RT-AX86U occasional unexpected rebooting after flashing 3004.388.9

[Chuckles67]

RT-AX86U is rebooting unexpectedly runing this asuswrt-merlin FW: I've seen it happen 5 times in the last two months.
Merlin current Version : 3004.388.9_2
amtm add-ons: diversion, conmon, vnstat, entware packages, disk check script, format disk, swap file

on 4/28 I did an upgrade from Merlin 3004.388.8_2 to Merlin 3004.388.9 then did an "hard factory reset" including disconnecting USB drive before the upgrade then later formatting that USB drive before reconnecting.
Dirty upgrade to *.9_2 released one day later - unlucky timing with that dot release

The router has a stable configuration since several years including amtm, diversion, vnstat, conmon and ovpn servers.

The system log for the reboot (my spouse texted at 15:38 saying "no internet again...")

<snip>
Jun 12 06:26:50 ovpn-server2[2385]: xx.xx.xxx.xxx:3878 Connection reset, restarting [0]
Jun 12 15:25:57 rc_service: httpd 1771:notify_rc restart_logger
Jun 12 15:25:57 custom_script: Running /jffs/scripts/service-event (args: restart logger)
Jun 12 15:25:57 syslogd exiting
Jun 12 15:25:57 syslogd started: BusyBox v1.25.1
Jun 12 15:25:57 kernel: klogd started: BusyBox v1.25.1 (2025-04-28 17:28:04 EDT)
Jun 12 15:34:39 wlceventd: wlceventd_proc_event(685): eth7: Auth B2:59:37:CE:36:45, status: Successful (0), rssi:0
Jun 12 15:34:39 hostapd: eth7: STA b2:59:37:ce:36:45 IEEE 802.11: associated
Jun 12 15:34:39 wlceventd: wlceventd_proc_event(722): eth7: Assoc B2:59:37:CE:36:45, status: Successful (0), rssi:-52
Jun 12 15:34:39 hostapd: eth7: STA b2:59:37:ce:36:45 RADIUS: starting accounting session BE9C87EA17DDE7F4
Jun 12 15:34:39 hostapd: eth7: STA b2:59:37:ce:36:45 WPA: pairwise key handshake completed (RSN)
Jun 12 15:34:44 hostapd: eth7: STA b2:59:37:ce:36:45 IEEE 802.11: disassociated
Jun 12 15:34:44 wlceventd: wlceventd_proc_event(662): eth7: Disassoc B2:59:37:CE:36:45, status: 0, reason: Disassociated because sending station is leaving (or has left) BSS (8), rssi:0
Jun 12 15:34:44 wlceventd: wlceventd_proc_event(662): eth7: Disassoc B2:59:37:CE:36:45, status: 0, reason: Disassociated because sending station is leaving (or has left) BSS (8), rssi:0
Jun 12 15:34:44 hostapd: eth7: STA b2:59:37:ce:36:45 IEEE 802.11: disassociated
Jun 12 15:34:49 wlceventd: wlceventd_proc_event(685): eth7: Auth B2:59:37:CE:36:45, status: Successful (0), rssi:0
Jun 12 15:34:49 wlceventd: wlceventd_proc_event(722): eth7: Assoc B2:59:37:CE:36:45, status: Successful (0), rssi:-52
Jun 12 15:34:49 hostapd: eth7: STA b2:59:37:ce:36:45 IEEE 802.11: associated
Jun 12 15:34:49 hostapd: eth7: STA b2:59:37:ce:36:45 RADIUS: starting accounting session D1414503465E2068
Jun 12 15:34:49 hostapd: eth7: STA b2:59:37:ce:36:45 WPA: pairwise key handshake completed (RSN)
Jun 12 15:45:10 ovpn-server2[2389]: TCP connection established with [AF_INET]204.76.203.208:59862
Jun 12 15:45:10 ovpn-server2[2389]: 204.76.203.208:59862 TCP connection established with [AF_INET]204.76.203.208:59874
Jun 12 15:45:10 ovpn-server2[2389]: 204.76.203.208:59874 WARNING: Bad encapsulated packet length from peer (5635), which must be > 0 and <= 1768 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...]
Jun 12 15:45:10 ovpn-server2[2389]: 204.76.203.208:59874 Connection reset, restarting [0]
Jun 12 15:45:10 ovpn-server2[2389]: 204.76.203.208:59874 SIGUSR1[soft,connection-reset] received, client-instance restarting
Jun 12 15:45:10 ovpn-server2[2389]: 204.76.203.208:59862 Connection reset, restarting [0]
Jun 12 15:45:10 ovpn-server2[2389]: 204.76.203.208:59862 SIGUSR1[soft,connection-reset] received, client-instance restarting
Jun 12 15:48:23 hostapd: eth6: STA 34:60:f9:23:b2:fb WPA: group key handshake completed (RSN)
</snip>

Any specific smoking guns here?

I've now set the log levels to `notice` and `debug`. If/when happens again then I'll update this thread with the latest log.

UPDATED
- clarified hard reset => factory reset
- clarified the factory reset was done after the .9 install
- add link to "hard factory reset"
- added amtm add-ons.

 

[John Fitzgerald]

What worked for me was flashing to newest stock, letting it settle, then flashing RMerlin with a factory reset and loading everything from scratch.
My drama was in another post.

AX86U: Does this indicate a hardware fault?

Does this code indicate a hardware fault, Nand or Radio (in 2 section snips)? The update from 388.8_4 to 388.9_2 did not go well. The logs show I am getting hammered with "China" blocks and the router is unusable, (thinking it might be a DOS attack)??? The router has become unusable even after...

www.snbforums.com

 

[Chuckles67]

What worked for me was flashing to newest stock, letting it settle, then flashing RMerlin with a factory reset and loading everything from scratch.
My drama was in another post.

AX86U: Does this indicate a hardware fault?

Does this code indicate a hardware fault, Nand or Radio (in 2 section snips)? The update from 388.8_4 to 388.9_2 did not go well. The logs show I am getting hammered with "China" blocks and the router is unusable, (thinking it might be a DOS attack)??? The router has become unusable even after...

www.snbforums.com

Thanks for sharing - I haven't been on Asus stock since buying this router four-five years ago and immediately flashing with Merlin 386.x

 

[John Fitzgerald]

I haven't been on Asus stock since buying this router four-five years ago and immediately flashing with Merlin 386.x

Same here. This was the most frustrating update. I went from .8_4 to .9(which broke WP2/WPA3 mixed mode) to .9_2 and it was a mess. I believe the .9 caused the bad behavior.

Hope this works out for you.

 

[Chuckles67]

What worked for me was flashing to newest stock, letting it settle, then flashing RMerlin with a factory reset and loading everything from scratch.

Did you factory reset before flashing RMerlin or after (or both)?

 

[Chuckles67]

Same here. This was the most frustrating update. I went from .8_4 to .9(which broke WP2/WPA3 mixed mode) to .9_2 and it was a mess. I believe the .9 caused the bad behavior.

I'm using the Authentication Method "WPA2-Personal" for both 2.4G and 5G radios: after install of .9, followed by a hard factory reset, "WPA2-Personal" was the default method.
I do have a mixture of devices including older 2.4G devices that probably do not support WPA3, plus I think my neighbors are not tech-savvy enough to try hacking in to my wifi so can live with WPA2 security

 

[John Fitzgerald]

Did you factory reset before flashing RMerlin or after (or both)?

I had factory reset while on RMerlin and tried different combinations of restores and nothing was working.
Then I WPS reset and flashed stock and the system picked up a new ASUS DDNS Cert certificate (located under wan tab[left side] then ddns tab[top tabs).
I loaded the minimum to get started and let the system run for a while to make sure it was running smooth.
When I was happy, I flashed RMerlin then did bare minimum again and then did a GUI factory reset and loaded all from scratch including redoing the external drive and setting up all the script add-ons new.

I really thought some sort of hardware failure occurred with the flash process going bad.
The .9 release was a mess and the problems were all on account of ASUS.
The reason for the .9_2 release was ASUS came out with several fixes for their errors.

At this point the .9 release should be pulled.

EDIT: I had no issues on another AX86U unit going from .8_4 straight to .9_2 .

 

[Chuckles67]

Adding log after a new reboot.

• Default message log level: notice
• Log only messages more urgent than: debug

The router rebooted at 21:16. About 20 minutes earlier the log shows a "possible active attack on TCP link" for the OVPN Server 2 that failed - I doubt this caused the router reboot. There is nothing in the log immediately before the reboot at 21:16.

Jun 13 20:56:42 ovpn-server2[2408]: TCP connection established with [AF_INET]204.76.203.208:57158
Jun 13 20:56:42 ovpn-server2[2408]: 204.76.203.208:57158 TCP connection established with [AF_INET]204.76.203.208:57172
Jun 13 20:56:42 ovpn-server2[2408]: 204.76.203.208:57172 WARNING: Bad encapsulated packet length from peer (5635), which must be > 0 and <= 1768 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...]
Jun 13 20:56:42 ovpn-server2[2408]: 204.76.203.208:57172 Connection reset, restarting [0]
Jun 13 20:56:42 ovpn-server2[2408]: 204.76.203.208:57172 SIGUSR1[soft,connection-reset] received, client-instance restarting
Jun 13 20:56:43 ovpn-server2[2408]: 204.76.203.208:57158 Connection reset, restarting [0]
Jun 13 20:56:43 ovpn-server2[2408]: 204.76.203.208:57158 SIGUSR1[soft,connection-reset] received, client-instance restarting
Dec 31 16:00:20 syslogd started: BusyBox v1.25.1
Dec 31 16:00:20 kernel: klogd started: BusyBox v1.25.1 (2025-04-28 17:28:04 EDT)
Dec 31 16:00:20 kernel: Booting Linux on physical CPU 0x0

I'm planning to take the router down, flash to Asus stock firmware, then flash to RMerlin 3004.388.9_2.
I'll report back on this thread later.

UPDATE: will run hard factory resets in between the various flashes. Final config will be setup manually with a newly formatted USB drive.

 

[degrub]

Factory reset as well so it is clean as it can be. Hand config, not restore a config file.