diff --git a/kernel/rv1106-enablement/PORT-STATUS.md b/kernel/rv1106-enablement/PORT-STATUS.md
index 1710fb5..b827c0b 100644
--- a/kernel/rv1106-enablement/PORT-STATUS.md
+++ b/kernel/rv1106-enablement/PORT-STATUS.md
@@ -159,3 +159,30 @@ build-m2.sh reproducible M2 build (zImage + dtb)
 ```
 The full ported tree lives in `flare-edge/research/linux-6.18.46/` (scratch); this dir is
 the durable, reviewable capture, to become a proper patch series as milestones land.
+
+## Hardware verification of the CURRENT series (2026-09-03, bench panel)
+
+The series in `../../patches/` was built with `build/build-kernel.sh` +
+`build/warden_defconfig` (rockchip gcc 8.3), packaged with the new
+`build/mk-bootimg.sh`, flashed to the bench panel's inactive slot armed for a
+single try, and booted. Working on real silicon: display (`/dev/fb0`,
+`/dev/dri/card0`), backlight, Goodix touch, RGA (`/dev/rga`), eth0, the usb0
+gadget, all userspace daemons, and zero kernel faults in dmesg.
+
+M4/M5/M6 above are STALE: display and RGA are in the series and verified here.
+
+**What the same test found missing, and why it matters.** Diffing this
+defconfig's expansion against the kernel actually shipping on a panel showed
+three subsystems absent, none of which fail at build time:
+
+    ip link add type wireguard   -> Operation not supported
+    iptables -L                  -> FAIL (no filter or nat table)
+    /proc/net/vlan               -> absent
+
+That is the FLARE mesh, every rule in S35iptables plus router-mode NAT, and the
+MikroTik tagged-port work. The netfilter half hid behind a 6.18 rename: the
+legacy tables moved under NETFILTER_XTABLES_LEGACY / IP_NF_IPTABLES_LEGACY, so
+copying the vendor kernel's symbol list verbatim leaves IP_NF_FILTER and
+IP_NF_NAT silently off. Fixed in warden_defconfig and re-verified on the same
+panel: wireguard device creates, filter and nat tables load, MASQUERADE and the
+state match apply, and a VLAN interface creates.