interleaved). */
 +        v4l2request_nv15_unpack_plane_to_p010(map->data[1],
 +                                              (uint16_t *)dst->data[1],
 +                                              dst->width, dst->height / 2,
 +                                              map->linesize[1],
 +                                              dst->linesize[1]);
 +        ret = 0;
 +        goto fail;
 +    }
 +
     map->format = dst->format;
     ret = v4l2request_map_frame(hwfc, map, src);
 -- 
 2.47.3
@@ -0,0 +1,221 @@
 #!/bin/bash
 # Build ffmpeg-v4l2-request-fourier_<ver>_arm64.deb (the Kwiboo FFmpeg
 # fork with the V4L2-Request API hwaccel patches).
 #
 # Mirror of arch/ffmpeg-v4l2-request-fourier into the Debian tree.
 # Provides the patched `ffmpeg` + `ffprobe` binaries plus the shared
 # libav* libraries with v4l2-request support, so consumers like
 # mpv-fourier (and the kdirect bit-exact reference test rig) work
 # end-to-end without a stock-Debian FFmpeg fallback.
 #
 # **Private prefix /opt/fourier** (Path A per fourier-debian
 # architecture discussion 2026-05-19).  Stock Debian trixie ships
 # FFmpeg 7.1.x = libavcodec.so.61; this package ships FFmpeg 8.1 =
 # libavcodec.so.62 — different SOVERSION, NOT a drop-in for trixie's
 # KDE/VLC/etc.  Living in /opt/fourier/lib keeps the stock system
 # intact; only fourier-aware consumers (firefox-fourier, mpv-fourier,
 # daedalus-v4l2) RPATH into /opt/fourier/lib.  Postinst drops an
 # ld.so.conf.d entry so dlopen-based consumers (firefox at runtime)
 # find the libs by SONAME without LD_LIBRARY_PATH wrappers.
 #
 # Big build: 25-40 min on a runner.  Output is a single .deb that
 # bundles ffmpeg/ffprobe + libavcodec.so.62 + libavformat.so.62 etc.
 # all together — no split per-library subpackages.  Easier to consume,
 # trades off finer-grained downgrades.
 #
 # Sibling Arch package: ../../arch/ffmpeg-v4l2-request-fourier/PKGBUILD
 # Upstream: https://github.com/Kwiboo/FFmpeg (branch v4l2-request-n8.1)
 set -euo pipefail
 # Same pin as arch/ — v4l2-request-n8.1 tip 2026-04-24.
 UPSTREAM_COMMIT=b57fbbe50c9b2656fad86a1a7eeabfd2b2a50935
 FFMPEG_VERSION=8.1
 # epoch 2 matches Debian's stock ffmpeg (currently 7:7.1.x in trixie);
 # +rfourier suffix to avoid colliding with upstream/Debian rebuilds.
 PKGVER=2:${FFMPEG_VERSION}+rfourier+gb57fbbe
 PKGREL=2  # pkgrel=2 — Path A move to /opt/fourier prefix (2026-05-19)
 HERE=$(dirname "$(readlink -f "$0")")
 # Reproducible build.  2026-05-18 23:00 UTC — Phase 8.13 close.
 export SOURCE_DATE_EPOCH=1779231600
 work=$(mktemp -d)
 trap "rm -rf $work" EXIT
 cd "$work"
 git clone --depth 1 \
    --branch v4l2-request-n8.1 \
    https://github.com/Kwiboo/FFmpeg.git FFmpeg
 cd FFmpeg
 # git fetch the specific commit (depth=1 of branch tip might not be it)
 if [ "$(git rev-parse HEAD)" != "$UPSTREAM_COMMIT" ]; then
    git fetch origin "$UPSTREAM_COMMIT"
    git checkout "$UPSTREAM_COMMIT"
 fi
 # Apply patches (same as Arch).
 patch -Np1 -i "$HERE/0001-libudev-bypass-fallback.patch"
 patch -Np1 -i "$HERE/0002-nv15-to-p010-unpack.patch"
 # Configure with Arch-parity flags.  Drops the same set of features
 # (X11, AMF, CUDA, FireWire, AviSynth, Bluray, OpenMPT, JPEG-XL,
 # Theora, XVid, rsvg, soxr, ssh, vidstab, modplug, SDL2, Vulkan,
 # JACK, GSM, Speex) — not needed on the Fourier fleet, keeps the .deb
 # smaller and the dependency graph tighter.
 ./configure \
    --prefix=/opt/fourier \
    --bindir=/opt/fourier/bin \
    --libdir=/opt/fourier/lib \
    --shlibdir=/opt/fourier/lib \
    --incdir=/opt/fourier/include \
    --datadir=/opt/fourier/share/ffmpeg \
    --mandir=/opt/fourier/share/man \
    --extra-ldexeflags='-Wl,-rpath,/opt/fourier/lib' \
    --extra-ldsoflags='-Wl,-rpath,/opt/fourier/lib' \
    --disable-debug \
    --disable-static \
    --disable-doc \
    --disable-stripping \
    --enable-shared \
    --enable-gpl \
    --enable-version3 \
    --enable-pic \
    --enable-neon \
    --arch=aarch64 \
    --enable-libdrm \
    --enable-libv4l2 \
    --enable-libudev \
    --enable-v4l2-request \
    --enable-v4l2_m2m \
    --enable-vaapi \
    --enable-opengl \
    --enable-gnutls \
    --enable-fontconfig \
    --enable-libass \
    --enable-libfreetype \
    --enable-libfribidi \
    --enable-libxml2 \
    --enable-libpulse \
    --enable-libdav1d \
    --enable-libopus \
    --enable-libvorbis \
    --enable-libmp3lame \
    --enable-libvpx \
    --enable-libx264 \
    --enable-libx265 \
    --enable-libwebp \
    --host-cflags='-fPIC'
 make -j"$(nproc)"
 make tools/qt-faststart
 # Stage
 ROOT="$work/pkgroot"
 make DESTDIR="$ROOT" install
 install -Dm755 tools/qt-faststart "$ROOT/opt/fourier/bin/qt-faststart"
 # ld.so.conf.d entry so dlopen-based consumers (firefox-fourier at
 # runtime) find /opt/fourier/lib/libavcodec.so.62 by SONAME without an
 # LD_LIBRARY_PATH wrapper.  No risk of contaminating stock binaries:
 # stock KDE/VLC link against libavcodec.so.61 (different SONAME), so
 # the loader never sees our .so.62 as a match for their .so.61.
 install -Dm644 /dev/stdin "$ROOT/etc/ld.so.conf.d/fourier.conf" <<EOF
 # fourier campaign: FFmpeg 8.1 fork + libVA fork in private prefix.
 /opt/fourier/lib
 EOF
 # Optional /usr/bin shims so users can call ffmpeg-fourier without
 # remembering the /opt path.  No conflict with stock /usr/bin/ffmpeg.
 install -d "$ROOT/usr/bin"
 ln -sf /opt/fourier/bin/ffmpeg   "$ROOT/usr/bin/ffmpeg-fourier"
 ln -sf /opt/fourier/bin/ffprobe  "$ROOT/usr/bin/ffprobe-fourier"
 # Doc
 mkdir -p "$ROOT/usr/share/doc/ffmpeg-v4l2-request-fourier" "$ROOT/DEBIAN"
 install -Dm644 "$HERE/debian/copyright" \
    "$ROOT/usr/share/doc/ffmpeg-v4l2-request-fourier/copyright"
 install -Dm644 "$HERE/debian/changelog" \
    "$ROOT/usr/share/doc/ffmpeg-v4l2-request-fourier/changelog.Debian"
 gzip -9 -n "$ROOT/usr/share/doc/ffmpeg-v4l2-request-fourier/changelog.Debian"
 cat > "$ROOT/DEBIAN/control" <<EOF
 Package: ffmpeg-v4l2-request-fourier
 Version: ${PKGVER}-${PKGREL}
 Section: video
 Priority: optional
 Architecture: arm64
 Depends: libc6,
         libdrm2,
         libfontconfig1,
         libfreetype6,
         libfribidi0,
         libxml2,
         libpulse0,
         libdav1d7 | libdav1d6,
         libopus0,
         libvorbis0a,
         libvorbisenc2,
         libmp3lame0,
         libvpx9 | libvpx8 | libvpx7,
         libx264-164 | libx264-163,
         libx265-215 | libx265-209 | libx265-199,
         libwebp7 | libwebp6,
         libwebpmux3,
         libass9,
         libgnutls30,
         libudev1,
         libv4l-0,
         libva2,
         libva-drm2
 Maintainer: Markus Fritsche <mfritsche@reauktion.de>
 Homepage: https://github.com/Kwiboo/FFmpeg
 Description: FFmpeg with V4L2 Request API hwaccel (Kwiboo fork, /opt/fourier prefix)
 FFmpeg ${FFMPEG_VERSION} patched with the V4L2 Request API stateless
 video decoder hwaccel — Kwiboo's long-running rebase of Jernej
 Škrabec's v4l2-request patchset onto FFmpeg release tags.
 .
 Provides 'ffmpeg -hwaccel v4l2request' / '-hwaccel drm' routes that
 drive rkvdec / hantro / cedrus / rpi-hevc-dec / daedalus_v4l2
 stateless decoders directly through libavcodec's hwdevice DRM path,
 bypassing libva.  Used by mpv-fourier and firefox-fourier as their
 backing FFmpeg, and as the kdirect bit-exact reference in libva-v4l2-
 request-fourier validation.
 .
 INSTALLED TO /opt/fourier (NOT /usr): this is FFmpeg 8.1 (libav*.so.62)
 sitting alongside Debian trixie's stock FFmpeg 7.1 (libav*.so.61) —
 different SONAMEs, no symbol clash.  Consumer binaries RPATH into
 /opt/fourier/lib; ld.so.conf.d/fourier.conf adds the path to ld.so
 cache for dlopen-by-SONAME (firefox).  /usr/bin/ffmpeg-fourier and
 /usr/bin/ffprobe-fourier are convenience symlinks to /opt/fourier/bin.
 Stock 'ffmpeg' command unaffected.
 .
 Drops X11/AMF/CUDA/Bluray/JACK/Vulkan/SDL2/Theora/XVid/Speex/JPEG-XL
 per Fourier fleet policy (Wayland + ARM + video-decode focus).
 No 'ffplay' binary; mpv-fourier covers interactive playback.
 EOF
 # ldconfig must be re-run after install so /opt/fourier/lib is in the cache.
 cat > "$ROOT/DEBIAN/postinst" <<'PEOF'
 #!/bin/sh
 set -e
 if [ "$1" = "configure" ]; then
    ldconfig
 fi
 #DEBHELPER#
 PEOF
 chmod 755 "$ROOT/DEBIAN/postinst"
 cat > "$ROOT/DEBIAN/postrm" <<'PEOF'
 #!/bin/sh
 set -e
 if [ "$1" = "remove" ] || [ "$1" = "purge" ]; then
    ldconfig
 fi
 #DEBHELPER#
 PEOF
 chmod 755 "$ROOT/DEBIAN/postrm"
 DEB_OUT="ffmpeg-v4l2-request-fourier_${PKGVER//:/%3a}-${PKGREL}_arm64.deb"
 dpkg-deb --root-owner-group --build "$ROOT" "$HERE/$DEB_OUT"
 echo "built: $HERE/$DEB_OUT"
@@ -0,0 +1,14 @@
 ffmpeg-v4l2-request-fourier (2:8.1+rfourier+gb57fbbe-1) bookworm trixie; urgency=medium
  * Initial Debian packaging for the Kwiboo FFmpeg fork with V4L2
    Request API hwaccel patches.
  * Mirror of arch/ffmpeg-v4l2-request-fourier (same pin b57fbbe,
    same configure flags, same 2 patches: libudev-bypass-fallback +
    nv15-to-p010-unpack).
  * Drop-in replacement for Debian's stock ffmpeg + libav*; takes
    epoch 2 to win the apt version comparison.
  * Required by mpv-fourier and firefox-fourier; not strictly
    required for the VAAPI-only path on daedalus-v4l2 hosts (stock
    libva + Debian ffmpeg works there).
 -- Markus Fritsche <mfritsche@reauktion.de>  Mon, 18 May 2026 23:00:00 +0000
@@ -0,0 +1,61 @@
 Source: ffmpeg-v4l2-request-fourier
 Section: video
 Priority: optional
 Maintainer: Markus Fritsche <mfritsche@reauktion.de>
 Build-Depends: debhelper-compat (= 13),
               git,
               nasm,
               pkg-config,
               libass-dev,
               libdrm-dev,
               libfontconfig1-dev,
               libfreetype6-dev,
               libfribidi-dev,
               libgnutls28-dev,
               libmp3lame-dev,
               libopus-dev,
               libpulse-dev,
               libudev-dev,
               libv4l-dev,
               libva-dev,
               libvorbis-dev,
               libvpx-dev,
               libwebp-dev,
               libx264-dev,
               libx265-dev,
               libxml2-dev,
               libdav1d-dev,
               linux-libc-dev
 Standards-Version: 4.6.2
 Homepage: https://github.com/Kwiboo/FFmpeg
 Package: ffmpeg-v4l2-request-fourier
 Architecture: arm64
 Depends: ${misc:Depends}, ${shlibs:Depends}
 Conflicts: ffmpeg,
           libavcodec61, libavformat61, libavutil59,
           libswresample5, libswscale8, libavdevice61, libavfilter10,
           libpostproc58
 Replaces: ffmpeg,
          libavcodec61, libavformat61, libavutil59,
          libswresample5, libswscale8, libavdevice61, libavfilter10,
          libpostproc58
 Provides: ffmpeg (= ${binary:Version}),
          libavcodec.so.61,
          libavformat.so.61,
          libavutil.so.59
 Description: FFmpeg with V4L2 Request API hwaccel (Kwiboo fork)
 FFmpeg 8.1 patched with the V4L2 Request API stateless video decoder
 hwaccel — Kwiboo's long-running rebase of Jernej Škrabec's
 v4l2-request patchset onto FFmpeg release tags.
 .
 Provides 'ffmpeg -hwaccel v4l2request' / '-hwaccel drm' routes that
 drive rkvdec / hantro / cedrus / rpi-hevc-dec / daedalus_v4l2
 stateless decoders directly through libavcodec's hwdevice DRM path,
 bypassing libva. Used by mpv-fourier and firefox-fourier as their
 backing FFmpeg, and as the kdirect bit-exact reference in
 libva-v4l2-request-fourier validation.
 .
 Drops X11/AMF/CUDA/Bluray/JACK/Vulkan/SDL2/Theora/XVid/Speex/JPEG-XL
 per Fourier fleet policy (Wayland + ARM + video-decode focus). No
 'ffplay' binary; mpv-fourier covers interactive playback.
@@ -0,0 +1,21 @@
 Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
 Upstream-Name: FFmpeg (Kwiboo v4l2-request fork)
 Upstream-Contact: Niklas Haas <niklas@haasn.dev>, Jernej Škrabec, Kwiboo
 Source: https://github.com/Kwiboo/FFmpeg
 Files: *
 Copyright: 2000-2026 The FFmpeg developers
 License: GPL-3.0-or-later
 Files: 0001-libudev-bypass-fallback.patch 0002-nv15-to-p010-unpack.patch
 Copyright: 2024-2026 Markus Fritsche <fritsche.markus@gmail.com>
 License: GPL-3.0-or-later
 License: GPL-3.0-or-later
 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; either version 3 of the License, or
 (at your option) any later version.
 .
 On Debian systems, the complete text of the GNU General Public
 License v3 can be found in `/usr/share/common-licenses/GPL-3'.
@@ -0,0 +1,74 @@
 #!/bin/bash
 # Build libva-v4l2-request-fourier_<ver>_arm64.deb.
 #
 # Compiles the libva ICD from the marfrit/libva-v4l2-request-fourier
 # tip pinned in PKGVER below.  Mirrors arch/libva-v4l2-request-fourier
 # (Arch Linux build).  Output is a single arm64 .deb that ships the
 # VA-API driver as /usr/lib/aarch64-linux-gnu/dri/v4l2_request_drv_video.so.
 #
 # Sibling Arch package: ../../arch/libva-v4l2-request-fourier/PKGBUILD
 # Upstream fork: https://git.reauktion.de/marfrit/libva-v4l2-request-fourier
 set -euo pipefail
 # Same pin as the Arch PKGBUILD.  de27e95 = "v4l2: log error_idx +
 # failing ctrl id on S_EXT_CTRLS failure" (Phase 8.13 diagnostic).
 UPSTREAM_COMMIT=de27e95571b67ef34619c23a12db4698f9b3454e
 PKGVER=1.0.0+r376+gde27e95
 PKGREL=1
 HERE=$(dirname "$(readlink -f "$0")")
 # Reproducible build.  2026-05-18 23:00 UTC — Phase 8.13 close.
 export SOURCE_DATE_EPOCH=1779231600
 work=$(mktemp -d)
 trap "rm -rf $work" EXIT
 cd "$work"
 curl -sSLfo libva-fourier.tar.gz \
    "https://git.reauktion.de/marfrit/libva-v4l2-request-fourier/archive/${UPSTREAM_COMMIT}.tar.gz"
 tar xzf libva-fourier.tar.gz
 SRCDIR=$(echo libva-v4l2-request-fourier)
 cd "$SRCDIR"
 meson setup build \
    --buildtype=release \
    --prefix=/usr \
    --libdir=lib/aarch64-linux-gnu \
    -Db_lto=false
 meson compile -C build
 ROOT="$work/pkgroot"
 DESTDIR="$ROOT" meson install -C build
 # Strip any non-package debug, then drop dependencies + control.
 install -Dm644 "$HERE/debian/copyright" "$ROOT/usr/share/doc/libva-v4l2-request-fourier/copyright"
 install -Dm644 "$HERE/debian/changelog" "$ROOT/usr/share/doc/libva-v4l2-request-fourier/changelog.Debian"
 gzip -9 -n "$ROOT/usr/share/doc/libva-v4l2-request-fourier/changelog.Debian"
 mkdir -p "$ROOT/DEBIAN"
 cat > "$ROOT/DEBIAN/control" <<EOF
 Package: libva-v4l2-request-fourier
 Version: ${PKGVER}-${PKGREL}
 Section: libs
 Priority: optional
 Architecture: arm64
 Depends: libva2, libdrm2
 Conflicts: libva-v4l2-request
 Replaces: libva-v4l2-request
 Provides: libva-driver, libva-v4l2-request (= ${PKGVER}-${PKGREL})
 Maintainer: Markus Fritsche <mfritsche@reauktion.de>
 Homepage: https://git.reauktion.de/marfrit/libva-v4l2-request-fourier
 Description: VA-API backend for V4L2 stateless decoders (fourier fork)
 LibVA implementation for the Linux Video4Linux2 Request API, multiplanar
 fork of bootlin/libva-v4l2-request.  Drives rkvdec / hantro / cedrus /
 rpi-hevc-dec / daedalus_v4l2 stateless decoders for H.264, HEVC, VP8,
 VP9, AV1, and MPEG-2.
 .
 Auto-detected by VAAPI consumers (ffmpeg -hwaccel vaapi, mpv --hwdec=vaapi,
 Firefox VAAPI accel) when LIBVA_DRIVER_NAME=v4l2_request is set.
 EOF
 DEB_OUT="libva-v4l2-request-fourier_${PKGVER}-${PKGREL}_arm64.deb"
 dpkg-deb --root-owner-group --build "$ROOT" "$HERE/$DEB_OUT"
 echo "built: $HERE/$DEB_OUT"
@@ -0,0 +1,15 @@
 libva-v4l2-request-fourier (1.0.0+r376+gde27e95-1) bookworm trixie; urgency=medium
  * Initial Debian packaging (sibling to existing
    arch/libva-v4l2-request-fourier).
  * Pinned to fork tip de27e95: "v4l2: log error_idx + failing ctrl id
    on S_EXT_CTRLS failure" — Phase 8.13 diagnostic that surfaced the
    real root cause of the libva→daedalus_v4l2 request-completion
    timeout.
  * Includes daedalus_v4l2 probe slot (b5b3acf) and meson option gate
    (2146341) for the Pi 5 daemon-backed decoder shim.
  * Backward-compatible on rkvdec / hantro / cedrus / rpi-hevc-dec
    hosts — daedalus probe is off by default unless the kernel module
    is present.
 -- Markus Fritsche <mfritsche@reauktion.de>  Mon, 18 May 2026 23:00:00 +0000
@@ -0,0 +1,27 @@
 Source: libva-v4l2-request-fourier
 Section: libs
 Priority: optional
 Maintainer: Markus Fritsche <mfritsche@reauktion.de>
 Build-Depends: debhelper-compat (= 13),
               libva-dev,
               libdrm-dev,
               meson (>= 0.43),
               ninja-build,
               pkg-config
 Standards-Version: 4.6.2
 Homepage: https://git.reauktion.de/marfrit/libva-v4l2-request-fourier
 Package: libva-v4l2-request-fourier
 Architecture: arm64
 Depends: ${misc:Depends}, ${shlibs:Depends}, libva2, libdrm2
 Conflicts: libva-v4l2-request
 Replaces: libva-v4l2-request
 Provides: libva-driver, libva-v4l2-request (= ${binary:Version})
 Description: VA-API backend for V4L2 stateless decoders (fourier fork)
 LibVA implementation for the Linux Video4Linux2 Request API, multiplanar
 fork of bootlin/libva-v4l2-request. Drives rkvdec / hantro / cedrus /
 rpi-hevc-dec / daedalus_v4l2 stateless decoders for H.264, HEVC, VP8,
 VP9, AV1, and MPEG-2.
 .
 Auto-detected by VAAPI consumers (ffmpeg -hwaccel vaapi, mpv --hwdec=vaapi,
 Firefox VAAPI accel) when LIBVA_DRIVER_NAME=v4l2_request is set.
@@ -0,0 +1,38 @@
 Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
 Upstream-Name: libva-v4l2-request-fourier
 Upstream-Contact: Markus Fritsche <fritsche.markus@gmail.com>
 Source: https://git.reauktion.de/marfrit/libva-v4l2-request-fourier
 Comment:
 Fork of bootlin/libva-v4l2-request with multi-codec / multi-device
 enhancements for the fourier campaign (RK3399 / RK3588 / RK3566 / BCM2712).
 Per-file SPDX headers are the canonical declaration; this summary
 covers the aggregate.
 Files: *
 Copyright: 2018 Paul Kocialkowski <paul.kocialkowski@bootlin.com>
           2018-2026 The libva-v4l2-request authors
           2024-2026 Markus Fritsche <fritsche.markus@gmail.com>
 License: LGPL-2.1+ or MIT
 License: LGPL-2.1+
 This package is free software; you can redistribute it and/or
 modify it under the terms of the GNU Lesser General Public
 License as published by the Free Software Foundation; either
 version 2.1 of the License, or (at your option) any later version.
 .
 On Debian systems, the complete text of the GNU Lesser General
 Public License v2.1 can be found in `/usr/share/common-licenses/LGPL-2.1'.
 License: MIT
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the
 "Software"), to deal in the Software without restriction, including
 without limitation the rights to use, copy, modify, merge, publish,
 distribute, sublicense, and/or sell copies of the Software, and to
 permit persons to whom the Software is furnished to do so, subject
 to the following conditions:
 .
 The above copyright notice and this permission notice shall be
 included in all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND.
@@ -0,0 +1,56 @@
 From 9d3bbd3651eb8405b8609e4f5e8c4978056483d0 Mon Sep 17 00:00:00 2001
 From: Jonas Karlman <jonas@kwiboo.se>
 Date: Sun, 18 Aug 2024 17:42:14 -0700
 Subject: [PATCH 1/2] meson: add detection logic for v4l2request support
 We will probably adjust this to look for a specific libavutil version after
 v4l2request support is merged upstream, but this check is fine for now.
 ---
 meson.build   | 11 +++++++++++
 meson.options |  1 +
 2 files changed, 12 insertions(+)
 diff --git a/meson.build b/meson.build
 index d4c75a907f..540f279dc7 100644
 --- a/meson.build
 +++ b/meson.build
@@ -1444,6 +1444,16 @@ if features['ios-gl']
     sources += files('video/out/hwdec/hwdec_ios_gl.m')
 endif
 +v4l2request = get_option('v4l2request').require(
 +    cc.has_header_symbol('libavutil/hwcontext.h',
 +                         'AV_HWDEVICE_TYPE_V4L2REQUEST',
 +                         dependencies: libavutil)
 +)
 +features += {'v4l2request': v4l2request.allowed()}
 +if features['v4l2request']
 +    sources += files('video/v4l2request.c')
 +endif
 +
 libva = dependency('libva', version: '>= 1.1.0', required: get_option('vaapi'))
 vaapi_drm = dependency('libva-drm', version: '>= 1.1.0', required:
@@ -1911,6 +1921,7 @@ summary({'cocoa': features['cocoa'] and features['swift'],
          'libmpv': get_option('libmpv'),
          'lua': features['lua'],
          'opengl': features['gl'],
 +         'v4l2request': features['v4l2request'],
          'vulkan': features['vulkan'],
          'wayland': features['wayland'],
          'x11': features['x11']},
 diff --git a/meson.options b/meson.options
 index 836d16d03f..54ec2dccfc 100644
 --- a/meson.options
 +++ b/meson.options
@@ -103,6 +103,7 @@ option('d3d-hwaccel', type: 'feature', value: 'auto', description: 'D3D11VA hwac
 option('d3d9-hwaccel', type: 'feature', value: 'auto', description: 'DXVA2 hwaccel')
 option('gl-dxinterop-d3d9', type: 'feature', value: 'auto', description: 'OpenGL/DirectX DXVA2 hwaccel')
 option('ios-gl', type: 'feature', value: 'auto', description: 'iOS OpenGL ES interop support')
 +option('v4l2request', type: 'feature', value: 'auto', description: 'V4L2 Request API hwaccel')
 option('videotoolbox-gl', type: 'feature', value: 'auto', description: 'Videotoolbox with OpenGL')
 option('videotoolbox-pl', type: 'feature', value: 'auto', description: 'Videotoolbox with libplacebo')
 -- 
 2.52.0
@@ -0,0 +1,81 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Markus Fritsche <fritsche.markus@gmail.com>
 Date: Fri, 8 May 2026 23:30:00 +0000
 Subject: [PATCH] vo_dmabuf_wayland: explicit DMA_BUF_IOCTL_SYNC on import fds
 V4L2 does not attach implicit fences (dma_resv) to CAPTURE buffers
 on VIDIOC_DQBUF. When the buffer is forwarded to a Wayland compositor
 that imports it via wl_dmabuf and samples in the GPU, the GPU may
 read from physical memory before the producer's writes have flushed,
 producing all-zero output (manifests as solid green for BT.601
 limited-range YUV(0,0,0) -> RGB(0, 135, 0) on the consumer side).
 Issue an explicit DMA_BUF_IOCTL_SYNC(SYNC_START|SYNC_RW) +
 SYNC_END(SYNC_RW) round-trip on each unique dma_buf fd before
 zwp_linux_buffer_params_v1_add(). This invokes the producer driver's
 dma_buf_ops->begin_cpu_access / end_cpu_access, which on most ARM
 SoCs flushes write buffers and synchronizes coherent memory before
 the compositor's GPU import.
 This is a userspace workaround. Root cause is the missing implicit
 fence on V4L2 CAPTURE DQBUF and is being addressed upstream via
 the vb2_dma_resv RFC.
 Without this patch, on RK3566 (hantro VPU + Mali-G52 panfrost +
 KDE Plasma 6 / KWin 6.6.4), `mpv --hwdec=vaapi --vo=dmabuf-wayland`
 shows solid green frames for all hardware-decoded content. With
 this patch, decoded frames are presented correctly.
 Signed-off-by: Markus Fritsche <fritsche.markus@gmail.com>
 ---
 diff --git a/video/out/vo_dmabuf_wayland.c b/video/out/vo_dmabuf_wayland.c
 index 6b7c511..16e3d18 100644
 --- a/video/out/vo_dmabuf_wayland.c
 +++ b/video/out/vo_dmabuf_wayland.c
@@ -27,6 +27,12 @@
 #include <va/va_drmcommon.h>
 #endif
 +/* fourier patch: explicit dma_buf cache sync workaround for missing
 + * implicit-fence on V4L2 stateless CAPTURE buffers. Applies to both
 + * VAAPI and DRMPrime import paths. */
 +#include <linux/dma-buf.h>
 +#include <sys/ioctl.h>
 +
 #include "gpu/hwdec.h"
 #include "gpu/video.h"
 #include "mpv_talloc.h"
@@ -205,6 +211,14 @@ static void vaapi_dmabuf_importer(struct buffer *buf, struct mp_image *src,
         buf->drm_format = 0;
         goto done;
     }
 +    /* fourier patch: explicit cache coherency sync on each dma_buf fd
 +     * before submitting to the compositor. See top-of-file comment. */
 +    for (int obj_no = 0; obj_no < desc.num_objects; obj_no++) {
 +        struct dma_buf_sync sync = { .flags = DMA_BUF_SYNC_START | DMA_BUF_SYNC_RW };
 +        (void)ioctl(desc.objects[obj_no].fd, DMA_BUF_IOCTL_SYNC, &sync);
 +        sync.flags = DMA_BUF_SYNC_END | DMA_BUF_SYNC_RW;
 +        (void)ioctl(desc.objects[obj_no].fd, DMA_BUF_IOCTL_SYNC, &sync);
 +    }
     for (int plane_no = 0; plane_no < desc.layers[layer_no].num_planes; ++plane_no) {
         int object = desc.layers[layer_no].object_index[plane_no];
         uint64_t modifier = desc.objects[object].drm_format_modifier;
@@ -258,6 +272,16 @@ static void drmprime_dmabuf_importer(struct buffer *buf, struct mp_image *src,
         return;
     buf->id = drmprime_surface_id(src);
 +
 +    /* fourier patch: explicit cache coherency sync on each dma_buf fd
 +     * before submitting to the compositor. See top-of-file comment. */
 +    for (int obj_no = 0; obj_no < desc->nb_objects; obj_no++) {
 +        struct dma_buf_sync sync = { .flags = DMA_BUF_SYNC_START | DMA_BUF_SYNC_RW };
 +        (void)ioctl(desc->objects[obj_no].fd, DMA_BUF_IOCTL_SYNC, &sync);
 +        sync.flags = DMA_BUF_SYNC_END | DMA_BUF_SYNC_RW;
 +        (void)ioctl(desc->objects[obj_no].fd, DMA_BUF_IOCTL_SYNC, &sync);
 +    }
 +
     for (layer_no = 0; layer_no < desc->nb_layers; layer_no++) {
         AVDRMLayerDescriptor layer = desc->layers[layer_no];
 -- 
 2.51.0
@@ -0,0 +1,435 @@
 From dd1e1fd6fe884d66c49dc26af715e1423c7471a3 Mon Sep 17 00:00:00 2001
 From: Philip Langdale <philipl@overt.org>
 Date: Sun, 18 Aug 2024 17:43:41 -0700
 Subject: [PATCH 2/2] vo: hwdec: drmprime: add separate hwdecs for v4l2request
 With all the machinery in place, we can now add the v4l2request hwdecs with a
 different hw device type, and a different initialisation path. This applies to
 both the drmprime and drmprime_overlay hwdecs.
 At the moment, the device initialisation is done in the bare minimum way, but
 it can be extended to take a device path (for example) if that makes sense as
 we better understand what meaningful configuration will be.
 Co-authored-by: Jonas Karlman <jonas@kwiboo.se>
 ---
 video/hwdec.c                            |   3 +
 video/hwdec.h                            |   1 +
 video/out/gpu/hwdec.c                    |   6 ++
 video/out/hwdec/hwdec_drmprime.c         | 125 +++++++++++++++++------
 video/out/hwdec/hwdec_drmprime_overlay.c |  81 +++++++++++++--
 video/out/vo_dmabuf_wayland.c            |   1 +
 video/v4l2request.c                      |  34 ++++++
 7 files changed, 210 insertions(+), 41 deletions(-)
 create mode 100644 video/v4l2request.c
 diff --git a/video/hwdec.c b/video/hwdec.c
 index deba518e82..de2ffecc40 100644
 --- a/video/hwdec.c
 +++ b/video/hwdec.c
@@ -125,6 +125,9 @@ static const struct hwcontext_fns *const hwcontext_fns[] = {
 #if HAVE_DRM
     &hwcontext_fns_drmprime,
 #endif
 +#if HAVE_V4L2REQUEST
 +    &hwcontext_fns_v4l2request,
 +#endif
 #if HAVE_VAAPI
     &hwcontext_fns_vaapi,
 #endif
 diff --git a/video/hwdec.h b/video/hwdec.h
 index e7734e5d7e..bf337389cb 100644
 --- a/video/hwdec.h
 +++ b/video/hwdec.h
@@ -119,6 +119,7 @@ extern const struct hwcontext_fns hwcontext_fns_cuda;
 extern const struct hwcontext_fns hwcontext_fns_d3d11;
 extern const struct hwcontext_fns hwcontext_fns_drmprime;
 extern const struct hwcontext_fns hwcontext_fns_dxva2;
 +extern const struct hwcontext_fns hwcontext_fns_v4l2request;
 extern const struct hwcontext_fns hwcontext_fns_vaapi;
 extern const struct hwcontext_fns hwcontext_fns_vdpau;
 diff --git a/video/out/gpu/hwdec.c b/video/out/gpu/hwdec.c
 index be39c507d0..f50b927851 100644
 --- a/video/out/gpu/hwdec.c
 +++ b/video/out/gpu/hwdec.c
@@ -38,6 +38,8 @@ extern const struct ra_hwdec_driver ra_hwdec_drmprime;
 extern const struct ra_hwdec_driver ra_hwdec_drmprime_overlay;
 extern const struct ra_hwdec_driver ra_hwdec_aimagereader;
 extern const struct ra_hwdec_driver ra_hwdec_vulkan;
 +extern const struct ra_hwdec_driver ra_hwdec_v4l2request;
 +extern const struct ra_hwdec_driver ra_hwdec_v4l2request_overlay;
 const struct ra_hwdec_driver *const ra_hwdec_drivers[] = {
 #if HAVE_D3D_HWACCEL
@@ -73,6 +75,10 @@ const struct ra_hwdec_driver *const ra_hwdec_drivers[] = {
     &ra_hwdec_drmprime,
     &ra_hwdec_drmprime_overlay,
 #endif
 +#if HAVE_V4L2REQUEST
 +    &ra_hwdec_v4l2request,
 +    &ra_hwdec_v4l2request_overlay,
 +#endif
 #if HAVE_ANDROID_MEDIA_NDK
     &ra_hwdec_aimagereader,
 #endif
 diff --git a/video/out/hwdec/hwdec_drmprime.c b/video/out/hwdec/hwdec_drmprime.c
 index 7869eb124a..446f63de44 100644
 --- a/video/out/hwdec/hwdec_drmprime.c
 +++ b/video/out/hwdec/hwdec_drmprime.c
@@ -77,7 +77,7 @@ static const char *forked_pix_fmt_names[] = {
     "rpi4_10",
 };
 -static int init(struct ra_hwdec *hw)
 +static int pre_init(struct ra_hwdec *hw)
 {
     struct priv_owner *p = hw->priv;
@@ -92,36 +92,12 @@ static int init(struct ra_hwdec *hw)
         return -1;
     }
 -    /*
 -     * The drm_params resource is not provided when using X11 or Wayland, but
 -     * there are extensions that supposedly provide this information from the
 -     * drivers. Not properly documented. Of course.
 -     */
 -    mpv_opengl_drm_params_v2 *params = ra_get_native_resource(hw->ra_ctx->ra,
 -                                                              "drm_params_v2");
 -
 -    /*
 -     * Respect drm_device option, so there is a way to control this when not
 -     * using a DRM gpu context. If drm_params_v2 are present, they will already
 -     * respect this option.
 -     */
 -    void *tmp = talloc_new(NULL);
 -    struct drm_opts *drm_opts = mp_get_config_group(tmp, hw->global, &drm_conf);
 -    const char *opt_path = drm_opts->device_path;
 -
 -    const char *device_path = params && params->render_fd > -1 ?
 -                              drmGetRenderDeviceNameFromFd(params->render_fd) :
 -                              opt_path ? opt_path : "/dev/dri/renderD128";
 -    MP_VERBOSE(hw, "Using DRM device: %s\n", device_path);
 +    return 0;
 +}
 -    int ret = av_hwdevice_ctx_create(&p->hwctx.av_device_ref,
 -                                     AV_HWDEVICE_TYPE_DRM,
 -                                     device_path, NULL, 0);
 -    talloc_free(tmp);
 -    if (ret != 0) {
 -        MP_VERBOSE(hw, "Failed to create hwdevice_ctx: %s\n", av_err2str(ret));
 -        return -1;
 -    }
 +static int post_init(struct ra_hwdec *hw)
 +{
 +    struct priv_owner *p = hw->priv;
     /*
      * At the moment, there is no way to discover compatible formats
@@ -154,6 +130,75 @@ static int init(struct ra_hwdec *hw)
     return 0;
 }
 +static int init_drmprime(struct ra_hwdec *hw)
 +{
 +    struct priv_owner *p = hw->priv;
 +
 +    int ret = pre_init(hw);
 +    if (ret < 0)
 +        return ret;
 +
 +    /*
 +     * The drm_params resource is not provided when using X11 or Wayland, but
 +     * there are extensions that supposedly provide this information from the
 +     * drivers. Not properly documented. Of course.
 +     */
 +    mpv_opengl_drm_params_v2 *params = ra_get_native_resource(hw->ra_ctx->ra,
 +                                                              "drm_params_v2");
 +
 +    /*
 +     * Respect drm_device option, so there is a way to control this when not
 +     * using a DRM gpu context. If drm_params_v2 are present, they will already
 +     * respect this option.
 +     */
 +    void *tmp = talloc_new(NULL);
 +    struct drm_opts *drm_opts = mp_get_config_group(tmp, hw->global, &drm_conf);
 +    const char *opt_path = drm_opts->device_path;
 +
 +    const char *device_path = params && params->render_fd > -1 ?
 +                              drmGetRenderDeviceNameFromFd(params->render_fd) :
 +                              opt_path ? opt_path : "/dev/dri/renderD128";
 +    MP_VERBOSE(hw, "Using DRM device: %s\n", device_path);
 +
 +    ret = av_hwdevice_ctx_create(&p->hwctx.av_device_ref,
 +                                 AV_HWDEVICE_TYPE_DRM,
 +                                 device_path, NULL, 0);
 +    talloc_free(tmp);
 +    if (ret < 0) {
 +        MP_VERBOSE(hw, "Failed to create hwdevice_ctx: %s\n", av_err2str(ret));
 +        return ret;
 +    }
 +
 +    return post_init(hw);
 +}
 +
 +#if HAVE_V4L2REQUEST
 +static int init_v4l2request(struct ra_hwdec *hw)
 +{
 +    struct priv_owner *p = hw->priv;
 +
 +    int ret = pre_init(hw);
 +    if (ret < 0)
 +        return ret;
 +
 +    /*
 +     * AVCodecHWConfig contains a combo of a pixel format and hwdevice type,
 +     * correct type must be created here or hwaccel will fail.
 +     *
 +     * FIXME: Create hwdevice based on type in AVCodecHWConfig
 +     */
 +    ret = av_hwdevice_ctx_create(&p->hwctx.av_device_ref,
 +                                 AV_HWDEVICE_TYPE_V4L2REQUEST,
 +                                 NULL, NULL, 0);
 +    if (ret < 0) {
 +        MP_VERBOSE(hw, "Failed to create hwdevice_ctx: %s\n", av_err2str(ret));
 +        return ret;
 +    }
 +
 +    return post_init(hw);
 +}
 +#endif
 +
 static void mapper_unmap(struct ra_hwdec_mapper *mapper)
 {
     struct priv_owner *p_owner = mapper->owner->priv;
@@ -308,7 +353,7 @@ const struct ra_hwdec_driver ra_hwdec_drmprime = {
     .priv_size = sizeof(struct priv_owner),
     .imgfmts = {IMGFMT_DRMPRIME, 0},
     .device_type = AV_HWDEVICE_TYPE_DRM,
 -    .init = init,
 +    .init = init_drmprime,
     .uninit = uninit,
     .mapper = &(const struct ra_hwdec_mapper_driver){
         .priv_size = sizeof(struct dmabuf_interop_priv),
@@ -318,3 +363,21 @@ const struct ra_hwdec_driver ra_hwdec_drmprime = {
         .unmap = mapper_unmap,
     },
 };
 +
 +#if HAVE_V4L2REQUEST
 +const struct ra_hwdec_driver ra_hwdec_v4l2request = {
 +    .name = "v4l2request",
 +    .priv_size = sizeof(struct priv_owner),
 +    .imgfmts = {IMGFMT_DRMPRIME, 0},
 +    .device_type = AV_HWDEVICE_TYPE_V4L2REQUEST,
 +    .init = init_v4l2request,
 +    .uninit = uninit,
 +    .mapper = &(const struct ra_hwdec_mapper_driver){
 +        .priv_size = sizeof(struct dmabuf_interop_priv),
 +        .init = mapper_init,
 +        .uninit = mapper_uninit,
 +        .map = mapper_map,
 +        .unmap = mapper_unmap,
 +    },
 +};
 +#endif
 diff --git a/video/out/hwdec/hwdec_drmprime_overlay.c b/video/out/hwdec/hwdec_drmprime_overlay.c
 index 61514f8e89..689e9b04e5 100644
 --- a/video/out/hwdec/hwdec_drmprime_overlay.c
 +++ b/video/out/hwdec/hwdec_drmprime_overlay.c
@@ -246,7 +246,7 @@ static void uninit(struct ra_hwdec *hw)
     }
 }
 -static int init(struct ra_hwdec *hw)
 +static int pre_init(struct ra_hwdec *hw)
 {
     struct priv *p = hw->priv;
     int draw_plane, drmprime_video_plane;
@@ -267,15 +267,15 @@ static int init(struct ra_hwdec *hw)
                                            drm_params->connector_id, draw_plane, drmprime_video_plane);
         if (!p->ctx) {
             mp_err(p->log, "Failed to retrieve DRM atomic context.\n");
 -            goto err;
 +            return -1;
         }
         if (!p->ctx->drmprime_video_plane) {
             mp_warn(p->log, "No drmprime video plane. You might need to specify it manually using --drm-drmprime-video-plane\n");
 -            goto err;
 +            return -1;
         }
     } else {
         mp_verbose(p->log, "Failed to retrieve DRM fd from native display.\n");
 -        goto err;
 +        return -1;
     }
     drmModeCrtcPtr crtc;
@@ -289,7 +289,7 @@ static int init(struct ra_hwdec *hw)
     uint64_t has_prime;
     if (drmGetCap(p->ctx->fd, DRM_CAP_PRIME, &has_prime) < 0) {
         MP_ERR(hw, "Card does not support prime handles.\n");
 -        goto err;
 +        return -1;
     }
     if (has_prime) {
@@ -298,19 +298,67 @@ static int init(struct ra_hwdec *hw)
     disable_video_plane(hw);
 +    return 0;
 +}
 +
 +static int init_drmprime(struct ra_hwdec *hw)
 +{
 +    struct priv *p = hw->priv;
 +
 +    int ret = pre_init(hw);
 +    if (ret < 0)
 +        goto err;
 +
     p->hwctx = (struct mp_hwdec_ctx) {
         .driver_name = hw->driver->name,
         .hw_imgfmt = IMGFMT_DRMPRIME,
     };
     char *device = drmGetDeviceNameFromFd2(p->ctx->fd);
 -    int ret = av_hwdevice_ctx_create(&p->hwctx.av_device_ref,
 -                                     AV_HWDEVICE_TYPE_DRM, device, NULL, 0);
 +    ret = av_hwdevice_ctx_create(&p->hwctx.av_device_ref,
 +                                 AV_HWDEVICE_TYPE_DRM, device, NULL, 0);
     if (device)
         free(device);
 -    if (ret != 0) {
 +    if (ret < 0) {
 +        MP_VERBOSE(hw, "Failed to create hwdevice_ctx: %s\n", av_err2str(ret));
 +        goto err;
 +    }
 +
 +    hwdec_devices_add(hw->devs, &p->hwctx);
 +
 +    return 0;
 +
 +err:
 +    uninit(hw);
 +    return ret;
 +}
 +
 +#if HAVE_V4L2REQUEST
 +static int init_v4l2request(struct ra_hwdec *hw)
 +{
 +    struct priv *p = hw->priv;
 +
 +    int ret = pre_init(hw);
 +    if (ret < 0)
 +        goto err;
 +
 +    p->hwctx = (struct mp_hwdec_ctx) {
 +        .driver_name = hw->driver->name,
 +        .hw_imgfmt = IMGFMT_DRMPRIME,
 +    };
 +
 +    /*
 +     * AVCodecHWConfig contains a combo of a pixel format and hwdevice type,
 +     * correct type must be created here or hwaccel will fail.
 +     *
 +     * FIXME: Create hwdevice based on type in AVCodecHWConfig
 +     */
 +    ret = av_hwdevice_ctx_create(&p->hwctx.av_device_ref,
 +                                 AV_HWDEVICE_TYPE_V4L2REQUEST,
 +                                 NULL, NULL, 0);
 +    if (ret < 0) {
         MP_VERBOSE(hw, "Failed to create hwdevice_ctx: %s\n", av_err2str(ret));
         goto err;
     }
@@ -321,15 +369,28 @@ static int init(struct ra_hwdec *hw)
 err:
     uninit(hw);
 -    return -1;
 +    return ret;
 }
 +#endif
 const struct ra_hwdec_driver ra_hwdec_drmprime_overlay = {
     .name = "drmprime-overlay",
     .priv_size = sizeof(struct priv),
     .imgfmts = {IMGFMT_DRMPRIME, 0},
     .device_type = AV_HWDEVICE_TYPE_DRM,
 -    .init = init,
 +    .init = init_drmprime,
 +    .overlay_frame = overlay_frame,
 +    .uninit = uninit,
 +};
 +
 +#if HAVE_V4L2REQUEST
 +const struct ra_hwdec_driver ra_hwdec_v4l2request_overlay = {
 +    .name = "v4l2request-overlay",
 +    .priv_size = sizeof(struct priv),
 +    .imgfmts = {IMGFMT_DRMPRIME, 0},
 +    .device_type = AV_HWDEVICE_TYPE_V4L2REQUEST,
 +    .init = init_v4l2request,
     .overlay_frame = overlay_frame,
     .uninit = uninit,
 };
 +#endif
 diff --git a/video/out/vo_dmabuf_wayland.c b/video/out/vo_dmabuf_wayland.c
 index 9b06643544..6d62849568 100644
 --- a/video/out/vo_dmabuf_wayland.c
 +++ b/video/out/vo_dmabuf_wayland.c
@@ -860,6 +860,7 @@ static int preinit(struct vo *vo)
     // Initialize all possible hwdec drivers.
     ra_hwdec_ctx_init(&p->hwdec_ctx, vo->hwdec_devs, "vaapi", false);
     ra_hwdec_ctx_init(&p->hwdec_ctx, vo->hwdec_devs, "drmprime", false);
 +    ra_hwdec_ctx_init(&p->hwdec_ctx, vo->hwdec_devs, "v4l2request", false);
     p->src = (struct mp_rect){0, 0, 0, 0};
     return 0;
 diff --git a/video/v4l2request.c b/video/v4l2request.c
 new file mode 100644
 index 0000000000..2aa4d14fea
 --- /dev/null
 +++ b/video/v4l2request.c
@@ -0,0 +1,34 @@
 +/*
 + * This file is part of mpv.
 + *
 + * mpv is free software; you can redistribute it and/or
 + * modify it under the terms of the GNU Lesser General Public
 + * License as published by the Free Software Foundation; either
 + * version 2.1 of the License, or (at your option) any later version.
 + *
 + * mpv is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU Lesser General Public License for more details.
 + *
 + * You should have received a copy of the GNU Lesser General Public
 + * License along with mpv.  If not, see <http://www.gnu.org/licenses/>.
 + */
 +
 +#include <libavutil/hwcontext.h>
 +
 +#include "hwdec.h"
 +
 +static struct AVBufferRef *v4l2request_create_standalone(struct mpv_global *global,
 +        struct mp_log *log, struct hwcontext_create_dev_params *params)
 +{
 +    AVBufferRef* ref = NULL;
 +    av_hwdevice_ctx_create(&ref, AV_HWDEVICE_TYPE_V4L2REQUEST, NULL, NULL, 0);
 +
 +    return ref;
 +}
 +
 +const struct hwcontext_fns hwcontext_fns_v4l2request = {
 +    .av_hwdevice_type = AV_HWDEVICE_TYPE_V4L2REQUEST,
 +    .create_dev = v4l2request_create_standalone,
 +};
 -- 
 2.52.0
@@ -0,0 +1,134 @@
 #!/bin/bash
 # Build mpv-fourier_<ver>_arm64.deb (mpv with v4l2request hwdec wiring +
 # vo_dmabuf_wayland cache-sync fix).
 #
 # Mirror of arch/mpv-fourier into the Debian tree.  Same source pin
 # (mpv 0.41.0), same 3 patches, same meson options.
 #
 # Depends on ffmpeg-v4l2-request-fourier for the libavcodec backing
 # library — the v4l2request hwdec mpv now offers requires
 # AV_HWDEVICE_TYPE_V4L2REQUEST which only exists in Kwiboo's FFmpeg
 # fork, not in Debian stock ffmpeg.
 #
 # Conflicts: mpv — drop-in replacement.  Pi 5 / CM5 hosts using stock
 # Firefox + VAAPI don't need this; the firefox-fourier / kdirect
 # bench-test paths do.
 #
 # Sibling Arch package: ../../arch/mpv-fourier/PKGBUILD
 # Sibling FFmpeg package: ../ffmpeg-v4l2-request-fourier/build-deb.sh
 # Upstream: https://github.com/mpv-player/mpv
 set -euo pipefail
 MPV_VERSION=0.41.0
 PKGVER=1:${MPV_VERSION}+rfourier
 PKGREL=1
 MPV_TARBALL_SHA256=ee21092a5ee427353392360929dc64645c54479aefdb5babc5cfbb5fad626209
 HERE=$(dirname "$(readlink -f "$0")")
 # Reproducible build.  2026-05-18 23:00 UTC — Phase 8.13 close.
 export SOURCE_DATE_EPOCH=1779231600
 work=$(mktemp -d)
 trap "rm -rf $work" EXIT
 cd "$work"
 curl -sSLfo mpv.tar.gz \
    "https://github.com/mpv-player/mpv/archive/v${MPV_VERSION}/mpv-${MPV_VERSION}.tar.gz"
 echo "$MPV_TARBALL_SHA256  mpv.tar.gz" | sha256sum -c
 tar xzf mpv.tar.gz
 cd "mpv-${MPV_VERSION}"
 # Apply the 3 fourier patches.
 patch -p1 < "$HERE/0001-meson-add-detection-logic-for-v4l2request-support.patch"
 patch -p1 < "$HERE/0002-vo-hwdec-drmprime-add-separate-hwdecs-for-v4l2reques.patch"
 patch -p1 < "$HERE/0001-vo_dmabuf_wayland-explicit-cache-sync-on-import-fd.patch"
 # Configure.  Same shape as arch/mpv-fourier's meson options.
 meson setup build \
    --prefix=/usr \
    --libdir=lib/aarch64-linux-gnu \
    --buildtype=release \
    --auto-features=auto \
    -Dv4l2request=enabled \
    -Dlibmpv=true \
    -Dgl-x11=enabled \
    -Dcaca=disabled \
    -Dcdda=enabled \
    -Ddrm=enabled \
    -Ddvbin=enabled \
    -Ddvdnav=enabled \
    -Dlibarchive=enabled \
    -Dopenal=enabled \
    -Dsdl2-audio=enabled \
    -Dsdl2-video=enabled \
    -Dsdl2-gamepad=enabled
 meson compile -C build -j"$(nproc)"
 # Stage
 ROOT="$work/pkgroot"
 DESTDIR="$ROOT" meson install -C build
 # Drop private linkage entries from the .pc (only matter for static linking).
 sed -i -e '/Requires.private/d' -e '/Libs.private/d' \
    "$ROOT/usr/lib/aarch64-linux-gnu/pkgconfig/mpv.pc"
 # Docs
 mkdir -p "$ROOT/usr/share/doc/mpv-fourier" "$ROOT/DEBIAN"
 install -m 644 DOCS/encoding.rst "$ROOT/usr/share/doc/mpv-fourier/"
 install -m 644 DOCS/tech-overview.txt "$ROOT/usr/share/doc/mpv-fourier/"
 install -Dm644 "$HERE/debian/copyright" "$ROOT/usr/share/doc/mpv-fourier/copyright"
 install -Dm644 "$HERE/debian/changelog" "$ROOT/usr/share/doc/mpv-fourier/changelog.Debian"
 gzip -9 -n "$ROOT/usr/share/doc/mpv-fourier/changelog.Debian"
 # TOOLS scripts
 mkdir -p "$ROOT/usr/share/mpv/scripts"
 install -m 644 TOOLS/umpv TOOLS/mpv_identify.sh TOOLS/stats-conv.py TOOLS/idet.sh \
    "$ROOT/usr/share/mpv/scripts/" 2>/dev/null || true
 [ -d TOOLS/lua ] && cp TOOLS/lua/* "$ROOT/usr/share/mpv/scripts/" 2>/dev/null || true
 cat > "$ROOT/DEBIAN/control" <<EOF
 Package: mpv-fourier
 Version: ${PKGVER}-${PKGREL}
 Section: video
 Priority: optional
 Architecture: arm64
 Depends: ffmpeg-v4l2-request-fourier (>= 2:8.1+rfourier),
         libc6, libdrm2,
         libass9, libbluray2, libcdio19, libcdio-paranoia2,
         libdvdnav4, libdvdread8,
         libegl1, libgl1, libjpeg62-turbo | libjpeg62,
         libplacebo338 | libplacebo208,
         libpulse0, libsixel1, libluajit-5.1-2,
         libmujs3 | libmujs2 | libmujs1,
         libpipewire-0.3-0, librubberband2, libsdl2-2.0-0,
         libopenal1, libuchardet0, libvulkan1,
         libwayland-client0, libwayland-egl1, libwayland-cursor0,
         libxkbcommon0, libxext6, libxpresent1,
         libxrandr2, libxss1, libxv1, libx11-6,
         zlib1g
 Conflicts: mpv, libmpv2, libmpv1
 Replaces: mpv, libmpv2, libmpv1
 Provides: mpv (= ${PKGVER}-${PKGREL}), libmpv.so.2
 Maintainer: Markus Fritsche <mfritsche@reauktion.de>
 Homepage: https://mpv.io/
 Description: mpv media player with V4L2-Request hwdec (fourier fork)
 mpv ${MPV_VERSION} patched with:
   - Kwiboo + Langdale v4l2request hwdec wiring (meson detection +
     vo_hwdec_drmprime separate hwdec instance for AV_HWDEVICE_TYPE_
     V4L2REQUEST) so '--hwdec=v4l2request' actually engages on
     dmabuf-wayland.
   - vo_dmabuf_wayland explicit DMA_BUF_IOCTL_SYNC on import fds
     (iter1 of dmabuf-modifier-triage) — workaround for missing
     implicit-fence on V4L2 stateless CAPTURE buffers.  Fixes the
     KWin-on-RK3566 dark-green chroma readback regression on ohm.
 .
 Requires ffmpeg-v4l2-request-fourier as the backing libavcodec.
 Stock Debian ffmpeg does not provide AV_HWDEVICE_TYPE_V4L2REQUEST.
 EOF
 DEB_OUT="mpv-fourier_${PKGVER//:/%3a}-${PKGREL}_arm64.deb"
 dpkg-deb --root-owner-group --build "$ROOT" "$HERE/$DEB_OUT"
 echo "built: $HERE/$DEB_OUT"
@@ -0,0 +1,12 @@
 mpv-fourier (1:0.41.0+rfourier-1) bookworm trixie; urgency=medium
  * Initial Debian packaging for mpv with the fourier-umbrella patches.
  * Mirror of arch/mpv-fourier (same source tarball pin 0.41.0,
    same 3 patches: v4l2request meson detection, drmprime hwdec
    wiring, vo_dmabuf_wayland explicit cache-sync).
  * Depends on ffmpeg-v4l2-request-fourier (>= 2:8.1+rfourier) — the
    v4l2request hwdec requires AV_HWDEVICE_TYPE_V4L2REQUEST which
    only exists in Kwiboo's FFmpeg fork.
  * Drop-in replacement for Debian's stock mpv; takes epoch 1.
 -- Markus Fritsche <mfritsche@reauktion.de>  Mon, 18 May 2026 23:00:00 +0000
@@ -0,0 +1,70 @@
 Source: mpv-fourier
 Section: video
 Priority: optional
 Maintainer: Markus Fritsche <mfritsche@reauktion.de>
 Build-Depends: debhelper-compat (= 13),
               meson (>= 1.0),
               ninja-build,
               pkg-config,
               python3-docutils,
               ffmpeg-v4l2-request-fourier (>= 2:8.1+rfourier),
               libdrm-dev,
               libass-dev,
               libbluray-dev,
               libcdio-dev,
               libcdio-paranoia-dev,
               libdvdnav-dev,
               libdvdread-dev,
               libegl-dev,
               libgl-dev,
               libjpeg-dev,
               libplacebo-dev,
               libpulse-dev,
               libsixel-dev,
               libluajit-5.1-dev,
               libmujs-dev,
               libpipewire-0.3-dev,
               librubberband-dev,
               libsdl2-dev,
               libopenal-dev,
               libuchardet-dev,
               libvulkan-dev,
               libwayland-dev,
               wayland-protocols,
               libxkbcommon-dev,
               libxext-dev,
               libxpresent-dev,
               libxrandr-dev,
               libxss-dev,
               libxv-dev,
               libx11-dev,
               libv4l-dev,
               libudev-dev,
               libsystemd-dev,
               libarchive-dev,
               libxml2-dev,
               libdvbpsi-dev,
               zlib1g-dev
 Standards-Version: 4.6.2
 Homepage: https://mpv.io/
 Package: mpv-fourier
 Architecture: arm64
 Depends: ${misc:Depends}, ${shlibs:Depends},
         ffmpeg-v4l2-request-fourier (>= 2:8.1+rfourier)
 Conflicts: mpv, libmpv2, libmpv1
 Replaces: mpv, libmpv2, libmpv1
 Provides: mpv (= ${binary:Version}), libmpv.so.2
 Description: mpv media player with V4L2-Request hwdec (fourier fork)
 mpv 0.41.0 patched with:
   - Kwiboo + Langdale v4l2request hwdec wiring (meson detection +
     vo_hwdec_drmprime separate hwdec instance for AV_HWDEVICE_TYPE_
     V4L2REQUEST) so '--hwdec=v4l2request' actually engages on
     dmabuf-wayland.
   - vo_dmabuf_wayland explicit DMA_BUF_IOCTL_SYNC on import fds
     (iter1 of dmabuf-modifier-triage) — workaround for missing
     implicit-fence on V4L2 stateless CAPTURE buffers. Fixes the
     KWin-on-RK3566 dark-green chroma readback regression on ohm.
 .
 Requires ffmpeg-v4l2-request-fourier as the backing libavcodec.
 Stock Debian ffmpeg does not provide AV_HWDEVICE_TYPE_V4L2REQUEST.
@@ -0,0 +1,25 @@
 Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
 Upstream-Name: mpv
 Upstream-Contact: https://github.com/mpv-player/mpv/issues
 Source: https://github.com/mpv-player/mpv
 Files: *
 Copyright: 2000-2026 The mpv developers
 License: GPL-2.0-or-later AND LGPL-2.1-or-later
 Files: 0001-meson-add-detection-logic-for-v4l2request-support.patch
       0002-vo-hwdec-drmprime-add-separate-hwdecs-for-v4l2reques.patch
 Copyright: 2024 Kwiboo, Niklas Haas, contributors
 License: LGPL-2.1-or-later
 Files: 0001-vo_dmabuf_wayland-explicit-cache-sync-on-import-fd.patch
 Copyright: 2026 Markus Fritsche <fritsche.markus@gmail.com>
 License: LGPL-2.1-or-later
 License: GPL-2.0-or-later
 On Debian systems, the complete text of the GNU General Public
 License v2 can be found in `/usr/share/common-licenses/GPL-2'.
 License: LGPL-2.1-or-later
 On Debian systems, the complete text of the GNU Lesser General
 Public License v2.1 can be found in `/usr/share/common-licenses/LGPL-2.1'.