Intel X710 (i40e)

Module I2C: 1-byte-offset only — dead end for BCM SMI

reg_address > 0xFF returns AQ retval 14 (hard boundary).
Emits at most [dev, offset, data] (2 payload bytes); the BCM SMI needs 3–5 byte frames in one transaction.
MDIO interface modes don't reach the module — no PHY on the NIC MDIO pins; copper SFPs wire only I2C.
Single-byte writes work (unlike the E810) — which is what makes the oracle path below possible.

Transport: /sys/kernel/debug/i40e/<pci>/command, send aq_cmd <flags> <opcode> 0 0 0 0 <param0> <param1> <param2> 0, flags 0x2000.
Opcode 0x0629 get / 0x0628 set PHY register. param0 = phy_interface | dev_addr<<8 | cmd_flags<<16 (phy_interface 2 = EXTERNAL_MODULE, dev_addr 0xA2); param1 = reg offset; param2 = value.
Result comes back in the dmesg "AQ desc WB" line, 9th field.
Proven on the Fibergaga, link up: per-pair SNR (PMA 1.133–1.136), PCS 3.32/3.33, the 3.E820 counter (../../modules/fibergaga/).

Rejects HWTSTAMP_FILTER_ALL with -ERANGE (verified in upstream i40e_ptp.c) — PTP-only, so no committed-path bucketing here.
Genuinely shared PHC across ports (one oscillator) + PTP latches: the platform for the retrain-stability experiment and the scoped-but-unbuilt PTP path-delay length fallback (../../open-questions.md §2) — probes must be PTP-shaped here too.
No EEE on i40e/X710.