Device: OnePlus 6T (fajita), SDM845
Image: kali-nethunterpro-2026.2-sdm845 (Phosh), kernel 6.12.92-sdm845-nh
Prior OS: LineageOS 22.2 (OxygenOS 11 firmware base, MPSS.AT.4.0.c2.15)
Summary: Out of the box, internal Wi-Fi (WCN3990 / ath10k_snoc) is non-functional — wlan0 never appears, Wi-Fi is greyed out in Phosh. Root cause is a chain of missing/misplaced firmware and broken PD-mapper descriptors in the shipped rootfs. Cellular/modem is also dead out of the box for the same underlying reason.
Issues found (in dependency order):

1. Firmware path mismatch. The DTB requests co-processor firmware from qcom/sdm845/oneplus6/ (e.g. mba.mbn, adsp.mbn, cdsp.mbn, venus.mbn, a630_zap.mbn), but the shipped rootfs places these files in qcom/sdm845/ (one level up). Result: Direct firmware load ... failed with error -2 for every remoteproc at boot. The oneplus6/ subdirectory does not exist in the image.

2. Modem firmware not device-matched. Even after placing mba.mbn/modem.mbn at the correct path, the shipped generic modem firmware fails PBL authentication: qcom-q6v5-mss 4080000.remoteproc: PBL returned unexpected status -284557301 → Boot failed: -22. The modem only boots when using firmware extracted from the device's own modem partition (MPSS.AT.4.0.c2.15, OxygenOS 11). Suggests the shipped modem firmware is either absent, generic, or version-mismatched against the device's secure-boot trust root.

3. Modem firmware ships split, loader wants merged. The device modem/ADSP firmware is .mdt + .bNN segments; the mainline loader expects a single squashed .mbn. Required manual pil-squasher merge. Worth documenting or handling in-image.

4. ADSP does not auto-boot (remoteproc0 stays offline), so its servreg node is never published — which pd-mapper needs. Had to manually echo start > /sys/class/remoteproc/remoteproc0/state.

5. pd-mapper: "no pd maps available". Two causes: (a) the .jsn PD descriptors in qcom/sdm845/ are symlinks to wrong SoCs (adspr.jsn → ../qcm2290/, cdspr.jsn → ../qcs615/, modemuw.jsn → ../qcm2290/); (b) pd-mapper searches /lib/firmware/updates/qcom/sdm845/oneplus6/ (confirmed via strace openat), where no .jsn files are shipped. Fixed by placing the device's own .jsn descriptors (from the modem partition) into that path.

6. ath10k probe-order race. ath10k_snoc probes at ~13s (boot), but modem comes up ~19s and ADSP/pd-mapper later. ath10k stalls silently after Adding to iommu group 10 and never retries. Runtime modprobe -r/reload and driver unbind/bind do not re-trigger a working probe (no dmesg output on reload) — appears to only probe successfully at boot. No working ordering is shipped to guarantee modem+ADSP+pd-mapper are up before ath10k probes.

7.Bluetooth crnv21.bin path. Initramfs reports missing qca/oneplus6/crnv21.bin; the file exists elsewhere in the tree and must be copied to that path for BT to initialise cleanly.

8.Minor: venus.mbn (video codec) and slpi.mbn (sensor DSP) also fail -2 on the oneplus6/ path; USB Ethernet r8152 works despite an rtl8153a-4.fw load-fail warning.

Net: with (1) correct firmware paths, (2) device-extracted + squashed modem/ADSP firmware, (3) correct .jsn descriptors in the updates/.../oneplus6/ path, cellular and the full servreg/pd-mapper chain come up — but ath10k still won't complete its probe at runtime due to the boot-ordering issue (6), which remains unresolved. Suggest the image ship: correct oneplus6/ firmware paths, a documented/automated way to source device modem firmware, correct per-SoC .jsn descriptors, ADSP auto-boot, and ath10k load ordering after pd-mapper.