diff --git a/CMakeLists.txt b/CMakeLists.txt
index 47bb42f..5a1d9a0 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -56,6 +56,10 @@ add_library(WiFiDriver
     src/HalModule.h
     src/Iqk8812a.cpp
     src/Iqk8812a.h
+    src/Iqk8814a.cpp
+    src/Iqk8814a.h
+    src/PhydmWatchdog.cpp
+    src/PhydmWatchdog.h
     src/ParsedRadioPacket.cpp
     src/PhyTableLoader.cpp
     src/PhyTableLoader.h
diff --git a/README.md b/README.md
index 72dcf5b..6c5b3b8 100644
--- a/README.md
+++ b/README.md
@@ -4,12 +4,12 @@ The Realtek 11ac driver that simply devours its competitors.
 
 Devourer is a userspace re-implementation of Realtek's RTL88xxAU Wi-Fi
 driver (Jaguar family: RTL8812AU and RTL8821AU shipping on every band,
-RTL8811AU supported via the 8812 code path, RTL8814AU RX-only),
-speaking to the chip directly through libusb. No kernel
-module, no `rtl8812au` DKMS tree — just a C++20 static library
-(`WiFiDriver`) plus two demo executables for RX and TX. It is the
-OpenIPC project's driver of choice for long-range video links built on
-top of cheap Realtek 11ac USB radios.
+RTL8811AU supported via the 8812 code path, RTL8814AU with band-
+specific gaps — see table below), speaking to the chip directly
+through libusb. No kernel module, no `rtl8812au` DKMS tree — just a
+C++20 static library (`WiFiDriver`) plus two demo executables for RX
+and TX. It is the OpenIPC project's driver of choice for long-range
+video links built on top of cheap Realtek 11ac USB radios.
 
 ## Hardware landscape
 
@@ -25,7 +25,7 @@ layered on top.
 | -------------- | --------------- | ------------- | ---------------------- | ---------------------- | ------------------------------------------- |
 | **RTL8812AU**  | 2T2R            | TX + RX       | TX + RX                | TX + RX                | VID/PID `0bda:8812`; reference part — works on every channel/band combo |
 | **RTL8811AU**  | 1T1R            | TX + RX       | TX + RX                | TX + RX                | 1T1R cut of 8812 silicon; rides 8812 code path with `RFType=RF_TYPE_1T1R` selected from `REG_SYS_CFG` bit 27. Status mirrored from 8812 — not separately exercised |
-| **RTL8814AU**  | 4T4R, 3-SS max  | RX only       | RX only                | RX only                | VID/PID `0bda:8813`; 2-SS effective on USB-2. TX submits succeed on the bulk pipe but nothing reaches the air at any band |
+| **RTL8814AU**  | 4T4R, 3-SS max  | RX only       | RX only                | TX + RX                | VID/PID `0bda:8813`; 2-SS effective on USB-2. 5 GHz UNII-2/3 TX produces on-air frames after the 8814A-specific band-switch + channel-set chain. 2.4 GHz TX still doesn't reach receivers |
 | **RTL8821AU**  | 1T1R AC + BT    | TX + RX       | TX + RX                | TX + RX | OEM-rebadged as TP-Link Archer T2U Plus (`2357:0120`) etc. UNII-2/3 TX has cross-receiver asymmetry against 8812AU peers |
 
 Successor families (`Jaguar2` / `Jaguar+` — 8812BU, 8822BU/BE, etc., and
@@ -105,6 +105,24 @@ Common to both demos:
   channel switch. Skipped by default in 8814 monitor mode: the loop issues
   ~300 vendor control transfers and the resulting per-rate indices are
   unused for RX-only operation.
+- `DEVOURER_SKIP_TXPWR=1` — skip the per-rate TX-power loop entirely on
+  every chip. Useful for fast iteration during BB/RF debugging when the
+  per-rate indices aren't relevant to what you're measuring.
+- `DEVOURER_FORCE_IQK=1` — run phydm I/Q calibration on every channel-set,
+  not just band transitions. For 8814, IQK is otherwise off by default —
+  the kernel doesn't run it on `iw set channel` either, and devourer
+  matches that behaviour.
+- `DEVOURER_DISABLE_IQK=1` — never run IQK, even when armed by a band
+  transition. Diagnostic — IQK-output BB regs stay at their BB-init seeds.
+- `DEVOURER_PHYDM_WATCHDOG=1` — start the periodic phydm DM watchdog
+  thread (FA-counter statistics + DIG IGI walk every ~2 s). Off by
+  default because the watchdog's BB reads/writes share libusb's
+  transfer queue with the TX bulk path and measurably drop sustained
+  TX throughput on Jaguar chips. Use for canary-diff workflows and
+  RX-only DIG tuning.
+- `DEVOURER_DUMP_CANARY=1` — emit a canonical post-channel-set dump of
+  BB/MAC/RF anchor registers. Feeds the `tests/canary_diff.py`
+  cross-validation tool against `tools/canary_kernel_dump.sh` output.
 - `DEVOURER_USB_QUIET=1` — downgrade libusb log level from DEBUG to
   WARNING (DEBUG produces ~7 MB per 15 s and can fill `/tmp` mid-capture).
 
@@ -180,7 +198,9 @@ src/      Driver implementation
           FirmwareManager        chip-specific firmware download
           PhyTableLoader         applies chip-cut-conditional BB/AGC tables
           PowerTracking8812a     phydm thermal-meter TX BB-swing compensation
-          Iqk8812a               phydm I/Q calibration
+          Iqk8812a               phydm I/Q calibration for 8812 / 8821
+          Iqk8814a               phydm I/Q calibration for 8814 (4-path)
+          PhydmWatchdog          opt-in periodic DM thread (FA stats + DIG)
           RtlUsbAdapter          libusb wrapper (vendor + bulk transfers)
           FrameParser            RX parsing, TX descriptor layout
           Radiotap.c             radiotap header iterator
diff --git a/src/HalModule.cpp b/src/HalModule.cpp
index 6633fb5..9fca03d 100644
--- a/src/HalModule.cpp
+++ b/src/HalModule.cpp
@@ -72,6 +72,29 @@ bool HalModule::rtw_hal_init(SelectedChannel selectedChannel) {
   if (status) {
     _radioManagementModule->init_hw_mlme_ext(selectedChannel);
     _radioManagementModule->SetMonitorMode();
+
+    /* Construct + start the phydm DM watchdog after chip init is
+     * complete. Tick once synchronously so the first canary capture
+     * sees post-watchdog state (mirrors kernel where phydm runs
+     * before any read-back). Then spawn the periodic thread for
+     * subsequent 2s ticks. */
+    /* Phydm DM watchdog is opt-in (`DEVOURER_PHYDM_WATCHDOG=1`). The
+     * watchdog thread's periodic BB reads/writes share libusb's
+     * transfer queue with the TX bulk path — measured 4500→1000 TX
+     * submits in 10s on 8821 ch100, and 2300→0 RX hits on the 8814
+     * ch100 dev-dev cell — when the watchdog runs concurrently with
+     * sustained TX. The scaffold + DIG port are kept available for
+     * targeted experiments (canary diff vs kernel reference, future
+     * RX-only DIG tuning), but normal monitor-mode RX/TX runs the
+     * faster, watchdog-less path that matches kernel cold-init
+     * behaviour anyway (kernel doesn't run phydm before the first
+     * `iw set channel` either). */
+    if (std::getenv("DEVOURER_PHYDM_WATCHDOG")) {
+      _phydmWatchdog = std::make_unique<PhydmWatchdog>(
+          _device, _eepromManager, _radioManagementModule.get(), _logger);
+      _phydmWatchdog->TickOnce();
+      _phydmWatchdog->Start();
+    }
   } else {
     _logger->error("rtw_hal_init: fail");
   }
@@ -310,6 +333,15 @@ bool HalModule::rtl8812au_hal_init(uint8_t init_channel) {
   if (_eepromManager->version_id.ICType == CHIP_8812) {
     _radioManagementModule->ArmIQKOnNextChannelSet();
   }
+  /* Note: 8814 IQK is NOT auto-armed on cold init. The kernel does
+   * not arm it either — the standard `iw set channel` path goes
+   * through `set_channel_bwmode` → `rtw_hal_set_chnl_bw` without
+   * firing `HW_VAR_DO_IQK`. Only AP-mode / DFS / silent-reset paths
+   * fire IQK kernel-side. Auto-arming on devourer caused BB 0xc60
+   * to land at the AFE-normal value (0x07808003) at end of IQK
+   * restore, instead of the BB-init final value (0x0e808003) that
+   * the kernel canary observes. The `Iqk8814a` port is still wired
+   * up via `DEVOURER_FORCE_IQK=1` for explicit testing. */
 
   if (_eepromManager->version_id.RFType == RF_TYPE_1T1R) {
     PHY_BB8812_Config_1T();
diff --git a/src/HalModule.h b/src/HalModule.h
index 9fc8083..ec699bc 100644
--- a/src/HalModule.h
+++ b/src/HalModule.h
@@ -7,6 +7,7 @@ extern "C"{
 #include "Hal8814PwrSeq.h"
 #include "Hal8821APwrSeq.h"
 }
+#include "PhydmWatchdog.h"
 #include "RadioManagementModule.h"
 #include "RtlUsbAdapter.h"
 #include "SelectedChannel.h"
@@ -51,6 +52,9 @@ class HalModule {
   uint8_t _rxAggDmaSize =
       16; /* uint: 128b, 0x0A = 10 =
              MAX_RX_DMA_BUFFER_SIZE/2/pHalData.UsbBulkOutSize */
+  /* Phydm DM watchdog. Lazily constructed in `rtw_hal_init` after
+   * `RadioManagementModule` is fully wired up. */
+  std::unique_ptr<PhydmWatchdog> _phydmWatchdog;
 
 public:
   HalModule(RtlUsbAdapter device, std::shared_ptr<EepromManager> eepromManager,
diff --git a/src/Iqk8814a.cpp b/src/Iqk8814a.cpp
new file mode 100644
index 0000000..f8233ec
--- /dev/null
+++ b/src/Iqk8814a.cpp
@@ -0,0 +1,309 @@
+#include "Iqk8814a.h"
+
+#include "RadioManagementModule.h"
+
+#include <chrono>
+#include <thread>
+
+namespace {
+
+constexpr uint32_t kRFRegMask = 0xfffffu; /* 20-bit RF reg mask */
+constexpr int kLokDelayMs = 1;            /* upstream LOK_delay */
+constexpr int kWbiqkDelayMs = 10;         /* upstream WBIQK_delay */
+constexpr int kTxIqk = 0;
+constexpr int kRxIqk = 1;
+
+inline void DelayMs(int ms) {
+  std::this_thread::sleep_for(std::chrono::milliseconds(ms));
+}
+
+inline uint32_t Bit(int n) { return 1u << n; }
+
+} // namespace
+
+Iqk8814a::Iqk8814a(RtlUsbAdapter device,
+                   std::shared_ptr<EepromManager> eepromManager,
+                   RadioManagementModule *radio, Logger_t logger)
+    : _device(device), _eepromManager(eepromManager), _radio(radio),
+      _logger(logger) {}
+
+void Iqk8814a::BackupMacBb(const uint32_t *macRegs, uint32_t *macOut,
+                           const uint32_t *bbRegs, uint32_t *bbOut) {
+  for (int i = 0; i < kMacRegNum; i++) {
+    macOut[i] = _device.rtw_read32(macRegs[i]);
+  }
+  for (int i = 0; i < kBbRegNum; i++) {
+    bbOut[i] = _device.rtw_read32(bbRegs[i]);
+  }
+}
+
+void Iqk8814a::BackupRf(const uint32_t *regs, uint32_t out[][4]) {
+  /* Path C/D RF reads return sentinel/zero by HW design (kaeru:
+   * "RTL8814AU RF read mechanism — paths C/D write-only by HW design")
+   * but mirror upstream's read-all-4-paths pattern exactly so the
+   * restore writes back identical values. */
+  for (int i = 0; i < kRfRegNum; i++) {
+    out[i][RfPath::RF_PATH_A] =
+        _radio->phy_query_rf_reg(RfPath::RF_PATH_A, regs[i], kRFRegMask);
+    out[i][RfPath::RF_PATH_B] =
+        _radio->phy_query_rf_reg(RfPath::RF_PATH_B, regs[i], kRFRegMask);
+    out[i][RfPath::RF_PATH_C] =
+        _radio->phy_query_rf_reg(RfPath::RF_PATH_C, regs[i], kRFRegMask);
+    out[i][RfPath::RF_PATH_D] =
+        _radio->phy_query_rf_reg(RfPath::RF_PATH_D, regs[i], kRFRegMask);
+  }
+}
+
+void Iqk8814a::AFESetting(bool doIqk) {
+  /* IQK AFE setting: 0x0e808003 (RX_WAIT_CCA mode) vs Normal: 0x07808003. */
+  const uint32_t afe_val = doIqk ? 0x0e808003u : 0x07808003u;
+  _device.rtw_write32(0xc60, afe_val);
+  _device.rtw_write32(0xe60, afe_val);
+  _device.rtw_write32(0x1860, afe_val);
+  _device.rtw_write32(0x1a60, afe_val);
+  _device.phy_set_bb_reg(0x90c, Bit(13), 0x1);
+  _device.phy_set_bb_reg(0x764, Bit(10) | Bit(9), 0x3);
+  _device.phy_set_bb_reg(0x764, Bit(10) | Bit(9), 0x0);
+  _device.phy_set_bb_reg(0x804, Bit(2), 0x1);
+  _device.phy_set_bb_reg(0x804, Bit(2), 0x0);
+}
+
+void Iqk8814a::RestoreMacBb(const uint32_t *macRegs, const uint32_t *macBackup,
+                            const uint32_t *bbRegs, const uint32_t *bbBackup) {
+  for (int i = 0; i < kMacRegNum; i++) {
+    _device.rtw_write32(macRegs[i], macBackup[i]);
+  }
+  for (int i = 0; i < kBbRegNum; i++) {
+    _device.rtw_write32(bbRegs[i], bbBackup[i]);
+  }
+}
+
+void Iqk8814a::RestoreRf(const uint32_t *regs, const uint32_t backup[][4]) {
+  /* Clear RF[*][0xef] paging before restoring. */
+  _radio->phy_set_rf_reg(RfPath::RF_PATH_A, 0xef, kRFRegMask, 0x0);
+  _radio->phy_set_rf_reg(RfPath::RF_PATH_B, 0xef, kRFRegMask, 0x0);
+  _radio->phy_set_rf_reg(RfPath::RF_PATH_C, 0xef, kRFRegMask, 0x0);
+  _radio->phy_set_rf_reg(RfPath::RF_PATH_D, 0xef, kRFRegMask, 0x0);
+
+  for (int i = 0; i < kRfRegNum; i++) {
+    _radio->phy_set_rf_reg(RfPath::RF_PATH_A, regs[i], kRFRegMask,
+                           backup[i][RfPath::RF_PATH_A]);
+    _radio->phy_set_rf_reg(RfPath::RF_PATH_B, regs[i], kRFRegMask,
+                           backup[i][RfPath::RF_PATH_B]);
+    _radio->phy_set_rf_reg(RfPath::RF_PATH_C, regs[i], kRFRegMask,
+                           backup[i][RfPath::RF_PATH_C]);
+    _radio->phy_set_rf_reg(RfPath::RF_PATH_D, regs[i], kRFRegMask,
+                           backup[i][RfPath::RF_PATH_D]);
+  }
+}
+
+void Iqk8814a::ResetNCTL() {
+  _device.rtw_write32(0x1b00, 0xf8000000);
+  _device.rtw_write32(0x1b80, 0x00000006);
+  _device.rtw_write32(0x1b00, 0xf8000000);
+  _device.rtw_write32(0x1b80, 0x00000002);
+}
+
+void Iqk8814a::ConfigureMAC() {
+  _device.rtw_write8(0x522, 0x3f);
+  _device.phy_set_bb_reg(0x550, Bit(11) | Bit(3), 0x0);
+  _device.rtw_write8(0x808, 0x00);                  /* RX ant off */
+  _device.phy_set_bb_reg(0x838, 0xf, 0xe);          /* CCA off */
+  _device.phy_set_bb_reg(0xa14, Bit(9) | Bit(8), 0x3); /* CCK RX path off */
+  _device.rtw_write32(0xcb0, 0x77777777);
+  _device.rtw_write32(0xeb0, 0x77777777);
+  _device.rtw_write32(0x18b4, 0x77777777);
+  _device.rtw_write32(0x1ab4, 0x77777777);
+  _device.phy_set_bb_reg(0x1abc, 0x0ff00000, 0x77);
+  _device.phy_set_bb_reg(0xcbc, 0xf, 0x0);
+}
+
+void Iqk8814a::LokOneShot() {
+  /* LO leakage calibration, all 4 paths. Polls 0x1b00 bit 0 for
+   * completion (clears when done). On success, reads LOK result from
+   * 0x1bfc and writes RF[path][0x8] LOK trim. On timeout, writes a
+   * fallback constant. */
+  for (uint8_t path = 0; path <= 3; ++path) {
+    _device.phy_set_bb_reg(0x9a4, Bit(21) | Bit(20),
+                           path); /* ADC clock source */
+    _device.rtw_write32(0x1b00, 0xf8000001u | (1u << (4 + path)));
+    DelayMs(kLokDelayMs);
+
+    bool lokNotReady = true;
+    int delayCount = 0;
+    while (lokNotReady) {
+      lokNotReady =
+          (_radio->phy_query_bb_reg_public(0x1b00, Bit(0)) != 0);
+      DelayMs(1);
+      if (++delayCount >= 10) {
+        _logger->warn("8814 LOK path {} timeout", path);
+        ResetNCTL();
+        break;
+      }
+    }
+
+    if (!lokNotReady) {
+      _device.rtw_write32(0x1b00, 0xf8000000u | (path << 1));
+      _device.rtw_write32(0x1bd4, 0x003f0001);
+      uint32_t lokTemp2 =
+          (_radio->phy_query_bb_reg_public(0x1bfc, 0x003e0000) + 0x10) & 0x1f;
+      uint32_t lokTemp1 =
+          (_radio->phy_query_bb_reg_public(0x1bfc, 0x0000003e) + 0x10) & 0x1f;
+
+      /* Saturation: replicate bits 4-0 upwards. Mirrors upstream's
+       * "for ii in 1..5: temp += (temp & BIT(4-ii)) << (ii*2)". */
+      for (int ii = 1; ii < 5; ++ii) {
+        lokTemp1 += (lokTemp1 & Bit(4 - ii)) << (ii * 2);
+        lokTemp2 += (lokTemp2 & Bit(4 - ii)) << (ii * 2);
+      }
+
+      _radio->phy_set_rf_reg(static_cast<RfPath>(path), 0x8, 0x07c00,
+                             lokTemp1 >> 4);
+      _radio->phy_set_rf_reg(static_cast<RfPath>(path), 0x8, 0xf8000,
+                             lokTemp2 >> 4);
+    } else {
+      _radio->phy_set_rf_reg(static_cast<RfPath>(path), 0x8, kRFRegMask,
+                             0x08400);
+    }
+  }
+}
+
+void Iqk8814a::IqkOneShot() {
+  /* TX-IQK then RX-IQK across all 4 paths. CMD ID encoded in 0x1b00
+   * bits 11:8 (BW-dependent) plus path-trigger bit (1 << (4+path)).
+   * For 20MHz monitor mode (band_width=0): TX=3, RX=9. */
+  constexpr uint8_t kBandWidth20 = 0; /* devourer is fixed 20MHz monitor */
+  constexpr uint32_t kIqkApply[4] = {0xc94, 0xe94, 0x1894, 0x1a94};
+
+  for (int idx = 0; idx <= 1; ++idx) {
+    for (uint8_t path = 0; path <= 3; ++path) {
+      int calRetry = 0;
+      bool fail = true;
+      while (fail) {
+        _device.phy_set_bb_reg(0x9a4, Bit(21) | Bit(20), path);
+
+        uint32_t iqkCmd;
+        if (idx == kTxIqk) {
+          /* 20 WBTXK: CMD = 3, BW20 + 3 = 3 */
+          iqkCmd = 0xf8000001u | ((kBandWidth20 + 3u) << 8) | (1u << (4 + path));
+        } else {
+          /* 20 WBRXK: CMD = 9, 9 - BW20 = 9 */
+          iqkCmd = 0xf8000001u | ((9u - kBandWidth20) << 8) | (1u << (4 + path));
+        }
+        _device.rtw_write32(0x1b00, iqkCmd);
+        DelayMs(kWbiqkDelayMs);
+
+        bool notReady = true;
+        int delayCount = 0;
+        while (notReady) {
+          notReady =
+              (_radio->phy_query_bb_reg_public(0x1b00, Bit(0)) != 0);
+          if (!notReady) {
+            fail =
+                (_radio->phy_query_bb_reg_public(0x1b08, Bit(26)) != 0);
+            break;
+          }
+          DelayMs(1);
+          if (++delayCount >= 20) {
+            _logger->warn("8814 IQK path {} {} timeout", path,
+                          idx == kTxIqk ? "TX" : "RX");
+            ResetNCTL();
+            break;
+          }
+        }
+
+        if (fail) {
+          ++calRetry;
+        }
+        if (calRetry > 3) {
+          break;
+        }
+      }
+
+      _device.rtw_write32(0x1b00, 0xf8000000u | (path << 1));
+
+      if (!fail) {
+        if (idx == kTxIqk) {
+          /* TX IQC matrix read from 0x1b38. */
+          (void)_device.rtw_read32(0x1b38);
+        } else {
+          _device.rtw_write32(0x1b3c, 0x20000000);
+          (void)_device.rtw_read32(0x1b3c);
+        }
+      }
+
+      if (idx == kRxIqk) {
+        /* TXIQK success → write TX IQC to 0x1b38. Else clear IQK_Apply
+         * bit 0 (disable TX IQC). */
+        /* NOTE: devourer doesn't cache per-path TX-IQK success state
+         * because we recompute every channel-set. If TX IQK failed
+         * just now in the same loop pass, we can't tell here without
+         * a per-path success vector. Mirror upstream's behavior with
+         * a simple per-iteration carry: if the just-completed RX-IQK
+         * passes and TX-IQK didn't fail, the HW already wrote IQC. */
+        if (fail) {
+          /* RX IQK Fail → clear IQK_Apply bits 11:10. */
+          _device.phy_set_bb_reg(kIqkApply[path], Bit(11) | Bit(10), 0x0);
+        }
+      }
+    }
+  }
+}
+
+void Iqk8814a::IqkTx(BandType band) {
+  /* Path-wide BB-CCA off plus RF reg 0x58 BIT19 set, then 0x1b00 with
+   * band-dependent CMD enable, then LOK + IQK_OneShot. */
+  _radio->phy_set_rf_reg(RfPath::RF_PATH_A, 0x58, Bit(19), 0x1);
+  _radio->phy_set_rf_reg(RfPath::RF_PATH_B, 0x58, Bit(19), 0x1);
+  _radio->phy_set_rf_reg(RfPath::RF_PATH_C, 0x58, Bit(19), 0x1);
+  _radio->phy_set_rf_reg(RfPath::RF_PATH_D, 0x58, Bit(19), 0x1);
+
+  _device.phy_set_bb_reg(0xc94, Bit(11) | Bit(10) | Bit(0), 0x401);
+  _device.phy_set_bb_reg(0xe94, Bit(11) | Bit(10) | Bit(0), 0x401);
+  _device.phy_set_bb_reg(0x1894, Bit(11) | Bit(10) | Bit(0), 0x401);
+  _device.phy_set_bb_reg(0x1a94, Bit(11) | Bit(10) | Bit(0), 0x401);
+
+  if (band == BandType::BAND_ON_5G) {
+    _device.rtw_write32(0x1b00, 0xf8000ff1);
+  } else {
+    _device.rtw_write32(0x1b00, 0xf8000ef1);
+  }
+  DelayMs(1);
+
+  _device.rtw_write32(0x810, 0x20101063);
+  _device.rtw_write32(0x90c, 0x0B00C000);
+
+  LokOneShot();
+  IqkOneShot();
+}
+
+void Iqk8814a::Calibrate(uint8_t channel, BandType band, bool is_recovery) {
+  (void)is_recovery;
+  (void)channel;
+
+  /* Backup register addresses — verbatim from upstream
+   * `_phy_iq_calibrate_8814a` (halrf_iqk_8814a.c:472). */
+  const uint32_t backupMacReg[kMacRegNum] = {0x520, 0x550};
+  const uint32_t backupBbReg[kBbRegNum] = {
+      0xa14, 0x808,  0x838,  0x90c,  0x810, 0xcb0, 0xeb0,
+      0x18b4, 0x1ab4, 0x1abc, 0x9a4, 0x764, 0xcbc};
+  const uint32_t backupRfReg[kRfRegNum] = {0x0, 0x8f};
+
+  uint32_t macBackup[kMacRegNum]{};
+  uint32_t bbBackup[kBbRegNum]{};
+  uint32_t rfBackup[kRfRegNum][4]{};
+
+  BackupMacBb(backupMacReg, macBackup, backupBbReg, bbBackup);
+  AFESetting(/*doIqk=*/true);
+  BackupRf(backupRfReg, rfBackup);
+  ConfigureMAC();
+  IqkTx(band);
+  ResetNCTL();
+  AFESetting(/*doIqk=*/false);
+  RestoreMacBb(backupMacReg, macBackup, backupBbReg, bbBackup);
+  RestoreRf(backupRfReg, rfBackup);
+
+  _logger->info("Iqk8814a::Calibrate done (channel={}, band={})",
+                unsigned(channel),
+                band == BandType::BAND_ON_5G ? "5G" : "2.4G");
+}
diff --git a/src/Iqk8814a.h b/src/Iqk8814a.h
new file mode 100644
index 0000000..89d65ec
--- /dev/null
+++ b/src/Iqk8814a.h
@@ -0,0 +1,77 @@
+#ifndef IQK_8814A_H
+#define IQK_8814A_H
+
+#include "EepromManager.h"
+#include "RfPath.h"
+#include "RtlUsbAdapter.h"
+#include "logger.h"
+
+#include <cstdint>
+#include <memory>
+
+class RadioManagementModule;
+enum class BandType;
+
+/* Port of upstream phydm's I/Q calibration for the 8814AU. Mirrors
+ * `phy_iq_calibrate_8814a` -> `_phy_iq_calibrate_8814a` ->
+ * `_IQK_Tx_8814A` in `aircrack-ng/rtl8812au/hal/phydm/halrf/rtl8814a/
+ * halrf_iqk_8814a.c`.
+ *
+ * 8814 IQK differs structurally from 8812 IQK:
+ *   - 4 RF paths (A/B/C/D) instead of 2.
+ *   - HW-driven via the 0x1b00 NCO Control trigger register. Devourer
+ *     writes a CMD ID into 0x1b00, polls 0x1b00 bit 0 for completion,
+ *     and reads result coefficients from 0x1b38 / 0x1b3c — no
+ *     iterative tone-sweep loop.
+ *   - Separate LO leakage calibration (LOK) phase before TX/RX-IQK.
+ *   - Path-C/D RFE pinmux at 0x18b4 / 0x1ab4 / 0x1abc included in
+ *     backup set.
+ *
+ * Closes the documented post-channel-set RF[A]/[B] 0x00 bit-15
+ * divergence at 5G (kernel achieves bit 15 = 0 by running this
+ * routine after channel-set; devourer without it sits in SW-LNA
+ * mode).
+ *
+ * IQK takes ~50-100 ms per invocation. Caller serialises against
+ * channel-set, TX/RX activity, pwrtrk ticks.
+ *
+ * Out of scope:
+ *   - FW-offload IQK — devourer has no H2C mailbox.
+ *   - Per-channel IQC matrix caching — full recompute each trigger.
+ *   - LC calibration / DPK — separate calibrations not in canary path.
+ */
+class Iqk8814a {
+public:
+  Iqk8814a(RtlUsbAdapter device, std::shared_ptr<EepromManager> eepromManager,
+           RadioManagementModule *radio, Logger_t logger);
+
+  /* Run a full I/Q calibration for 8814A. is_recovery == false runs
+   * the full LOK + TX-IQK + RX-IQK path on all four RF paths. true
+   * is reserved for the cached-reload short-circuit (not yet wired). */
+  void Calibrate(uint8_t channel, BandType band, bool is_recovery);
+
+private:
+  RtlUsbAdapter _device;
+  std::shared_ptr<EepromManager> _eepromManager;
+  RadioManagementModule *_radio;
+  Logger_t _logger;
+
+  static constexpr int kMacRegNum = 2;
+  static constexpr int kBbRegNum = 13;
+  static constexpr int kRfRegNum = 2;
+
+  void BackupMacBb(const uint32_t *macRegs, uint32_t *macOut,
+                   const uint32_t *bbRegs, uint32_t *bbOut);
+  void BackupRf(const uint32_t *regs, uint32_t out[][4]);
+  void AFESetting(bool doIqk);
+  void RestoreMacBb(const uint32_t *macRegs, const uint32_t *macBackup,
+                    const uint32_t *bbRegs, const uint32_t *bbBackup);
+  void RestoreRf(const uint32_t *regs, const uint32_t backup[][4]);
+  void ResetNCTL();
+  void ConfigureMAC();
+  void IqkTx(BandType band);
+  void LokOneShot();
+  void IqkOneShot();
+};
+
+#endif /* IQK_8814A_H */
diff --git a/src/PhydmWatchdog.cpp b/src/PhydmWatchdog.cpp
new file mode 100644
index 0000000..64b3b7c
--- /dev/null
+++ b/src/PhydmWatchdog.cpp
@@ -0,0 +1,274 @@
+#include "PhydmWatchdog.h"
+
+#include "RadioManagementModule.h"
+
+#include <algorithm>
+#include <chrono>
+
+namespace {
+
+/* Phydm AC FA counter register addresses, from
+ * `hal/phydm/phydm_regdefine11ac.h`. */
+constexpr uint16_t kRegOfdmFaType1 = 0xFCC; /* fast_fsync hi 16 */
+constexpr uint16_t kRegOfdmFaType2 = 0xFD0; /* sb_search_fail lo 16 */
+constexpr uint16_t kRegOfdmFaType3 = 0xFBC; /* parity_fail / rate_illegal */
+constexpr uint16_t kRegOfdmFaType4 = 0xFC0; /* crc8_fail / mcs_fail */
+constexpr uint16_t kRegOfdmFaType5 = 0xFC4; /* vht_crc8_fail */
+constexpr uint16_t kRegOfdmFaType6 = 0xFC8; /* vht_mcs_fail */
+constexpr uint16_t kRegOfdmFail = 0xF48;    /* OFDM FA count */
+constexpr uint16_t kRegCckFa = 0xA5C;       /* CCK FA count */
+constexpr uint16_t kRegCckCcaCnt = 0xF08;   /* CCK/OFDM CCA count */
+constexpr uint16_t kRegCckCrc32Cnt = 0xF04;
+constexpr uint16_t kRegVhtCrc32Cnt = 0xF0c;
+constexpr uint16_t kRegHtCrc32Cnt = 0xF10;
+constexpr uint16_t kRegOfdmCrc32Cnt = 0xF14;
+constexpr uint16_t kRegBbRxPath = 0x808; /* BIT(28) = CCK enable */
+
+constexpr uint32_t kMaskDWord = 0xFFFFFFFF;
+constexpr uint32_t kMaskLWord = 0x0000FFFF;
+constexpr uint32_t kBit28 = 1u << 28;
+constexpr uint32_t kBit17 = 1u << 17;
+constexpr uint32_t kBit15 = 1u << 15;
+constexpr uint32_t kBit0 = 1u << 0;
+
+/* Watchdog tick interval. Upstream uses 2s on Linux (CE) per
+ * `ADAPTIVITY_INTERVAL` / phydm_interface.c. */
+constexpr auto kTickInterval = std::chrono::seconds(2);
+
+} // namespace
+
+PhydmWatchdog::PhydmWatchdog(RtlUsbAdapter device,
+                             std::shared_ptr<EepromManager> eepromManager,
+                             RadioManagementModule *radio, Logger_t logger)
+    : _device(device), _eepromManager(eepromManager), _radio(radio),
+      _logger(logger) {}
+
+PhydmWatchdog::~PhydmWatchdog() { Stop(); }
+
+void PhydmWatchdog::Start() {
+  bool expected = false;
+  if (!_running.compare_exchange_strong(expected, true)) {
+    return; /* already running */
+  }
+  _stop.store(false);
+  _thread = std::thread([this]() { ThreadLoop(); });
+}
+
+void PhydmWatchdog::Stop() {
+  bool expected = true;
+  if (!_running.compare_exchange_strong(expected, false)) {
+    return; /* not running */
+  }
+  _stop.store(true);
+  if (_thread.joinable()) {
+    _thread.join();
+  }
+}
+
+void PhydmWatchdog::ThreadLoop() {
+  /* Wake every kTickInterval and run TickOnce. Interruptible via
+   * _stop. Use short polled sleeps (200ms) so Stop() returns
+   * quickly even mid-interval. */
+  auto next_tick = std::chrono::steady_clock::now() + kTickInterval;
+  while (!_stop.load()) {
+    if (std::chrono::steady_clock::now() >= next_tick) {
+      TickOnce();
+      next_tick = std::chrono::steady_clock::now() + kTickInterval;
+    }
+    std::this_thread::sleep_for(std::chrono::milliseconds(200));
+  }
+}
+
+void PhydmWatchdog::TickOnce() {
+  /* Read FA counters (no-op if BB isn't running yet — counters
+   * read zero). Then reset the counter latches so the next tick
+   * captures only the delta. */
+  FaCnt fa{};
+  ReadFaCountersAc(fa);
+  _lastFaCnt = fa;
+  ResetFaCountersAc();
+
+  /* DIG (Dynamic Initial Gain) — walk per-path IGI based on FA
+   * count. Reads BB 0xc50 byte 0 on the first tick to seed
+   * `cur_ig_value`, then on subsequent ticks adjusts and writes
+   * to all 4 paths (paths C/D writes are 8814-only; harmless
+   * write-only on 8812/8821). */
+  if (!_digInitialised) {
+    DigInit();
+    _digInitialised = true;
+  }
+  DigTick(fa.cnt_all);
+}
+
+void PhydmWatchdog::ReadFaCountersAc(FaCnt &out) {
+  /* Port of `phydm_fa_cnt_statistics_ac` (phydm_dig.c:1421).
+   * Reads OFDM/CCK FA + CCA + CRC32 counters from page-F BB
+   * registers. Fields not needed for the watchdog's own logic are
+   * skipped; the canonical phydm struct populates ~14 counters
+   * total and we cover the same set. */
+  uint32_t v = 0;
+
+  /* OFDM FA breakdown — kept for diagnostics, not used by the
+   * current minimal watchdog logic. */
+  (void)_radio->phy_query_bb_reg_public(kRegOfdmFaType1, kMaskDWord);
+  (void)_radio->phy_query_bb_reg_public(kRegOfdmFaType2, kMaskDWord);
+  (void)_radio->phy_query_bb_reg_public(kRegOfdmFaType3, kMaskDWord);
+  (void)_radio->phy_query_bb_reg_public(kRegOfdmFaType4, kMaskDWord);
+  (void)_radio->phy_query_bb_reg_public(kRegOfdmFaType5, kMaskDWord);
+  (void)_radio->phy_query_bb_reg_public(kRegOfdmFaType6, kMaskDWord);
+
+  /* OFDM/CCK FA counts. */
+  out.cnt_ofdm_fail =
+      _radio->phy_query_bb_reg_public(kRegOfdmFail, kMaskLWord);
+  out.cnt_cck_fail =
+      _radio->phy_query_bb_reg_public(kRegCckFa, kMaskLWord);
+
+  /* CCA counts. */
+  v = _radio->phy_query_bb_reg_public(kRegCckCcaCnt, kMaskDWord);
+  out.cnt_ofdm_cca = (v & 0xffff0000) >> 16;
+  out.cnt_cck_cca = v & 0xffff;
+
+  /* CRC32 counters. */
+  v = _radio->phy_query_bb_reg_public(kRegCckCrc32Cnt, kMaskDWord);
+  out.cnt_cck_crc32_error = (v & 0xffff0000) >> 16;
+  out.cnt_cck_crc32_ok = v & 0xffff;
+
+  v = _radio->phy_query_bb_reg_public(kRegOfdmCrc32Cnt, kMaskDWord);
+  out.cnt_ofdm_crc32_error = (v & 0xffff0000) >> 16;
+  out.cnt_ofdm_crc32_ok = v & 0xffff;
+
+  v = _radio->phy_query_bb_reg_public(kRegHtCrc32Cnt, kMaskDWord);
+  out.cnt_ht_crc32_error = (v & 0xffff0000) >> 16;
+  out.cnt_ht_crc32_ok = v & 0xffff;
+
+  v = _radio->phy_query_bb_reg_public(kRegVhtCrc32Cnt, kMaskDWord);
+  out.cnt_vht_crc32_error = (v & 0xffff0000) >> 16;
+  out.cnt_vht_crc32_ok = v & 0xffff;
+
+  /* Cumulative FA + CCA. CCK bits live in 0x808 BIT(28); if set,
+   * BB is using CCK so total includes CCK + OFDM. Otherwise OFDM
+   * only. */
+  const bool cck_enable =
+      _radio->phy_query_bb_reg_public(kRegBbRxPath, kBit28) != 0;
+  if (cck_enable) {
+    out.cnt_all = out.cnt_ofdm_fail + out.cnt_cck_fail;
+    out.cnt_cca_all = out.cnt_ofdm_cca + out.cnt_cck_cca;
+  } else {
+    out.cnt_all = out.cnt_ofdm_fail;
+    out.cnt_cca_all = out.cnt_ofdm_cca;
+  }
+}
+
+void PhydmWatchdog::ResetFaCountersAc() {
+  /* Port of `phydm_false_alarm_counter_reg_reset` AC branch
+   * (phydm_dig.c:1287-1298). Pulses the OFDM/CCK FA counter
+   * reset bits, then resets the PMAC/PHY counter via
+   * `phydm_reset_bb_hw_cnt` (R_0xb58 BIT(0)). */
+  /* OFDM FA counter reset (R_0x9a4 BIT(17) toggle). */
+  _device.phy_set_bb_reg(0x9a4, kBit17, 1);
+  _device.phy_set_bb_reg(0x9a4, kBit17, 0);
+
+  /* CCK FA counter reset (R_0xa2c BIT(15) toggle). */
+  _device.phy_set_bb_reg(0xa2c, kBit15, 0);
+  _device.phy_set_bb_reg(0xa2c, kBit15, 1);
+
+  /* All-counter reset (R_0xb58 BIT(0) toggle). */
+  _device.phy_set_bb_reg(0xb58, kBit0, 1);
+  _device.phy_set_bb_reg(0xb58, kBit0, 0);
+}
+
+PhydmWatchdog::FaCnt PhydmWatchdog::LastFaCnt() const { return _lastFaCnt; }
+
+void PhydmWatchdog::DigInit() {
+  /* Port of `phydm_dig_init` (phydm_dig.c:726). Reads current
+   * BB 0xc50 byte 0 as the initial IGI value. Bounds match the
+   * Jaguar AC family monitor-mode (!is_linked) configuration:
+   * coverage 0x1c..0x26, with dig_max_of_min = 0x2a as the upper
+   * bound when nothing's linked. */
+  _cur_ig_value =
+      static_cast<uint8_t>(_radio->phy_query_bb_reg_public(0xc50, 0xff));
+  _rx_gain_range_max = _dig_max_of_min;
+  _rx_gain_range_min = _dm_dig_min;
+  _logger->info("PhydmWatchdog::DigInit cur_ig=0x{:02x} bounds=[0x{:02x},0x{:02x}]",
+                unsigned(_cur_ig_value),
+                unsigned(_rx_gain_range_min),
+                unsigned(_rx_gain_range_max));
+}
+
+void PhydmWatchdog::DigTick(uint32_t fa_cnt) {
+  /* Port of `phydm_dig` (phydm_dig.c:1066), monitor-mode subset.
+   * Always !is_linked since devourer doesn't track link state.
+   * `phydm_dig_abs_boundary_decision`: dm_dig_max = COVERAGR (0x26),
+   * dm_dig_min = COVERAGE (0x1c). `phydm_dig_dym_boundary_decision`:
+   * rx_gain_range_{max,min} stay at {dig_max_of_min, dm_dig_min}.
+   * `phydm_new_igi_by_fa`: step={2,1,2}, FA thresholds={250,500,750}.
+   *
+   * Per `phydm_get_new_igi` (phydm_dig.c:952), monitor-mode walk:
+   *   fa > 750 → igi += 2 (saturate)
+   *   fa > 500 → igi += 1
+   *   fa < 250 → igi -= 2
+   * Then clamp to [rx_gain_range_min, rx_gain_range_max]. */
+  constexpr uint16_t kFaTh0 = 250;
+  constexpr uint16_t kFaTh1 = 500;
+  constexpr uint16_t kFaTh2 = 750;
+  constexpr uint8_t kStepUp1 = 2; /* fa > kFaTh2 */
+  constexpr uint8_t kStepUp2 = 1; /* fa > kFaTh1 */
+  constexpr uint8_t kStepDown = 2; /* fa < kFaTh0 */
+
+  /* Refresh bounds from abs_boundary_decision + dym_boundary_decision
+   * each tick (cheap, makes the !is_linked behaviour explicit). */
+  _dm_dig_max = 0x26;
+  _dm_dig_min = 0x1c;
+  _rx_gain_range_max = _dig_max_of_min;
+  _rx_gain_range_min = _dm_dig_min;
+
+  uint8_t new_igi = _cur_ig_value;
+  if (fa_cnt > kFaTh2) {
+    new_igi += kStepUp1;
+  } else if (fa_cnt > kFaTh1) {
+    new_igi += kStepUp2;
+  } else if (fa_cnt < kFaTh0) {
+    if (new_igi >= kStepDown) {
+      new_igi -= kStepDown;
+    } else {
+      new_igi = 0;
+    }
+  }
+
+  if (new_igi < _rx_gain_range_min) {
+    new_igi = _rx_gain_range_min;
+  }
+  if (new_igi > _rx_gain_range_max) {
+    new_igi = _rx_gain_range_max;
+  }
+
+  if (new_igi != _cur_ig_value) {
+    _logger->debug("PhydmWatchdog::DigTick fa={} igi 0x{:02x}->0x{:02x}",
+                   fa_cnt, unsigned(_cur_ig_value), unsigned(new_igi));
+    DigWriteIgi(new_igi);
+    _cur_ig_value = new_igi;
+  } else {
+    /* Re-write the same value to ensure the BB reg is in sync
+     * with our cached cur_ig_value (matters on first tick when
+     * BB-init left a different value than `phydm_SetIgiFloor_Jaguar`
+     * later overwrote). */
+    DigWriteIgi(new_igi);
+  }
+}
+
+void PhydmWatchdog::DigWriteIgi(uint8_t igi) {
+  /* Port of `phydm_write_dig_reg_c50` (phydm_dig.c:501). Writes
+   * the IGI byte to all populated path-IGI registers. Path C/D
+   * writes are 8814-only but writing them on 8812/8821 is
+   * harmless: those chips' BB regs at 0x1850/0x1a50 are reserved
+   * and ignore writes.
+   *
+   * NOTE: this duplicates the chip-family path-count check that
+   * RadioManagementModule does, but we don't have the EEPROM
+   * version_id easily accessible from here. Writing the unused
+   * paths is a no-op on non-8814. */
+  _device.phy_set_bb_reg(0xc50, 0xff, igi); /* path A — rA_IGI_Jaguar */
+  _device.phy_set_bb_reg(0xe50, 0xff, igi); /* path B — rB_IGI_Jaguar */
+  _device.phy_set_bb_reg(0x1850, 0xff, igi); /* path C — 8814 only */
+  _device.phy_set_bb_reg(0x1a50, 0xff, igi); /* path D — 8814 only */
+}
diff --git a/src/PhydmWatchdog.h b/src/PhydmWatchdog.h
new file mode 100644
index 0000000..d69dfbe
--- /dev/null
+++ b/src/PhydmWatchdog.h
@@ -0,0 +1,124 @@
+#ifndef PHYDM_WATCHDOG_H
+#define PHYDM_WATCHDOG_H
+
+#include "EepromManager.h"
+#include "RtlUsbAdapter.h"
+#include "logger.h"
+
+#include <atomic>
+#include <cstdint>
+#include <memory>
+#include <thread>
+
+class RadioManagementModule;
+
+/* Periodic phydm DM watchdog — runs every ~2s to drive dynamic
+ * management modules (FA counter statistics, DIG, RSSI tracking,
+ * etc.) the way upstream's `phydm_watchdog` does.
+ *
+ * Upstream `phydm_watchdog` (hal/phydm/phydm.c:1985) chains together:
+ *   phydm_phy_info_update, phydm_rssi_monitor_check,
+ *   phydm_false_alarm_counter_statistics, phydm_noisy_detection,
+ *   phydm_dig, phydm_cck_pd_th, phydm_adaptivity, phydm_ra_info_watchdog,
+ *   phydm_tx_path_diversity, phydm_cfo_tracking, phydm_dynamic_tx_power,
+ *   odm_antenna_diversity, phydm_beamforming_watchdog, halrf_watchdog,
+ *   phydm_primary_cca, ...
+ *
+ * Devourer's port scope (this header):
+ *   - FA counter statistics for the AC family (8812/8814/8821) —
+ *     reads BB OFDM/CCK FA+CCA counters at 0xfcc..0xfd0, resets at
+ *     tick boundary so successive ticks see only the delta.
+ *
+ * Out of scope (added as separate ports):
+ *   - RSSI monitor / CFO tracking / adaptivity — depend on TX/RX
+ *     activity which devourer drives via its own paths.
+ *   - Beamforming, antenna diversity — out of scope for monitor mode.
+ *
+ * Thread model: spawns a single background `std::thread` that wakes
+ * every 2s, runs `TickOnce()`, sleeps again. Stops cleanly on
+ * destruction (sets _stop, joins). `TickOnce()` is also callable
+ * directly (used at end-of-init for an immediate first cycle so the
+ * canary capture sees post-watchdog state). */
+class PhydmWatchdog {
+public:
+  PhydmWatchdog(RtlUsbAdapter device,
+                std::shared_ptr<EepromManager> eepromManager,
+                RadioManagementModule *radio, Logger_t logger);
+  ~PhydmWatchdog();
+
+  /* Spawn the watchdog thread. Idempotent. */
+  void Start();
+  /* Signal stop + join. Idempotent. Called from destructor. */
+  void Stop();
+  /* Run one watchdog cycle synchronously on the calling thread. */
+  void TickOnce();
+
+  /* Most-recent FA counter snapshot — exposed for diagnostics /
+   * future DIG integration. */
+  struct FaCnt {
+    uint32_t cnt_ofdm_fail;
+    uint32_t cnt_cck_fail;
+    uint32_t cnt_ofdm_cca;
+    uint32_t cnt_cck_cca;
+    uint32_t cnt_ht_crc32_error;
+    uint32_t cnt_ht_crc32_ok;
+    uint32_t cnt_vht_crc32_error;
+    uint32_t cnt_vht_crc32_ok;
+    uint32_t cnt_ofdm_crc32_error;
+    uint32_t cnt_ofdm_crc32_ok;
+    uint32_t cnt_cck_crc32_error;
+    uint32_t cnt_cck_crc32_ok;
+    uint32_t cnt_all;
+    uint32_t cnt_cca_all;
+  };
+  FaCnt LastFaCnt() const;
+
+private:
+  void ThreadLoop();
+  /* Port of `phydm_fa_cnt_statistics_ac` (phydm_dig.c:1421). Reads
+   * OFDM/CCK FA + CCA + CRC32 counters from page-F BB registers. */
+  void ReadFaCountersAc(FaCnt &out);
+  /* Port of `phydm_false_alarm_counter_reg_reset` AC branch
+   * (phydm_dig.c:1287-1298). Pulses BB reg toggles to clear the
+   * counter latches so the next tick captures fresh-since-now
+   * counts. */
+  void ResetFaCountersAc();
+  /* Port of `phydm_dig` (phydm_dig.c:1066) walking BB 0xc50/0xe50/
+   * 0x1850/0x1a50 byte 0 (per-path IGI) based on the most recent
+   * FA count. Always hits the !is_linked monitor-mode path: bounds
+   * [DIG_MIN_COVERAGE=0x1c, DIG_MAX_OF_MIN_BALANCE_MODE=0x2a],
+   * step={2,1,2}, FA thresholds={250,500,750}. */
+  void DigInit();
+  void DigTick(uint32_t fa_cnt);
+  void DigWriteIgi(uint8_t igi);
+
+  RtlUsbAdapter _device;
+  std::shared_ptr<EepromManager> _eepromManager;
+  RadioManagementModule *_radio;
+  Logger_t _logger;
+
+  std::thread _thread;
+  std::atomic<bool> _running{false};
+  std::atomic<bool> _stop{false};
+
+  /* Latest snapshot. mutable so const accessor is feasible without
+   * dragging in a mutex; reader sees a torn-but-bounded copy. */
+  mutable FaCnt _lastFaCnt{};
+
+  /* DIG state, mirroring `struct phydm_dig_struct` minus the fields
+   * we don't use (TDMA, damping check, antdiv override). All in
+   * "monitor mode, never linked" semantics — we never look at
+   * rssi_min / is_linked because devourer doesn't track them.
+   * `_digInitialised` distinguishes the first tick (which reads
+   * BB 0xc50 to seed cur_ig_value) from subsequent ticks (which
+   * just walk based on FA count). */
+  bool _digInitialised = false;
+  uint8_t _cur_ig_value = 0x20;
+  uint8_t _dm_dig_max = 0x26;       /* DIG_MAX_COVERAGR */
+  uint8_t _dm_dig_min = 0x1c;       /* DIG_MIN_COVERAGE */
+  uint8_t _dig_max_of_min = 0x2a;   /* DIG_MAX_OF_MIN_BALANCE_MODE */
+  uint8_t _rx_gain_range_max = 0x2a;
+  uint8_t _rx_gain_range_min = 0x1c;
+};
+
+#endif /* PHYDM_WATCHDOG_H */
diff --git a/src/RadioManagementModule.cpp b/src/RadioManagementModule.cpp
index 22360b4..72c2352 100644
--- a/src/RadioManagementModule.cpp
+++ b/src/RadioManagementModule.cpp
@@ -50,7 +50,8 @@ RadioManagementModule::RadioManagementModule(
     Logger_t logger)
     : _device{device}, _eepromManager{eepromManager}, _logger{logger},
       _pwrTrk{device, eepromManager, this, logger},
-      _iqk{device, eepromManager, this, logger} {}
+      _iqk{device, eepromManager, this, logger},
+      _iqk8814{device, eepromManager, this, logger} {}
 
 void RadioManagementModule::RunIQK() {
   _iqk.Calibrate(_currentChannel, current_band_type, /*is_recovery=*/false);
@@ -300,8 +301,14 @@ void RadioManagementModule::phy_SwChnlAndSetBwMode8812() {
    * is thermal-meter-driven so small (~1-step) divergence is expected
    * if devourer and kernel sampled the chip at non-identical
    * temperatures. Capture both dumps within a few seconds for clean
-   * parity. */
-  if (std::getenv("DEVOURER_DUMP_CANARY")) {
+   * parity.
+   *
+   * The IQK trigger BELOW runs phydm I/Q calibration which touches
+   * RF[*][0x0] / RF[*][0x8f] + BB IQK-output regs (0xc90 / 0xe90 /
+   * 0xcc4 / etc). We capture the canary AFTER IQK so it reflects the
+   * post-calibration state — matching kernel semantics where IQK is
+   * part of the channel-set callback. */
+  const auto dump_canary = [this]() {
     /* Per-chip canary set. Each Jaguar variant has a different active
      * RF/path footprint:
      *   - 8821AU is 1T1R AC: only path-A exists physically. Path-B BB-AGC
@@ -372,7 +379,7 @@ void RadioManagementModule::phy_SwChnlAndSetBwMode8812() {
         _logger->info("RF[B] 0x{:02x} = 0x{:05X}", a,
                       phy_query_rf_reg(RfPath::RF_PATH_B, a, 0xfffffu));
     _logger->info("=== END DEVOURER_DUMP_CANARY ===");
-  }
+  };
 
   /* Trigger I/Q calibration. Set by `phy_SwBand8812` on band
    * transitions and (post-init) on the very first channel-set via
@@ -384,9 +391,19 @@ void RadioManagementModule::phy_SwChnlAndSetBwMode8812() {
     if (_eepromManager->version_id.ICType == CHIP_8812) {
       _iqk.Calibrate(_currentChannel, current_band_type,
                      /*is_recovery=*/false);
+    } else if (_eepromManager->version_id.ICType == CHIP_8814A) {
+      _iqk8814.Calibrate(_currentChannel, current_band_type,
+                         /*is_recovery=*/false);
     }
   }
   _needIQK = false;
+
+  /* Canary dump runs LAST so it captures the post-IQK / post-pwrtrk
+   * state — same observation order as kernel iface reads via
+   * `iwpriv read 4,<addr>`. */
+  if (std::getenv("DEVOURER_DUMP_CANARY")) {
+    dump_canary();
+  }
 }
 
 void RadioManagementModule::phy_set_rf_reg(RfPath eRFPath, uint16_t RegAddr,
@@ -817,6 +834,197 @@ void RadioManagementModule::phy_SetRFEReg8812(BandType Band) {
   }
 }
 
+/* Port of upstream `PHY_SetRFEReg8814A` band-switch path (bInit=false)
+ * from `aircrack-ng/rtl8812au/hal/rtl8814a/rtl8814a_phycfg.c:1567`.
+ * 8814AU has its own RFE pinmux for all four paths (A/B/C/D) at
+ * 0xCB0 / 0xEB0 / 0x18B4 / 0x1AB4 plus the 0x1ABC[27:20] tail;
+ * the 8812 RFE function never touches the path-C/D regs so running
+ * it on 8814 leaves the LNA in SW-managed mode (visible as RF[A] 0x00
+ * bit 15 = 1 in canary diff) and the path-C/D antenna mux unprogrammed.
+ *
+ * rfe_type comes from EFUSE. Cases 0/1/2 are the only ones upstream
+ * 8814A handles; other rfe_type values fall through to case 0/default. */
+void RadioManagementModule::phy_SetRFEReg8814A(BandType Band) {
+  const auto rfe_type = _eepromManager->rfe_type;
+  if (Band == BandType::BAND_ON_2_4G) {
+    switch (rfe_type) {
+    case 2:
+      _device.phy_set_bb_reg(rA_RFE_Pinmux_Jaguar, bMaskDWord, 0x72707270);
+      _device.phy_set_bb_reg(rB_RFE_Pinmux_Jaguar, bMaskDWord, 0x72707270);
+      _device.phy_set_bb_reg(0x18B4, bMaskDWord, 0x72707270); /* rC_RFE_Pinmux */
+      _device.phy_set_bb_reg(0x1AB4, bMaskDWord, 0x77707770); /* rD_RFE_Pinmux */
+      _device.phy_set_bb_reg(0x1ABC, 0x0FF00000, 0x72);        /* [27:20] */
+      break;
+    case 1:
+      _device.phy_set_bb_reg(rA_RFE_Pinmux_Jaguar, bMaskDWord, 0x77777777);
+      _device.phy_set_bb_reg(rB_RFE_Pinmux_Jaguar, bMaskDWord, 0x77777777);
+      _device.phy_set_bb_reg(0x18B4, bMaskDWord, 0x77777777);
+      _device.phy_set_bb_reg(0x1AB4, bMaskDWord, 0x77777777);
+      _device.phy_set_bb_reg(0x1ABC, 0x0FF00000, 0x77);
+      break;
+    case 0:
+    default:
+      _device.phy_set_bb_reg(rA_RFE_Pinmux_Jaguar, bMaskDWord, 0x77777777);
+      _device.phy_set_bb_reg(rB_RFE_Pinmux_Jaguar, bMaskDWord, 0x77777777);
+      _device.phy_set_bb_reg(0x18B4, bMaskDWord, 0x77777777);
+      /* Upstream case-0/default skips rD_RFE_Pinmux entirely. */
+      _device.phy_set_bb_reg(0x1ABC, 0x0FF00000, 0x77);
+      break;
+    }
+  } else {
+    switch (rfe_type) {
+    case 2:
+      _device.phy_set_bb_reg(rA_RFE_Pinmux_Jaguar, bMaskDWord, 0x33173717);
+      _device.phy_set_bb_reg(rB_RFE_Pinmux_Jaguar, bMaskDWord, 0x33173717);
+      _device.phy_set_bb_reg(0x18B4, bMaskDWord, 0x33173717);
+      _device.phy_set_bb_reg(0x1AB4, bMaskDWord, 0x77177717);
+      _device.phy_set_bb_reg(0x1ABC, 0x0FF00000, 0x37);
+      break;
+    case 1:
+      _device.phy_set_bb_reg(rA_RFE_Pinmux_Jaguar, bMaskDWord, 0x33173317);
+      _device.phy_set_bb_reg(rB_RFE_Pinmux_Jaguar, bMaskDWord, 0x33173317);
+      _device.phy_set_bb_reg(0x18B4, bMaskDWord, 0x33173317);
+      _device.phy_set_bb_reg(0x1AB4, bMaskDWord, 0x77177717);
+      _device.phy_set_bb_reg(0x1ABC, 0x0FF00000, 0x33);
+      break;
+    case 0:
+    default:
+      _device.phy_set_bb_reg(rA_RFE_Pinmux_Jaguar, bMaskDWord, 0x54775477);
+      _device.phy_set_bb_reg(rB_RFE_Pinmux_Jaguar, bMaskDWord, 0x54775477);
+      _device.phy_set_bb_reg(0x18B4, bMaskDWord, 0x54775477);
+      _device.phy_set_bb_reg(0x1AB4, bMaskDWord, 0x54775477);
+      _device.phy_set_bb_reg(0x1ABC, 0x0FF00000, 0x54);
+      break;
+    }
+  }
+}
+
+/* Port of upstream `phy_SetBwRegAdc_8814A`
+ * (rtl8814a_phycfg.c:1454). Programs rRFMOD_Jaguar (0x8AC) bits [1:0]
+ * per bandwidth; both bands write the same value here. */
+void RadioManagementModule::phy_SetBwRegAdc_8814A(BandType Band,
+                                                  ChannelWidth_t bw) {
+  (void)Band;
+  uint32_t val;
+  switch (bw) {
+  case ChannelWidth_t::CHANNEL_WIDTH_20:
+    val = 0x0;
+    break;
+  case ChannelWidth_t::CHANNEL_WIDTH_40:
+    val = 0x1;
+    break;
+  case ChannelWidth_t::CHANNEL_WIDTH_80:
+    val = 0x2;
+    break;
+  default:
+    _logger->error("phy_SetBwRegAdc_8814A: unknown bw {}",
+                   static_cast<int>(bw));
+    return;
+  }
+  _device.phy_set_bb_reg(rRFMOD_Jaguar, BIT1 | BIT0, val);
+}
+
+/* Port of upstream `phy_SetBwRegAgc_8814A`
+ * (rtl8814a_phycfg.c:1496). 0x82C[15:12] AGC value: 20MHz=6, 80MHz=3,
+ * 40MHz=7 (2.4G) or 8 (5G). */
+void RadioManagementModule::phy_SetBwRegAgc_8814A(BandType Band,
+                                                  ChannelWidth_t bw) {
+  uint32_t agc;
+  switch (bw) {
+  case ChannelWidth_t::CHANNEL_WIDTH_20:
+    agc = 6;
+    break;
+  case ChannelWidth_t::CHANNEL_WIDTH_40:
+    agc = (Band == BandType::BAND_ON_5G) ? 8 : 7;
+    break;
+  case ChannelWidth_t::CHANNEL_WIDTH_80:
+    agc = 3;
+    break;
+  default:
+    _logger->error("phy_SetBwRegAgc_8814A: unknown bw {}",
+                   static_cast<int>(bw));
+    return;
+  }
+  _device.phy_set_bb_reg(rAGC_table_Jaguar, 0xf000, agc);
+}
+
+/* Port of upstream `phy_SetBBSwingByBand_8814A` (rtl8814a_phycfg.c:1652).
+ * Writes TX scale bits 31:21 for all four paths. Reuses the existing
+ * `phy_get_tx_bb_swing_8812a` (extended to handle path C/D bit
+ * extraction from the EFUSE swing byte). 0x181C / 0x1A1C are the
+ * path-C/D TX scale registers per `hal/Hal8814PhyReg.h`. */
+void RadioManagementModule::phy_SetBBSwingByBand_8814A(BandType Band) {
+  _device.phy_set_bb_reg(
+      rA_TxScale_Jaguar, 0xFFE00000,
+      phy_get_tx_bb_swing_8812a(Band, RfPath::RF_PATH_A));
+  _device.phy_set_bb_reg(
+      rB_TxScale_Jaguar, 0xFFE00000,
+      phy_get_tx_bb_swing_8812a(Band, RfPath::RF_PATH_B));
+  _device.phy_set_bb_reg(
+      0x181c, 0xFFE00000,
+      phy_get_tx_bb_swing_8812a(Band, RfPath::RF_PATH_C));
+  _device.phy_set_bb_reg(
+      0x1a1c, 0xFFE00000,
+      phy_get_tx_bb_swing_8812a(Band, RfPath::RF_PATH_D));
+}
+
+/* Port of upstream `PHY_SwitchWirelessBand8814A`
+ * (rtl8814a_phycfg.c:1688). 8814 has its own band-switch sequence,
+ * not a superset of the 8812 path. Running the 8812 band-switch on
+ * 8814 leaves path C/D RFE unprogrammed and the LNA in SW-managed
+ * mode (RF[A] 0x00 bit 15 = 1 at 5G in canary diff); the AGC table
+ * register and per-band rTxPath / rCCK_RX values also differ. The
+ * CCK+OFDM clock-gate cycle around the switch (`REG_SYS_CFG3_8814A`
+ * bit 16) is unique to 8814; upstream gates the chip's BB clocks
+ * off for the switch then re-enables. */
+void RadioManagementModule::PHY_SwitchWirelessBand8814A(BandType Band) {
+  /* `REG_SYS_CFG3_8814A = 0x1000` per `hal/rtl8814a_spec.h`; bit 16 of
+   * the dword lives in the +2 byte. */
+  constexpr uint16_t kRegSysCfg38814AHi = 0x1002;
+  constexpr uint16_t kRegCckCheck8814A  = 0x0454;
+
+  _logger->info("[{}] {}", __func__,
+                Band == BandType::BAND_ON_2_4G ? "2.4G" : "5G");
+
+  current_band_type = Band;
+
+  /* Disable BB CCK+OFDM clocks for the switch. */
+  uint8_t sys_cfg3 = _device.rtw_read8(kRegSysCfg38814AHi);
+  _device.rtw_write8(kRegSysCfg38814AHi, (uint8_t)(sys_cfg3 & ~BIT0));
+
+  if (Band == BandType::BAND_ON_2_4G) {
+    /* 8814 AGC table select lives at 0x958[4:0]
+     * (`rAGC_table_Jaguar2` in `hal/Hal8814PhyReg.h`), NOT 0x82C[1:0]
+     * (`rAGC_table_Jaguar`) — different register and different mask
+     * from the 8812 path. */
+    _device.phy_set_bb_reg(0x958, 0x1F, 0);
+    phy_SetRFEReg8814A(Band);
+    _device.phy_set_bb_reg(rTxPath_Jaguar, 0xf0, 0x2);    /* 0x80C[7:4] */
+    _device.phy_set_bb_reg(rCCK_RX_Jaguar, 0x0f000000, 0x5);
+    _device.phy_set_bb_reg(rOFDMCCKEN_Jaguar,
+                           bOFDMEN_Jaguar | bCCKEN_Jaguar, 0x3);
+    _device.rtw_write8(kRegCckCheck8814A, 0x0);
+    _device.phy_set_bb_reg(0xa80, BIT18, 0x0);            /* CCK Tx disable */
+  } else {
+    _device.rtw_write8(kRegCckCheck8814A, 0x80);
+    _device.phy_set_bb_reg(0xa80, BIT18, 0x1);            /* CCK Tx enable */
+    /* AGC table select postponed to channel switch per upstream comment. */
+    phy_SetRFEReg8814A(Band);
+    _device.phy_set_bb_reg(rTxPath_Jaguar, 0xf0, 0x0);
+    _device.phy_set_bb_reg(rCCK_RX_Jaguar, 0x0f000000, 0xF);
+    _device.phy_set_bb_reg(rOFDMCCKEN_Jaguar,
+                           bOFDMEN_Jaguar | bCCKEN_Jaguar, 0x02);
+  }
+
+  phy_SetBBSwingByBand_8814A(Band);
+  phy_SetBwRegAdc_8814A(Band, _currentChannelBw);
+  phy_SetBwRegAgc_8814A(Band, _currentChannelBw);
+
+  /* Re-enable BB CCK+OFDM clocks. */
+  sys_cfg3 = _device.rtw_read8(kRegSysCfg38814AHi);
+  _device.rtw_write8(kRegSysCfg38814AHi, (uint8_t)(sys_cfg3 | BIT0));
+}
+
 void RadioManagementModule::phy_SetBBSwingByBand_8812A(BandType Band) {
   _device.phy_set_bb_reg(
       rA_TxScale_Jaguar, 0xFFE00000,
@@ -921,6 +1129,10 @@ uint32_t RadioManagementModule::phy_get_tx_bb_swing_8812a(BandType Band,
       onePathSwing = (uint8_t)((swing & 0x3) >> 0); /* 0xC6/C7[1:0] */
     } else if (RFPath == RfPath::RF_PATH_B) {
       onePathSwing = (uint8_t)((swing & 0xC) >> 2); /* 0xC6/C7[3:2] */
+    } else if (RFPath == RfPath::RF_PATH_C) {
+      onePathSwing = (uint8_t)((swing & 0x30) >> 4); /* 0xC6/C7[5:4] — 8814 */
+    } else if (RFPath == RfPath::RF_PATH_D) {
+      onePathSwing = (uint8_t)((swing & 0xC0) >> 6); /* 0xC6/C7[7:6] — 8814 */
     }
 
     if (onePathSwing == 0x0) {
@@ -995,6 +1207,16 @@ void RadioManagementModule::Set_HW_VAR_ENABLE_RX_BAR(bool val) {
 }
 
 void RadioManagementModule::phy_SwChnl8812() {
+  /* 8814 has its own channel-set: different fc_area boundaries, RF_MOD_AG
+   * channel ranges, a 5G AGC-table sub-select at 0x958[4:0], 2.4G CCK
+   * TX DFIR writes, and the combined channel+mod RF write pattern. The
+   * 8812 path's `phy_FixSpur_8812A` workaround is also 8812-specific
+   * (cut-C ADC FIFO clock at ch11) and shouldn't run on 8814. */
+  if (_eepromManager->version_id.ICType == CHIP_8814A) {
+    phy_SwChnl8814A();
+    return;
+  }
+
   u8 channelToSW = _currentChannel;
 
   if (phy_SwBand8812(channelToSW) == false) {
@@ -1056,7 +1278,16 @@ bool RadioManagementModule::phy_SwBand8812(uint8_t channelToSW) {
   BandType Band;
   BandType BandToSW;
 
-  u1Btmp = _device.rtw_read8(REG_CCK_CHECK_8812);
+  /* 8814AU uses REG_CCK_CHECK_8814A (0x0454); 8812/8821 use
+   * REG_CCK_CHECK_8812 (typically 0x4CA). Reading the wrong register
+   * yields a bogus "current band" and triggers band-switch when it
+   * shouldn't (or skips it when it should). */
+  constexpr uint16_t kRegCckCheck8814A = 0x0454;
+  const bool is_8814 =
+      _eepromManager->version_id.ICType == CHIP_8814A;
+  const uint16_t cck_check_reg =
+      is_8814 ? kRegCckCheck8814A : REG_CCK_CHECK_8812;
+  u1Btmp = _device.rtw_read8(cck_check_reg);
   if ((u1Btmp & BIT7) != 0) {
     Band = BandType::BAND_ON_5G;
   } else {
@@ -1071,7 +1302,17 @@ bool RadioManagementModule::phy_SwBand8812(uint8_t channelToSW) {
   }
 
   if (BandToSW != Band) {
-    PHY_SwitchWirelessBand8812(BandToSW);
+    /* Per-chip band-switch. 8814 has a completely separate sequence
+     * (path-C/D RFE pinmux, 8814 AGC table register, CCK clock-gate
+     * cycle, different rTxPath/rCCK_RX values) — see
+     * `PHY_SwitchWirelessBand8814A`. 8812 and 8821 share the
+     * `PHY_SwitchWirelessBand8812` path (with `is_8821` branches
+     * inside for the 8821-specific RFE / AGC writes). */
+    if (_eepromManager->version_id.ICType == CHIP_8814A) {
+      PHY_SwitchWirelessBand8814A(BandToSW);
+    } else {
+      PHY_SwitchWirelessBand8812(BandToSW);
+    }
     /* Band transition invalidates IQK results — RX LNA, RFE pinmux,
      * BB-swing base all change. Mirror upstream where
      * `PHY_SwitchWirelessBand8812` is followed by `phy_iq_calibrate_*`
@@ -1082,8 +1323,104 @@ bool RadioManagementModule::phy_SwBand8812(uint8_t channelToSW) {
   return ret_value;
 }
 
+/* Port of upstream `phy_SwChnl8814A` (rtl8814a_phycfg.c:2448). The 8814
+ * channel-set differs from the 8812 path on several fronts:
+ *   - fc_area boundaries: 8814 splits 50-64 / 100-116 / 118+; 8812 uses
+ *     50-80 / 82-116 + an extra 15-35 case.
+ *   - RF_MOD_AG channel ranges: 8814 uses 36-64 / 100-140 / 140+ for
+ *     0x101/0x301/0x501; 8812 uses 36-80 / 82-140 / 140<.
+ *   - 5G AGC table sub-select: 8814 writes 0x958[4:0] = 1/2/3 per 5G
+ *     channel band (36-64 / 100-144 / >=149); 8812 has no equivalent.
+ *   - 2.4G CCK TX DFIR coefficients (channels 1-14): 8814 reprograms
+ *     rCCK0_TxFilter1/2 and rCCK0_DebugPort per channel range; 8812
+ *     doesn't.
+ *   - 8812-specific `phy_FixSpur_8812A` (cut-C ADC FIFO clock workaround
+ *     for ch11) is skipped entirely on 8814.
+ *
+ * Skips MP-mode-only paths (phy_ADC_CLK_8814A, phy_SpurCalibration_8814A,
+ * phy_ModifyInitialGain_8814A) — devourer only runs monitor mode.
+ * Skips the FW-offload `H2C_CHNL_SWITCH_OFFLOAD` path — devourer doesn't
+ * have the H2C mailbox plumbing. */
+void RadioManagementModule::phy_SwChnl8814A() {
+  const uint8_t channelToSW = _currentChannel;
+
+  if (phy_SwBand8812(channelToSW) == false) {
+    _logger->error("error Chnl {} !", channelToSW);
+  }
+
+  /* fc_area — 8814A boundaries. */
+  uint32_t fc_area;
+  if (36 <= channelToSW && channelToSW <= 48) {
+    fc_area = 0x494;
+  } else if (50 <= channelToSW && channelToSW <= 64) {
+    fc_area = 0x453;
+  } else if (100 <= channelToSW && channelToSW <= 116) {
+    fc_area = 0x452;
+  } else if (118 <= channelToSW) {
+    fc_area = 0x412;
+  } else {
+    fc_area = 0x96a;
+  }
+  _device.phy_set_bb_reg(rFc_area_Jaguar, 0x1ffe0000, fc_area);
+
+  for (uint8_t eRFPath = 0; eRFPath < _eepromManager->numTotalRfPath;
+       ++eRFPath) {
+    /* RF_MOD_AG — 8814A boundaries. */
+    uint32_t rf_val;
+    if (36 <= channelToSW && channelToSW <= 64) {
+      rf_val = 0x101;
+    } else if (100 <= channelToSW && channelToSW <= 140) {
+      rf_val = 0x301;
+    } else if (140 < channelToSW) {
+      rf_val = 0x501;
+    } else {
+      rf_val = 0x000;
+    }
+    /* Combined RF write: RF_MOD_AG bits + channel byte, single RMW.
+     * Mask BIT18|BIT17|BIT16|BIT9|BIT8 has lowest bit = BIT8, so
+     * phy_set_rf_reg's BitShift = 0 for the combined mask
+     * (BIT18|BIT17|BIT16|BIT9|BIT8|bMaskByte0 → lowest bit is BIT0).
+     * Pre-shift rf_val into bits 16:8, OR with channel byte. */
+    const uint32_t combined = (rf_val << 8) | channelToSW;
+    phy_set_rf_reg(static_cast<RfPath>(eRFPath), RF_CHNLBW_Jaguar,
+                   BIT18 | BIT17 | BIT16 | BIT9 | BIT8 | bMaskByte0,
+                   combined);
+  }
+
+  /* 5G AGC table sub-select (rAGC_table_Jaguar2 = 0x958, 8814-only). */
+  if (36 <= channelToSW && channelToSW <= 64) {
+    _device.phy_set_bb_reg(0x958, 0x1F, 1);
+  } else if (100 <= channelToSW && channelToSW <= 144) {
+    _device.phy_set_bb_reg(0x958, 0x1F, 2);
+  } else if (channelToSW >= 149) {
+    _device.phy_set_bb_reg(0x958, 0x1F, 3);
+  }
+
+  /* 2.4G CCK TX DFIR coefficient reprogramming per channel range. */
+  if (channelToSW >= 1 && channelToSW <= 11) {
+    _device.phy_set_bb_reg(rCCK0_TxFilter1, bMaskDWord, 0x1a1b0030);
+    _device.phy_set_bb_reg(rCCK0_TxFilter2, bMaskDWord, 0x090e1317);
+    _device.phy_set_bb_reg(rCCK0_DebugPort, bMaskDWord, 0x00000204);
+  } else if (channelToSW >= 12 && channelToSW <= 13) {
+    _device.phy_set_bb_reg(rCCK0_TxFilter1, bMaskDWord, 0x1a1b0030);
+    _device.phy_set_bb_reg(rCCK0_TxFilter2, bMaskDWord, 0x090e1217);
+    _device.phy_set_bb_reg(rCCK0_DebugPort, bMaskDWord, 0x00000305);
+  } else if (channelToSW == 14) {
+    _device.phy_set_bb_reg(rCCK0_TxFilter1, bMaskDWord, 0x1a1b0030);
+    _device.phy_set_bb_reg(rCCK0_TxFilter2, bMaskDWord, 0x00000E17);
+    _device.phy_set_bb_reg(rCCK0_DebugPort, bMaskDWord, 0x00000000);
+  }
+}
+
 void RadioManagementModule::phy_FixSpur_8812A(ChannelWidth_t Bandwidth,
                                               uint8_t Channel) {
+  /* 8812-only — upstream's `PHY_FixSpur_8814A` is empty / nonexistent.
+   * Returns early on 8814 even though the inner IS_C_CUT guard would
+   * also skip on B-cut chips; defends against future cut-C 8814 silicon
+   * incorrectly hitting the 8812-specific spur workaround. */
+  if (_eepromManager->version_id.ICType != CHIP_8812) {
+    return;
+  }
   /* C cut Item12 ADC FIFO CLOCK */
   if (IS_C_CUT(_eepromManager->version_id)) {
     if (Bandwidth == CHANNEL_WIDTH_40 && Channel == 11) {
@@ -1131,7 +1468,66 @@ enum VHT_DATA_SC : uint8_t {
   VHT_DATA_SC_40_LOWER_OF_80MHZ = 10,
 };
 
+/* Port of upstream `phy_SetBwMode8814A` (rtl8814a_phycfg.c:2182). 8814
+ * BW post-config writes a much smaller set of BB regs than the 8812
+ * path: it skips `rADC_Buf_Clk_Jaguar` (0x8C4 BIT30), `rL1PeakTH_Jaguar`
+ * (0x848[25:22]), `rCCAonSec_Jaguar` (0xf0000000), and uses a narrower
+ * `rRFMOD_Jaguar` mask. 8814 instead programs rRFMOD_Jaguar[1:0] and
+ * 0x82C[15:12] via the already-ported `phy_SetBwRegAdc_8814A` /
+ * `phy_SetBwRegAgc_8814A` helpers. Skipped here because they're
+ * either A-cut-only no-ops (phy_ADC_CLK_8814A) or specific-40MHz-
+ * channel workarounds (phy_SpurCalibration_8814A) that don't apply
+ * to devourer's 20 MHz monitor use case. */
+void RadioManagementModule::phy_PostSetBwMode8814A() {
+  /* 0x668 BW write (REG_TRXPTCL_CTL_8814A == REG_WMAC_TRXPTCL_CTL,
+   * same address). The existing 8812 helper does identical writes. */
+  phy_SetRegBW_8812(_currentChannelBw);
+
+  const auto SubChnlNum = phy_GetSecondaryChnl_8812();
+  /* REG_DATA_SC_8814A and REG_DATA_SC_8812 are both 0x0483. */
+  _device.rtw_write8(REG_DATA_SC_8812, SubChnlNum);
+
+  phy_SetBwRegAdc_8814A(current_band_type, _currentChannelBw);
+  phy_SetBwRegAgc_8814A(current_band_type, _currentChannelBw);
+
+  switch (_currentChannelBw) {
+  case ChannelWidth_t::CHANNEL_WIDTH_20:
+    /* No extra writes for 20 MHz on 8814. */
+    break;
+  case ChannelWidth_t::CHANNEL_WIDTH_40:
+    _device.phy_set_bb_reg(rRFMOD_Jaguar, 0x3C, SubChnlNum);
+    if (SubChnlNum ==
+        static_cast<uint8_t>(VHT_DATA_SC::VHT_DATA_SC_20_UPPER_OF_80MHZ)) {
+      _device.phy_set_bb_reg(rCCK_System_Jaguar, bCCK_System_Jaguar, 1);
+    } else {
+      _device.phy_set_bb_reg(rCCK_System_Jaguar, bCCK_System_Jaguar, 0);
+    }
+    break;
+  case ChannelWidth_t::CHANNEL_WIDTH_80:
+    _device.phy_set_bb_reg(rRFMOD_Jaguar, 0x3C, SubChnlNum);
+    break;
+  default:
+    _logger->error("phy_PostSetBwMode8814A: unknown Bandwidth {}",
+                   static_cast<int>(_currentChannelBw));
+    break;
+  }
+
+  /* RF[A/B/C/D] 0x18[11:10] BW bits — devourer's existing function
+   * loops over `numTotalRfPath` (4 on 8814) with the same per-BW
+   * values upstream `PHY_RF6052SetBandwidth8814A` uses, so it
+   * already covers paths C/D. */
+  PHY_RF6052SetBandwidth8812(_currentChannelBw);
+}
+
 void RadioManagementModule::phy_PostSetBwMode8812() {
+  /* Per-chip BW post-config. 8814 has a separate sequence (no
+   * rADC_Buf_Clk / rL1PeakTH / rCCAonSec writes, narrower
+   * rRFMOD_Jaguar mask) — see `phy_PostSetBwMode8814A`. */
+  if (_eepromManager->version_id.ICType == CHIP_8814A) {
+    phy_PostSetBwMode8814A();
+    return;
+  }
+
   uint8_t L1pkVal = 0, reg_837 = 0;
 
   /* 3 Set Reg668 BW */
diff --git a/src/RadioManagementModule.h b/src/RadioManagementModule.h
index 0884d5d..0b69de8 100644
--- a/src/RadioManagementModule.h
+++ b/src/RadioManagementModule.h
@@ -6,6 +6,7 @@
 
 #include "EepromManager.h"
 #include "Iqk8812a.h"
+#include "Iqk8814a.h"
 #include "PowerTracking8812a.h"
 #include "RfPath.h"
 #include "RtlUsbAdapter.h"
@@ -154,6 +155,7 @@ class RadioManagementModule {
   uint8_t power = 16;
   PowerTracking8812a _pwrTrk;
   Iqk8812a _iqk;
+  Iqk8814a _iqk8814;
 
 public:
   RadioManagementModule(RtlUsbAdapter device,
@@ -208,13 +210,20 @@ class RadioManagementModule {
   void phy_RFSerialWrite(RfPath eRFPath, uint32_t Offset, uint32_t Data);
   void phy_SetRFEReg8812(BandType Band);
   void phy_SetRFEReg8821(BandType Band);
+  void phy_SetRFEReg8814A(BandType Band);
+  void PHY_SwitchWirelessBand8814A(BandType Band);
+  void phy_SetBwRegAdc_8814A(BandType Band, ChannelWidth_t bw);
+  void phy_SetBwRegAgc_8814A(BandType Band, ChannelWidth_t bw);
   void phy_SetBBSwingByBand_8812A(BandType Band);
+  void phy_SetBBSwingByBand_8814A(BandType Band);
   uint32_t phy_get_tx_bb_swing_8812a(BandType Band, RfPath RFPath);
   void Set_HW_VAR_ENABLE_RX_BAR(bool val);
   void phy_SwChnl8812();
+  void phy_SwChnl8814A();
   bool phy_SwBand8812(uint8_t channelToSW);
   void phy_FixSpur_8812A(ChannelWidth_t Bandwidth, uint8_t Channel);
   void phy_PostSetBwMode8812();
+  void phy_PostSetBwMode8814A();
   void phy_SetRegBW_8812(ChannelWidth_t CurrentBW);
   void PHY_RF6052SetBandwidth8812(ChannelWidth_t Bandwidth);
   uint8_t phy_GetSecondaryChnl_8812();
diff --git a/tests/canary_diff.py b/tests/canary_diff.py
index b726b02..5941fa8 100755
--- a/tests/canary_diff.py
+++ b/tests/canary_diff.py
@@ -36,6 +36,12 @@
     chip temperature so each capture shows a slightly different
     value. The thermal value is also the input to phydm's TX
     BB-swing tracking (see BB 0xc1c[31:21] below).
+  - RF[A] 0x00 / RF[B] 0x00 lower 16 bits: RF_AC LNA + analog
+    config. Bits 4-9 are LNA gain index (phydm_rssi_monitor
+    walks), bit 15 is LNA HW/SW control mode (phydm_lna_sat
+    toggles). Upper bits 16-19 (RF mode: Standby/Normal/TX/RX)
+    ARE checked. Devourer doesn't run the phydm RSSI / LNA-sat
+    modules so it holds whatever the channel-set left.
   - BB 0xc1c / 0xe1c / 0x181c / 0x1a1c bits 31:21: TX BB-swing
     `tx_scaling_table_jaguar` index, written by `PowerTracking8812a`
     (and the kernel's phydm watchdog) based on the thermal-meter
@@ -55,6 +61,12 @@
     but the tone sweep samples noise so the per-bit output varies
     between runs even on the same chip. Functional IQK correctness
     is validated by the on-air RX/TX matrix, not by canary diff.
+  - MAC 0x100, 0x420, 0x4c8, 0x522, 0x610, 0x614: MAC operational-mode
+    artifacts. Kernel iface runs as a fully-configured normal-mode
+    driver (programs the iface MAC address, TX queue control, TBTT-
+    prohibit timing, MAC port enable bits); devourer's monitor mode
+    intentionally skips most of these. Not bugs — structural mode
+    differences that would otherwise dominate the diff.
 
 There's also a known capture-state asymmetry: the kernel iface is
 long-lived (CCK regs at 5G retain values written during prior 2.4G
@@ -85,6 +97,15 @@
     # RF thermal-meter sample — varies with chip temperature.
     ("RF[A]", 0x42): 0xFFFFFFFF,
     ("RF[B]", 0x42): 0xFFFFFFFF,
+    # RF_AC (mode + LNA + analog) — lower 16 bits are runtime-tracked
+    # by phydm (LNA gain index in bits 4-9, LNA HW/SW mode in bit 15,
+    # plus various biasing). Upper bits 16-19 are the RF mode field
+    # (Standby/Normal/TX/RX) and ARE checked. Devourer lacks the
+    # phydm_rssi_monitor + phydm_lna_sat modules that walk these
+    # bits on kernel, so devourer holds whatever the channel-set
+    # sequence left.
+    ("RF[A]", 0x00): 0x0000FFFF,
+    ("RF[B]", 0x00): 0x0000FFFF,
     # BB TX-swing thermal pwrtrk — only bits 31:21 (the
     # tx_scaling_table_jaguar index) are thermal-tracked. Devourer's
     # PowerTracking8812a is gated to CHIP_8812 only, so on 8814 the
@@ -114,6 +135,30 @@
     ("BB", 0xe14): 0xFFFFFFFF,
     ("BB", 0xe90): 0xFFFFFFFF,    # path-B TX IQK matrix
     ("BB", 0xe94): 0xFFFFFFFF,
+    # MAC operational-mode artifacts — kernel runs the iface as a
+    # fully-configured normal-mode driver (programs MAC address, TX
+    # queue control, TBTT-prohibit timing, MAC port enable bits);
+    # devourer runs monitor-mode-only and intentionally skips these
+    # writes. Not bugs — structural mode differences.
+    ("MAC", 0x100): 0xFFFFFFFF,   # REG_CR — TX/RXMACEN, port enable
+    ("MAC", 0x420): 0xFFFFFFFF,   # REG_FWHW_TXQ_CTRL — TX queue cfg
+    ("MAC", 0x4c8): 0xFFFFFFFF,   # REG_TBTT_PROHIBIT — beacon timing
+    ("MAC", 0x522): 0xFFFFFFFF,   # REG_TXPAUSE — TX pause domains
+    ("MAC", 0x610): 0xFFFFFFFF,   # REG_MACID  (MAC[3:0]) — kernel-only
+    ("MAC", 0x614): 0xFFFFFFFF,   # REG_MACID+4 (MAC[5:4]) — kernel-only
+    # 8814 init-time 8812 band-switch artifacts — HalModule's cold-init
+    # calls `PHY_SwitchWirelessBand8812` directly for all chip families
+    # (NOT through the chip-aware `phy_SwBand8812` dispatcher), so on
+    # 8814 the 8812-specific writes still fire. Routing this call
+    # through `PHY_SwitchWirelessBand8814A` instead corrupts the RF
+    # SI/PI read interface (CCK+OFDM clock-gate cycle pre-IQK leaves
+    # phy_RFSerialRead returning wrong-register values on path B),
+    # so we accept the small-bit BB divergence over broken RF reads.
+    # Specific bits the 8812 path forces vs BB-init / 8814 expected:
+    ("BB", 0x808): 0x10000000,    # bit 28 — CCK enable (8812 path forces 1)
+    ("BB", 0x82c): 0x00000001,    # bit 0  — AGC table tail
+    ("BB", 0x830): 0x00024000,    # bits 14, 17 — rPwed_TH_Jaguar 5G bits
+    ("BB", 0x834): 0x0000000c,    # bits 2, 3  — rBWIndication tail
 }
 
 # Capture-state artifacts at 5GHz only — registers that aren't
diff --git a/tests/test_canary_diff.py b/tests/test_canary_diff.py
index a663411..b3565d1 100644
--- a/tests/test_canary_diff.py
+++ b/tests/test_canary_diff.py
@@ -157,6 +157,31 @@ def test_5g_capture_state_artifact_masked(tmp_path: Path) -> None:
     assert "0xc20" in res.stdout
 
 
+def test_mac_opmode_artifacts_masked(tmp_path: Path) -> None:
+    """MAC 0x100 / 0x420 / 0x4c8 / 0x522 / 0x610 / 0x614 are kernel-vs-
+    devourer monitor-mode structural differences. Kernel programs the
+    iface MAC, TX queue control, etc; devourer monitor-mode doesn't.
+    These should be masked entirely so the diff doesn't fail on them."""
+    body_kernel = "\n".join([
+        "MAC 0x100 = 0x000006ff",
+        "MAC 0x420 = 0x03311f80",
+        "MAC 0x4c8 = 0x363608ff",
+        "MAC 0x522 = 0x4f000000",
+        "MAC 0x610 = 0xc7b00d20",
+        "MAC 0x614 = 0x0000b3e4",
+    ])
+    body_devourer = "\n".join([
+        "MAC 0x100 = 0x000000c5",
+        "MAC 0x420 = 0x00310f00",
+        "MAC 0x4c8 = 0x1f1f08ff",
+        "MAC 0x522 = 0x470f0000",
+        "MAC 0x610 = 0x00000000",
+        "MAC 0x614 = 0x00000000",
+    ])
+    res = run_diff(wrap(body_kernel), wrap(body_devourer), tmp_path=tmp_path)
+    assert res.returncode == 0, res.stdout + res.stderr
+
+
 def test_5g_capture_state_artifact_8814_path_c_d_masked(tmp_path: Path) -> None:
     """8814 path-C/D CCK TX-AGC mirrors (0x1820 / 0x1a20) — same
     asymmetry as path-A/B, should also be masked at 5G."""