Appliance image builds and boots for the locked-in hardware: kernel/ixgbe-sff.patch carries the product driver subset (raw I2C + sff_i2c, ETQF steering with rule round-trip, FCoE slot guard — bench-only reg_ops/ts_bench excluded), ported to v7.2 and compile-verified; mkimage applies it or dies, builds IXGBE=y (ICE/I40E out with the ice.pkg blob) and puts ixgbe.allow_unsupported_sfp=1 on the cmdline; load-ixgbe joins the repo anchored to its own path; module bringup ordered after the host checks because a down port's TX_DISABLE powers the PHY core down while the mailbox keeps answering (proven by flipping admin state: down reads 0xffff everywhere, core wakes 0.07-0.24s after the raise) with identify settling 3s bounded; cold-boot condition reproduced on the bench (ports downed first) and passing, confirmed on the appliance

phy.go

@@ -102,6 +102,11 @@ const (
 	linkWaitSpan = 25 * time.Second
 	linkWaitPoll = time.Second
 
+	// The PHY core wakes within 0.25 s of the port raise (bench-measured:
+	// BCM instant, Wiitek 0.07-0.24 s across cycles).
+	moduleUpWait = 3 * time.Second
+	moduleUpPoll = 100 * time.Millisecond
+
 	snrGoodMargin = 3.0
 	snrWarnMargin = 1.0
 )
@@ -493,9 +498,20 @@ func openModules(names [2]string) ([]*phyModule, [2]string, error) {
 		default:
 			return nil, idents, fmt.Errorf("%s: unknown module PN %q", name, pn)
 		}
-		idents[i], err = dev.identify()
-		if err != nil {
-			return nil, idents, err
+		// The port was just raised (the host checks run first): TX_DISABLE
+		// deasserts and the module re-powers its PHY core, which answers
+		// 0xffff through a working mailbox until it is back. Identify
+		// settles bounded while the core wakes.
+		deadline := time.Now().Add(moduleUpWait)
+		for {
+			idents[i], err = dev.identify()
+			if err == nil {
+				break
+			}
+			if time.Now().After(deadline) {
+				return nil, idents, err
+			}
+			time.Sleep(moduleUpPoll)
 		}
 		m := &phyModule{dev: dev}
 		// Born busy: the pollers stay silent through bringup's SETs and