Appliance image builds and boots for the locked-in hardware: kernel/ixgbe-sff.patch carries the product driver subset (raw I2C + sff_i2c, ETQF steering with rule round-trip, FCoE slot guard — bench-only reg_ops/ts_bench excluded), ported to v7.2 and compile-verified; mkimage applies it or dies, builds IXGBE=y (ICE/I40E out with the ice.pkg blob) and puts ixgbe.allow_unsupported_sfp=1 on the cmdline; load-ixgbe joins the repo anchored to its own path; module bringup ordered after the host checks because a down port's TX_DISABLE powers the PHY core down while the mailbox keeps answering (proven by flipping admin state: down reads 0xffff everywhere, core wakes 0.07-0.24s after the raise) with identify settling 3s bounded; cold-boot condition reproduced on the bench (ports downed first) and passing, confirmed on the appliance

main.go

@@ -207,12 +207,15 @@ func run(aName, bName string) (err error) {
 		ethertypes[i] = uint16(etherBase + i)
 	}
 
+	// The modules are only reachable behind an up port: ixgbe holds
+	// TX_DISABLE asserted while the netdev is admin-down and the module
+	// answers every PHY read with 0xffff (proven by flipping admin state on
+	// the bench). The host checks raise the links, so they run first.
+	checks := configureSystem(ifnames, ethertypes)
 	modules, moduleIDs, err := openModules([2]string{a.name, b.name})
 	if err != nil {
 		return err
 	}
-
-	checks := configureSystem(ifnames, ethertypes)
 	checks = append(checks, moduleChecks(modules, [2]string{a.name, b.name})...)
 	if err := reportChecks("SETTINGS", checks); err != nil {
 		return err