sndio was added as a dependency for TouchHLE but missing
PKG_DEPENDS_TARGET. The parallel build system schedules it
before the cross-compiler is built, causing build failure.
Reject zero-length SG entries and multi-fragment scatterlists in
rk3288_crypto ahash, forcing complex crypto payloads to the stable
ARM64_CE software implementation. This prevents hash corruption
during WPA3 SAE dragonfly handshakes.
Placed in RK3399 device patches as it is the only ROCKNIX target
where the rk3288_crypto driver probes (matching DT crypto node).
Enable CONFIG_PKCS8_PRIVATE_KEY_PARSER=y on all 10 device targets.
iwd requires the PKCS8 parser to read modern certificate and key
formats during WPA3 SAE authentication — its absence causes
Status 77 rejections.
On dual-driver devices (RK3326, RK3566, RK3588), both mali.json and
panfrost_icd.*.json Vulkan ICDs are installed. The Vulkan loader
enumerates both, but only one kernel driver is active at a time,
causing emulators to fail silently and fall back to OpenGL.
Mask the inactive ICD by bind-mounting /dev/null over its json file,
following the same pattern gpudriver already uses for libGL.so and
mali GLES library overrides. This leaves VK_ICD_FILENAMES unset,
preserving the loader's default search for layers and additional ICDs.
Also fix bind-mount guard checks: replace grep on /proc/mounts with
mount output parsing to avoid squashfs rootfs false positives that
could cause mali GLES bind-mounts to be skipped on fresh flash.
On devices without gpudriver (H700, SDM845, SM8250+), only one ICD
is installed and the Vulkan loader finds it via default search.
