Appliance image builds and boots for the locked-in hardware: kernel/ixgbe-sff.patch carries the product driver subset (raw I2C + sff_i2c, ETQF steering with rule round-trip, FCoE slot guard — bench-only reg_ops/ts_bench excluded), ported to v7.2 and compile-verified; mkimage applies it or dies, builds IXGBE=y (ICE/I40E out with the ice.pkg blob) and puts ixgbe.allow_unsupported_sfp=1 on the cmdline; load-ixgbe joins the repo anchored to its own path; module bringup ordered after the host checks because a down port's TX_DISABLE powers the PHY core down while the mailbox keeps answering (proven by flipping admin state: down reads 0xffff everywhere, core wakes 0.07-0.24s after the raise) with identify settling 3s bounded; cold-boot condition reproduced on the bench (ports downed first) and passing, confirmed on the appliance

mkimage

@@ -25,26 +25,25 @@ keys=(
 # distro's linux-firmware.
 edid=edid/waveshare-1024x600.bin
 distrofw=(
-	intel/ice/ddp/ice.pkg
 	i915/adlp_dmc.bin
 	i915/adlp_guc_70.bin
 	i915/tgl_huc.bin
 )
 
-cmdline="drm.edid_firmware=HDMI-A-1:$edid video=HDMI-A-1:e"
+cmdline="drm.edid_firmware=HDMI-A-1:$edid video=HDMI-A-1:e ixgbe.allow_unsupported_sfp=1"
 
 # Every setting the appliance depends on, re-asserted after the stored config
 # is loaded so a renamed or newly defaulted symbol cannot quietly drop one.
 wanty=(
 	EFI_STUB BLK_DEV_INITRD INITRAMFS_COMPRESSION_NONE CMDLINE_BOOL
 	PACKET INET DEVTMPFS PROC_FS SYSFS TMPFS
-	ICE ICE_HWTS I40E PTP_1588_CLOCK
+	IXGBE DEBUG_FS PTP_1588_CLOCK
 	DRM_I915 DRM_FBDEV_EMULATION DRM_LOAD_EDID_FIRMWARE DRM_PANIC
 	FB_DEVICE FRAMEBUFFER_CONSOLE VT_CONSOLE
 	USB_XHCI_PCI USB_HID HID_MULTITOUCH INPUT_EVDEV
 	CPU_FREQ_GOV_PERFORMANCE X86_INTEL_PSTATE
 )
-wantn=(MODULES BLOCK IGC)
+wantn=(MODULES BLOCK IGC ICE I40E)
 
 say() { printf '\n\033[36m== %s\033[0m\n' "$*"; }
 die() { printf '\033[31merror: %s\033[0m\n' "$*" >&2; exit 1; }
@@ -71,7 +70,14 @@ done
 [ -n "$signer" ] || die "$tag is not signed by a pinned kernel.org key"
 echo "$tag verified against $signer"
 
-git -C "$src" checkout -q --detach "$tag"
+# -f discards the previous run's applied patch: the tree is a build
+# workspace, and kernel/ixgbe-sff.patch is the source of truth.
+git -C "$src" checkout -f -q --detach "$tag"
+
+say "ixgbe patch"
+git -C "$src" apply --stat "$repo/kernel/ixgbe-sff.patch"
+git -C "$src" apply "$repo/kernel/ixgbe-sff.patch" ||
+	die "kernel/ixgbe-sff.patch does not apply to $tag; port the patch first"
 
 say "go binary"
 mkdir -p "$initdir"
@@ -111,7 +117,7 @@ cp "$repo/kernel/config" "$src/.config"
 ( cd "$src" && scripts/config \
 	--disable MODULES \
 	--enable EXPERT --disable BLOCK \
-	--enable I40E --disable IGC \
+	--enable IXGBE --disable ICE --disable I40E --disable IGC \
 	--enable DRM_LOAD_EDID_FIRMWARE \
 	--set-str EXTRA_FIRMWARE "$edid ${distrofw[*]}" \
 	--set-str EXTRA_FIRMWARE_DIR "$fwdir" \