Appliance image builds and boots for the locked-in hardware: kernel/ixgbe-sff.patch carries the product driver subset (raw I2C + sff_i2c, ETQF steering with rule round-trip, FCoE slot guard — bench-only reg_ops/ts_bench excluded), ported to v7.2 and compile-verified; mkimage applies it or dies, builds IXGBE=y (ICE/I40E out with the ice.pkg blob) and puts ixgbe.allow_unsupported_sfp=1 on the cmdline; load-ixgbe joins the repo anchored to its own path; module bringup ordered after the host checks because a down port's TX_DISABLE powers the PHY core down while the mailbox keeps answering (proven by flipping admin state: down reads 0xffff everywhere, core wakes 0.07-0.24s after the raise) with identify settling 3s bounded; cold-boot condition reproduced on the bench (ports downed first) and passing, confirmed on the appliance

load-ixgbe

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Dev-host module swap: builds the bench ixgbe (the product patch plus the
+# bench-only extras) out of tree and replaces the running driver. Does not
+# survive a reboot; the appliance image gets the product patch from
+# kernel/ixgbe-sff.patch via mkimage instead.
+src=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+src=$(dirname "$src")/ixgbe-sff
+make -C "/usr/lib/modules/$(uname -r)/build" "M=$src" modules
+sudo rmmod ixgbe
+sudo insmod "$src/ixgbe.ko" allow_unsupported_sfp=1
+sudo sh -c 'ls /sys/kernel/debug/ixgbe/*/sff_i2c'