diff --git a/kernel/rv1106-enablement/PORT-STATUS.md b/kernel/rv1106-enablement/PORT-STATUS.md
index 78d7530..62e018e 100644
--- a/kernel/rv1106-enablement/PORT-STATUS.md
+++ b/kernel/rv1106-enablement/PORT-STATUS.md
@@ -31,8 +31,34 @@ Fixed (captured in `clk/`):
    the UART frac clocks); mainline has no min/max opt-out, mapped to 0 (default limit).
    **⚠ PORT-VERIFY**: UART fractional baud accuracy.
 
-**Next:** the other core bring-up components (pinctrl, mach/timer, DT, defconfig) — being
-surveyed breadth-first in parallel to surface all their deltas before porting.
+## M1 — pinctrl (`pinctrl-rockchip.c/.h`): ✅ COMPILES CLEAN on 6.18
+`pinctrl-rockchip.o` (173688 bytes) builds no-errors. Transplanted from vendor 5.10 (effort S,
+zero API drift — the survey's assessment held): added `RV1106` to the type enum; a 159-line
+block of `RV1106_DRV/PULL/SMT_*` macros + 3 `rv1106_calc_*_reg_and_bit()` functions; `case
+RV1106:` in the 3 pull functions + the RK3568 drive-strength group; `rv1106_pin_banks[]` +
+`rv1106_pin_ctrl`; and the `rockchip,rv1106-pinctrl` of_device_id (dropping the vendor's
+`#ifdef CONFIG_CPU_RV1106` guard — mainline compiles all SoCs unconditionally). Captured as
+`pinctrl/0001-rv1106-pinctrl.patch`.
+- **PORT-VERIFY RESOLVED (iomux offsets):** the DRV/PULL/SMT per-bank offsets are confirmed by
+  a THIRD independent source — the upstream Simon Glass v3 pinctrl patch. Its
+  `rv1106_{drv,pull,smt}_offsets[]` match ours exactly once the 0x10000-strided per-bank IOC
+  base is applied (e.g. vendor GPIO2 DRV `0x100C0` = `0x10000 + 0xc0`). Retires the "do not
+  guess" iomux risk without hardware. (Note upstream uses per-bank IOC regmaps + low offsets;
+  we use the vendor's full-offset form — same absolute register, both compile.)
+- **Still PORT-VERIFY:** GPIO4 bank pin-count (`pin_banks` says 24, DT `gpio-ranges` says 32) —
+  carried from vendor unchanged; needs TRM/hardware.
+
+## M1 — mach + defconfig: NEXT
+Per the breadth survey's integration order: mach is a ~2-line DT-compat add to `rockchip.c`
+(do NOT recreate the dropped `CPU_RV1106` symbol); then the minimal M2 defconfig; then the DT
+(SoC nodes transplant + board-specific PORT-VERIFY: console UART, boot media, panel timings);
+then the first full kernel build toward an earlycon boot.
+
+## Upstream tracking (decision 2026-08-23)
+Base stays the vendor forward-port (applies to 6.18; we control it). The unmerged upstream
+RV1106 series (~35 patches, "New" state, does NOT apply cleanly to 6.18 — pinctrl v3 failed at
+`pinctrl-rockchip.c:3390`) is used as a **correctness oracle** for boot-critical PORT-VERIFY
+values (already retired the iomux offsets) and tracked for eventual convergence when it merges.
 
 ## Honest scope
 This is the first driver of ~120 in the RV1106 BSP. The clk port alone is a multi-cycle
diff --git a/kernel/rv1106-enablement/pinctrl/0001-rv1106-pinctrl.patch b/kernel/rv1106-enablement/pinctrl/0001-rv1106-pinctrl.patch
new file mode 100644
index 0000000..422afed
--- /dev/null
+++ b/kernel/rv1106-enablement/pinctrl/0001-rv1106-pinctrl.patch
@@ -0,0 +1,273 @@
+# RV1106 pinctrl support on Linux 6.18.46 (forward-ported from vendor 5.10). COMPILES CLEAN (pinctrl-rockchip.o 173688 bytes).
+# iomux DRV/PULL/SMT offsets cross-validated against upstream Simon Glass v3 patch (match once the 0x10000-strided per-bank IOC base is applied).
+--- a/drivers/pinctrl/pinctrl-rockchip.c	2026-08-23 06:27:10.000000000 -0600
++++ b/drivers/pinctrl/pinctrl-rockchip.c	2026-08-23 12:39:00.129754817 -0600
+@@ -1466,6 +1466,166 @@
+ #define RV1108_DRV_PINS_PER_REG		8
+ #define RV1108_DRV_BANK_STRIDE		16
+ 
++#define RV1106_DRV_BITS_PER_PIN		8
++#define RV1106_DRV_PINS_PER_REG		2
++#define RV1106_DRV_GPIO0_OFFSET		0x10
++#define RV1106_DRV_GPIO1_OFFSET		0x80
++#define RV1106_DRV_GPIO2_OFFSET		0x100C0
++#define RV1106_DRV_GPIO3_OFFSET		0x20100
++#define RV1106_DRV_GPIO4_OFFSET		0x30020
++
++static int rv1106_calc_drv_reg_and_bit(struct rockchip_pin_bank *bank,
++				       int pin_num, struct regmap **regmap,
++				       int *reg, u8 *bit)
++{
++	struct rockchip_pinctrl *info = bank->drvdata;
++
++	/* GPIO0_IOC is located in PMU */
++	switch (bank->bank_num) {
++	case 0:
++		*regmap = info->regmap_pmu;
++		*reg = RV1106_DRV_GPIO0_OFFSET;
++		break;
++
++	case 1:
++		*regmap = info->regmap_base;
++		*reg = RV1106_DRV_GPIO1_OFFSET;
++		break;
++
++	case 2:
++		*regmap = info->regmap_base;
++		*reg = RV1106_DRV_GPIO2_OFFSET;
++		break;
++
++	case 3:
++		*regmap = info->regmap_base;
++		*reg = RV1106_DRV_GPIO3_OFFSET;
++		break;
++
++	case 4:
++		*regmap = info->regmap_base;
++		*reg = RV1106_DRV_GPIO4_OFFSET;
++		break;
++
++	default:
++		dev_err(info->dev, "unsupported bank_num %d\n", bank->bank_num);
++		break;
++	}
++
++	*reg += ((pin_num / RV1106_DRV_PINS_PER_REG) * 4);
++	*bit = pin_num % RV1106_DRV_PINS_PER_REG;
++	*bit *= RV1106_DRV_BITS_PER_PIN;
++
++	return 0;
++}
++
++#define RV1106_PULL_BITS_PER_PIN		2
++#define RV1106_PULL_PINS_PER_REG		8
++#define RV1106_PULL_GPIO0_OFFSET		0x38
++#define RV1106_PULL_GPIO1_OFFSET		0x1C0
++#define RV1106_PULL_GPIO2_OFFSET		0x101D0
++#define RV1106_PULL_GPIO3_OFFSET		0x201E0
++#define RV1106_PULL_GPIO4_OFFSET		0x30070
++
++static int rv1106_calc_pull_reg_and_bit(struct rockchip_pin_bank *bank,
++					int pin_num, struct regmap **regmap,
++					int *reg, u8 *bit)
++{
++	struct rockchip_pinctrl *info = bank->drvdata;
++
++	/* GPIO0_IOC is located in PMU */
++	switch (bank->bank_num) {
++	case 0:
++		*regmap = info->regmap_pmu;
++		*reg = RV1106_PULL_GPIO0_OFFSET;
++		break;
++
++	case 1:
++		*regmap = info->regmap_base;
++		*reg = RV1106_PULL_GPIO1_OFFSET;
++		break;
++
++	case 2:
++		*regmap = info->regmap_base;
++		*reg = RV1106_PULL_GPIO2_OFFSET;
++		break;
++
++	case 3:
++		*regmap = info->regmap_base;
++		*reg = RV1106_PULL_GPIO3_OFFSET;
++		break;
++
++	case 4:
++		*regmap = info->regmap_base;
++		*reg = RV1106_PULL_GPIO4_OFFSET;
++		break;
++
++	default:
++		dev_err(info->dev, "unsupported bank_num %d\n", bank->bank_num);
++		break;
++	}
++
++	*reg += ((pin_num / RV1106_PULL_PINS_PER_REG) * 4);
++	*bit = pin_num % RV1106_PULL_PINS_PER_REG;
++	*bit *= RV1106_PULL_BITS_PER_PIN;
++
++	return 0;
++}
++
++#define RV1106_SMT_BITS_PER_PIN		1
++#define RV1106_SMT_PINS_PER_REG		8
++#define RV1106_SMT_GPIO0_OFFSET		0x40
++#define RV1106_SMT_GPIO1_OFFSET		0x280
++#define RV1106_SMT_GPIO2_OFFSET		0x10290
++#define RV1106_SMT_GPIO3_OFFSET		0x202A0
++#define RV1106_SMT_GPIO4_OFFSET		0x300A0
++
++static int rv1106_calc_schmitt_reg_and_bit(struct rockchip_pin_bank *bank,
++					   int pin_num,
++					   struct regmap **regmap,
++					   int *reg, u8 *bit)
++{
++	struct rockchip_pinctrl *info = bank->drvdata;
++
++	/* GPIO0_IOC is located in PMU */
++	switch (bank->bank_num) {
++	case 0:
++		*regmap = info->regmap_pmu;
++		*reg = RV1106_SMT_GPIO0_OFFSET;
++		break;
++
++	case 1:
++		*regmap = info->regmap_base;
++		*reg = RV1106_SMT_GPIO1_OFFSET;
++		break;
++
++	case 2:
++		*regmap = info->regmap_base;
++		*reg = RV1106_SMT_GPIO2_OFFSET;
++		break;
++
++	case 3:
++		*regmap = info->regmap_base;
++		*reg = RV1106_SMT_GPIO3_OFFSET;
++		break;
++
++	case 4:
++		*regmap = info->regmap_base;
++		*reg = RV1106_SMT_GPIO4_OFFSET;
++		break;
++
++	default:
++		dev_err(info->dev, "unsupported bank_num %d\n", bank->bank_num);
++		break;
++	}
++
++	*reg += ((pin_num / RV1106_SMT_PINS_PER_REG) * 4);
++	*bit = pin_num % RV1106_SMT_PINS_PER_REG;
++	*bit *= RV1106_SMT_BITS_PER_PIN;
++
++	return 0;
++}
++
+ static int rv1108_calc_drv_reg_and_bit(struct rockchip_pin_bank *bank,
+ 				       int pin_num, struct regmap **regmap,
+ 				       int *reg, u8 *bit)
+@@ -2751,7 +2911,8 @@
+ 		goto config;
+ 	} else if (ctrl->type == RK3528 ||
+ 		   ctrl->type == RK3562 ||
+-		   ctrl->type == RK3568) {
++		   ctrl->type == RK3568 ||
++		   ctrl->type == RV1106) {
+ 		rmask_bits = RK3568_DRV_BITS_PER_PIN;
+ 		ret = (1 << (strength + 1)) - 1;
+ 		goto config;
+@@ -2888,6 +3049,7 @@
+ 				? PIN_CONFIG_BIAS_PULL_PIN_DEFAULT
+ 				: PIN_CONFIG_BIAS_DISABLE;
+ 	case PX30:
++	case RV1106:
+ 	case RV1108:
+ 	case RK3188:
+ 	case RK3288:
+@@ -2949,6 +3111,7 @@
+ 		ret = regmap_write(regmap, reg, data);
+ 		break;
+ 	case PX30:
++	case RV1106:
+ 	case RV1108:
+ 	case RV1126:
+ 	case RK3188:
+@@ -3218,6 +3381,7 @@
+ 	case RK3066B:
+ 		return pull ? false : true;
+ 	case PX30:
++	case RV1106:
+ 	case RV1108:
+ 	case RV1126:
+ 	case RK3188:
+@@ -3960,6 +4124,48 @@
+ 		.schmitt_calc_reg	= px30_calc_schmitt_reg_and_bit,
+ };
+ 
++static struct rockchip_pin_bank rv1106_pin_banks[] = {
++	PIN_BANK_IOMUX_FLAGS(0, 32, "gpio0",
++			     IOMUX_WIDTH_4BIT | IOMUX_SOURCE_PMU,
++			     IOMUX_WIDTH_4BIT | IOMUX_SOURCE_PMU,
++			     IOMUX_WIDTH_4BIT | IOMUX_SOURCE_PMU,
++			     IOMUX_WIDTH_4BIT | IOMUX_SOURCE_PMU),
++	PIN_BANK_IOMUX_FLAGS_OFFSET(1, 32, "gpio1",
++				    IOMUX_WIDTH_4BIT,
++				    IOMUX_WIDTH_4BIT,
++				    IOMUX_WIDTH_4BIT,
++				    IOMUX_WIDTH_4BIT,
++				    0, 0x08, 0x10, 0x18),
++	PIN_BANK_IOMUX_FLAGS_OFFSET(2, 32, "gpio2",
++				    IOMUX_WIDTH_4BIT,
++				    IOMUX_WIDTH_4BIT,
++				    IOMUX_WIDTH_4BIT,
++				    IOMUX_WIDTH_4BIT,
++				    0x10020, 0x10028, 0, 0),
++	PIN_BANK_IOMUX_FLAGS_OFFSET(3, 32, "gpio3",
++				    IOMUX_WIDTH_4BIT,
++				    IOMUX_WIDTH_4BIT,
++				    IOMUX_WIDTH_4BIT,
++				    IOMUX_WIDTH_4BIT,
++				    0x20040, 0x20048, 0x20050, 0x20058),
++	PIN_BANK_IOMUX_FLAGS_OFFSET(4, 24, "gpio4",
++				    IOMUX_WIDTH_4BIT,
++				    IOMUX_WIDTH_4BIT,
++				    IOMUX_WIDTH_4BIT,
++				    0,
++				    0x30000, 0x30008, 0x30010, 0),
++};
++
++static struct rockchip_pin_ctrl rv1106_pin_ctrl __maybe_unused = {
++	.pin_banks		= rv1106_pin_banks,
++	.nr_banks		= ARRAY_SIZE(rv1106_pin_banks),
++	.label			= "RV1106-GPIO",
++	.type			= RV1106,
++	.pull_calc_reg		= rv1106_calc_pull_reg_and_bit,
++	.drv_calc_reg		= rv1106_calc_drv_reg_and_bit,
++	.schmitt_calc_reg	= rv1106_calc_schmitt_reg_and_bit,
++};
++
+ static struct rockchip_pin_bank rv1108_pin_banks[] = {
+ 	PIN_BANK_IOMUX_FLAGS(0, 32, "gpio0", IOMUX_SOURCE_PMU,
+ 					     IOMUX_SOURCE_PMU,
+@@ -4531,6 +4737,8 @@
+ static const struct of_device_id rockchip_pinctrl_dt_match[] = {
+ 	{ .compatible = "rockchip,px30-pinctrl",
+ 		.data = &px30_pin_ctrl },
++	{ .compatible = "rockchip,rv1106-pinctrl",
++		.data = &rv1106_pin_ctrl },
+ 	{ .compatible = "rockchip,rv1108-pinctrl",
+ 		.data = &rv1108_pin_ctrl },
+ 	{ .compatible = "rockchip,rv1126-pinctrl",
+--- a/drivers/pinctrl/pinctrl-rockchip.h	2026-08-23 06:27:10.000000000 -0600
++++ b/drivers/pinctrl/pinctrl-rockchip.h	2026-08-23 12:39:00.129754817 -0600
+@@ -185,6 +185,7 @@
+ 
+ enum rockchip_pinctrl_type {
+ 	PX30,
++	RV1106,
+ 	RV1108,
+ 	RV1126,
+ 	RK2928,