• NSM Get-Port-Network-Addresses returned an invalid format on B200/B300 HMC. It now follows the documented non-compact format.
• An issue that could prevent the adapter’s PCIe link from re-establishing after the host resumed from a deep power-down state. This fix improves the reliability of suspend/resume cycles.
• A DEAD IRISC assert that could occur during TLV NV_DATA flash access by suspending the watchdog while waiting for flash IPC (until timeout), preventing the assert on TLV access.
• An issue where repeatedly writing NVCONFIG TLVs could cause excessive NV_DATA partition swaps during garbage collection. This rapid cycling could accelerate flash wear (end-of-life at 100,000 erases) and potentially render the device inoperable. Firmware now avoids unnecessary physical writes by returning OK when the requested configuration already exists in flash, and increases the maximum supported NV_DATA partition swaps from 100,000 to 200,000.
• ICM_RES_HW_DMFS_ENCAP_H_FW was allocated per GVMI, preventing some RTTs from using it.
• vDPA doorbell resources were not released, which could cause failures when running other functionality after a vDPA FLR. Doorbell resources are now properly unlocked.
• RDMA traffic could stall in large-scale deployments for certain source IP and UDP source-port combinations when DOCA PCC was active and no congestion-control algorithm was configured in algorithm slot 0.
• The live migration target did not receive a port state change event on the resume VHCA command. The target now generates this event so software that depends on port state is notified of any changes.
• A precopy image was processed during the stop-copy phase, causing prolonged downtime due to a software limitation. The handling was slow because the handler performed a linear search for data; this was improved by replacing it with a faster search approach enabled via compile-time preprocessing.
• QPs established before loading DOCA PCC could exhibit inconsistent algorithm-selected behavior between ports in LAG mode after DOCA PCC is loaded.

• An interoperability issue where, when ConnectX-7 communicates with ConnectX-8 using the probe-based algorithm, bandwidth could become extremely low due to probe packets being dropped.
• The DPA kernel used unsafe ICM access during process creation/modification, which would cause the DPA kernel to hang during FLR.
• User Debugger “query caps” returned only the number of capabilities, not the capability bitmap.
• Race condition in standby/boot power sequencing. In certain timing windows, port power-down would be delayed such that the power-up flow detected the port still transitioning to power-down, causing the sequence to fail and leaving the port stuck in a powered-down state.
• mlxlink reported 0 values for SNR (media and host) due to incorrect local port mapping in firmware and an incorrect page number used by MFT.
• Due to an SMBus release race condition, the I2C bus would become stuck.
• Fuse values were not aligned with the updated values burned across different ConnectX-7 setups.
• Issue in the steering definers used for LAG with IPv6 traffic.
• A spurious CNP was sent in response to an out-of-sequence packet.
• The root complex sent MCTP-over-PCI messages before a BDF was assigned, causing responses to be sent with BDF 0. The fix ensures that MCTP messages routed by ID are ignored until a valid BDF is assigned.
• The steering tables were not updated after enabling partial Spectrum-X capabilities (BTH.AR) via LLPD.
• When decapsulation on a packet occurred, the FCS indication was not calculated correctly.
• In IB system, RTT_response_sl feature did not work with Sniffer tools (e.g., Wireshark/Tcpdump/).
   

This version of the System ROM contains updates aligned with the Intel Product Update (IPU) version IPU.2026.3 guidance.

This version of the System ROM should be paired with Server Platform Services (SPS) Firmware 06.03.04.069.0 (2.40_01_12_2026).

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Resolved an issue where the Intel Xeon E-2477P (6377P) processor incorrectly reported a supported core count of 8 instead of 12.

Resolved an issue where the system could hang or assert when certain MMCFG configuration options were applied.

Resolved an issue where the system time zone could be unexpectedly reset to the default value during boot when a DST-adjusted offset validation failed.

Resolved an issue where a Red Screen of Death (RSOD) could occur during PCIe error handling under certain conditions.

Resolved an issue where an unexpected processor state could cause a system fault during POST after memory training, potentially resulting in an RSOD during certain diagnostic operations.

Resolved an issue where systems with many SPDM-capable devices could experience unnecessary boot delays even when the SPDM policy was disabled.

Resolved an issue where the deprecated ASIX USB NIC RBSU configuration knob was still visible. The knob has been removed as it is no longer required.

Resolved an issue where eMMC devices of 8GB or 16GB capacity were not handled correctly due to a UINT32 overflow condition.

Known Issues:

After the operating system configures the time zone, subsequent time zone changes made in UEFI System Utilities (RBSU) may not be retained after a system reboot.

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Resolved an issue where the Intel Xeon E-2477P (6377P) processor incorrectly reported a supported core count of 8 instead of 12.

Resolved an issue where the system could hang or assert when certain MMCFG configuration options were applied.

Resolved an issue where the system time zone could be unexpectedly reset to the default value during boot when a DST-adjusted offset validation failed.

Resolved an issue where a Red Screen of Death (RSOD) could occur during PCIe error handling under certain conditions.

Resolved an issue where an unexpected processor state could cause a system fault during POST after memory training, potentially resulting in an RSOD during certain diagnostic operations.

Resolved an issue where systems with many SPDM-capable devices could experience unnecessary boot delays even when the SPDM policy was disabled.

Resolved an issue where the deprecated ASIX USB NIC RBSU configuration knob was still visible. The knob has been removed as it is no longer required.

Resolved an issue where eMMC devices of 8GB or 16GB capacity were not handled correctly due to a UINT32 overflow condition.

Known Issues:

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Resolved an issue where deleting or enrolling Secure Boot signatures via the Redfish API could fail.

Resolved an issue where Secure Boot key Auto Enrollment was not triggered after performing "Reset All Keys to Platform Defaults" through RBSU or the Redfish API when OEM Secure Boot customization was in use. The system now correctly re-enrolls the default Secure Boot keys after a reset.

Resolved an issue where the Secure Boot Auto Enroll Policy setting configured via the Redfish API was not correctly synchronized with the corresponding RBSU setting, and changes made in RBSU were not reflected in Redfish.

Resolved an issue where someiLO functions may stop working until the next system boot after an iLO factory reset.

Resolved an issue where a SPDM device authentication may be skipped during boot.

Resolved an issue where NVMe-oF IPv6 target hard drives were not detected during VMware 9.0 installation.

- Addressed the following security vulnerabilities:

- CVE-2026-34180 (OpenSSL)

Known Issues:

This revision of the System ROM includes AMD reference code GenoaPI 1.0.0.J for AMD 4th Generation EPYC processors.

This revision of the System ROM includes AMD reference code TurinPI 1.0.0.B for AMD 5th Generation EPYC processors.

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Addressed an issue where HPE Smart Memory DIMMs could be incorrectly identified as non-Smart Memory.

Addressed a security vulnerability in OpenSSL (CVE-2026-7383) where a signed integer overflow in ASN1_mbstring_ncopy() could lead to a heap buffer overflow under specific conditions.

Addressed a security vulnerability in Libpng (CVE-2026-34757) where a use-after-free condition could occur when passing a pointer returned by the PLTE, tRNS, or hIST getters back into the corresponding setters.

Addressed a security vulnerability in OpenSSL (CVE-2026-45447) involving a possible use-after-free condition in PKCS7_verify().

Addressed a security vulnerability in Libpng (CVE-2026-33416) where a dangling pointer could result in reads or writes to freed memory during palette operations.

Addressed an issue where iLO NMI could not generate a BSOD on Windows when Hyper-V was enabled on AMD Gen11 platforms.

Addressed an issue where VMware ESXi 9.1 installation could intermittently fail with a PSOD indicating inconsistent SVM MSR lock status across CPU cores.

Addressed an issue where the Tiered Memory Page Migration (TMPM) device was not generated in the ACPI SSDT table, preventing the MPDMA device from being recognized by the operating system.

Addressed an issue where the system could experience unnecessary boot halts on heavily loaded SPDM configurations when iLO discovery exceeded the BIOS timeout, even when SPDM policy was disabled.

Addressed an issue where the sysconfig shell command for enabledcoresperproc returned options inconsistent with the RBSU GUI.

Addressed an issue where the system timezone could be reset to default when DST-adjusted offset validation or stale mnemonic caused a validation failure during boot.

Addressed an issue where the progress bar was misaligned on the initial POST screen in Quiet Mode when a non-default OEM logo was configured.

Addressed an issue where visual noise appeared on OEM logo during POST screen display.

Addressed an issue where restoring defaults on high core count AMD Turin platforms (>=255 logical cores) could trigger an unnecessary full memory training cycle due to incorrect APIC mode handling.

Known Issues:

None

•     corner case performance enhance.
•     Servo change that resolves issue with early heat application from Idle sweep seek terminated that may cause read errors.

•     corner case performance enhance.
•     Servo change that resolves issue with early heat application from Idle sweep seek terminated that may cause read errors.

This version of the System ROM contains updates aligned with the Intel IPU2026.3 update. This version of the System ROM should be paired with Server Platform Services (SPS) Firmware 06.01.04.230.0 (2.90_08_16_2026).

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Addressed an issue where BIOS settings might be lost after an iLO factory reset in CNSA mode, causing multiple iLO management functions to stop working.

Addressed an issue where Secure Boot key auto-enrollment might not be triggered after using "Reset All Keys to Platform Defaults" in RBSU with OEM Secure Boot customization enabled.

Addressed an issue where the Secure Boot Auto Enroll Policy setting might not be synchronized correctly between RBSU and Redfish interfaces.

Addressed an issue where the SPDM Overall Boot Policy might not be read from the correct location, resulting in unexpected SPDM boot policy behavior.

Addressed an issue where deleting a Secure Boot signature via the Redfish API might fail.

Known Issues:

After the operating system configures the time zone, subsequent time zone changes made in UEFI System Utilities (RBSU) may not be retained after a system reboot.

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where BIOS settings might be lost after an iLO factory reset in CNSA mode, causing multiple iLO management functions to stop working.

Addressed an issue where Secure Boot key auto-enrollment might not be triggered after using "Reset All Keys to Platform Defaults" in RBSU with OEM Secure Boot customization enabled.

Addressed an issue where the Secure Boot Auto Enroll Policy setting might not be synchronized correctly between RBSU and Redfish interfaces.

Addressed an issue where the SPDM Overall Boot Policy might not be read from the correct location, resulting in unexpected SPDM boot policy behavior.

Addressed an issue where deleting a Secure Boot signature via the Redfish API might fail.

Known Issues:

• NSM Get-Port-Network-Addresses returned an invalid format on B200/B300 HMC. It now follows the documented non-compact format.
• An issue that could prevent the adapter’s PCIe link from re-establishing after the host resumed from a deep power-down state. This fix improves the reliability of suspend/resume cycles.
• A DEAD IRISC assert that could occur during TLV NV_DATA flash access by suspending the watchdog while waiting for flash IPC (until timeout), preventing the assert on TLV access.
• An issue where repeatedly writing NVCONFIG TLVs could cause excessive NV_DATA partition swaps during garbage collection. This rapid cycling could accelerate flash wear (end-of-life at 100,000 erases) and potentially render the device inoperable. Firmware now avoids unnecessary physical writes by returning OK when the requested configuration already exists in flash, and increases the maximum supported NV_DATA partition swaps from 100,000 to 200,000.
• ICM_RES_HW_DMFS_ENCAP_H_FW was allocated per GVMI, preventing some RTTs from using it.
• vDPA doorbell resources were not released, which could cause failures when running other functionality after a vDPA FLR. Doorbell resources are now properly unlocked.
• RDMA traffic could stall in large-scale deployments for certain source IP and UDP source-port combinations when DOCA PCC was active and no congestion-control algorithm was configured in algorithm slot 0.
• The live migration target did not receive a port state change event on the resume VHCA command. The target now generates this event so software that depends on port state is notified of any changes.
• A precopy image was processed during the stop-copy phase, causing prolonged downtime due to a software limitation. The handling was slow because the handler performed a linear search for data; this was improved by replacing it with a faster search approach enabled via compile-time preprocessing.
• QPs established before loading DOCA PCC could exhibit inconsistent algorithm-selected behavior between ports in LAG mode after DOCA PCC is loaded.

• An interoperability issue where, when ConnectX-7 communicates with ConnectX-8 using the probe-based algorithm, bandwidth could become extremely low due to probe packets being dropped.
• The DPA kernel used unsafe ICM access during process creation/modification, which would cause the DPA kernel to hang during FLR.
• User Debugger “query caps” returned only the number of capabilities, not the capability bitmap.
• Race condition in standby/boot power sequencing. In certain timing windows, port power-down would be delayed such that the power-up flow detected the port still transitioning to power-down, causing the sequence to fail and leaving the port stuck in a powered-down state.
• mlxlink reported 0 values for SNR (media and host) due to incorrect local port mapping in firmware and an incorrect page number used by MFT.
• Due to an SMBus release race condition, the I2C bus would become stuck.
• Fuse values were not aligned with the updated values burned across different ConnectX-7 setups.
• Issue in the steering definers used for LAG with IPv6 traffic.
• A spurious CNP was sent in response to an out-of-sequence packet.
• The root complex sent MCTP-over-PCI messages before a BDF was assigned, causing responses to be sent with BDF 0. The fix ensures that MCTP messages routed by ID are ignored until a valid BDF is assigned.
• The steering tables were not updated after enabling partial Spectrum-X capabilities (BTH.AR) via LLPD.
• When decapsulation on a packet occurred, the FCS indication was not calculated correctly.
• In IB system, RTT_response_sl feature did not work with Sniffer tools (e.g., Wireshark/Tcpdump/).
   

This version of the System ROM contains updates aligned with the Intel IPU2026.3 update. This version of the System ROM should be paired with Server Platform Services (SPS) Firmware 06.01.04.230.0 (2.90_08_16_2026).

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Addressed an issue where BIOS settings might be lost after an iLO factory reset in CNSA mode, causing multiple iLO management functions to stop working.

Addressed an issue where Secure Boot key auto-enrollment might not be triggered after using "Reset All Keys to Platform Defaults" in RBSU with OEM Secure Boot customization enabled.

Addressed an issue where the Secure Boot Auto Enroll Policy setting might not be synchronized correctly between RBSU and Redfish interfaces.

Addressed an issue where the SPDM Overall Boot Policy might not be read from the correct location, resulting in unexpected SPDM boot policy behavior.

Addressed an issue where deleting a Secure Boot signature via the Redfish API might fail.

Known Issues:

After the operating system configures the time zone, subsequent time zone changes made in UEFI System Utilities (RBSU) may not be retained after a system reboot.

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where BIOS settings might be lost after an iLO factory reset in CNSA mode, causing multiple iLO management functions to stop working.

Addressed an issue where Secure Boot key auto-enrollment might not be triggered after using "Reset All Keys to Platform Defaults" in RBSU with OEM Secure Boot customization enabled.

Addressed an issue where the Secure Boot Auto Enroll Policy setting might not be synchronized correctly between RBSU and Redfish interfaces.

Addressed an issue where the SPDM Overall Boot Policy might not be read from the correct location, resulting in unexpected SPDM boot policy behavior.

Addressed an issue where deleting a Secure Boot signature via the Redfish API might fail.

Known Issues:

This revision of the System ROM includes AMD reference code GenoaPI 1.0.0.J for AMD 4th Generation EPYC processors.

This revision of the System ROM includes AMD reference code TurinPI 1.0.0.B for AMD 5th Generation EPYC processors.

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Addressed an issue where HPE Smart Memory DIMMs could be incorrectly identified as non-Smart Memory.

Addressed a security vulnerability in OpenSSL (CVE-2026-7383) where a signed integer overflow in ASN1_mbstring_ncopy() could lead to a heap buffer overflow under specific conditions.

Addressed a security vulnerability in Libpng (CVE-2026-34757) where a use-after-free condition could occur when passing a pointer returned by the PLTE, tRNS, or hIST getters back into the corresponding setters.

Addressed a security vulnerability in OpenSSL (CVE-2026-45447) involving a possible use-after-free condition in PKCS7_verify().

Addressed a security vulnerability in Libpng (CVE-2026-33416) where a dangling pointer could result in reads or writes to freed memory during palette operations.

Addressed an issue where iLO NMI could not generate a BSOD on Windows when Hyper-V was enabled on AMD Gen11 platforms.

Addressed an issue where VMware ESXi 9.1 installation could intermittently fail with a PSOD indicating inconsistent SVM MSR lock status across CPU cores.

Addressed an issue where the Tiered Memory Page Migration (TMPM) device was not generated in the ACPI SSDT table, preventing the MPDMA device from being recognized by the operating system.

Addressed an issue where the system could experience unnecessary boot halts on heavily loaded SPDM configurations when iLO discovery exceeded the BIOS timeout, even when SPDM policy was disabled.

Addressed an issue where the sysconfig shell command for enabledcoresperproc returned options inconsistent with the RBSU GUI.

Addressed an issue where the system timezone could be reset to default when DST-adjusted offset validation or stale mnemonic caused a validation failure during boot.

Addressed an issue where the progress bar was misaligned on the initial POST screen in Quiet Mode when a non-default OEM logo was configured.

Addressed an issue where visual noise appeared on OEM logo during POST screen display.

Addressed an issue where restoring defaults on high core count AMD Turin platforms (>=255 logical cores) could trigger an unnecessary full memory training cycle due to incorrect APIC mode handling.

Known Issues:

None

• A BlueField-3 host SF could remain stuck in the inactive+attached state and fail to reactivate after host restart flows.
• A NULL pointer dereference in the mlx5_core driver that could cause a kernel panic and report PCIe completion-timeout errors on ConnectX-8 bare-metal systems.
• An issue that occurred when CONFIG_UBSAN=y and the user provided an invalid value, resulting in the following UBSAN error:UBSAN: shift-out-of-bounds in drivers/net/ethernet/mellanox/mlx5/core/diag/diag_cnt.c:190:11 shift exponent 4294967293 is too large for 32-bit type 'int'
• A race condition in the ib_core kernel module during concurrent address resolution that could produce a zero destination MAC (DMAC), causing silent packet loss and RDMA retry-exceeded errors.
• Upgrading doca-ofed did not always upgrade doca-extra (which includes the module sources and doca-kernel-support build scripts). In some cases, this caused doca-kernel-support to build against sources from an older release.
• Accessing timestamping mode could fail on kernel 7.0 and later.

• An issue on RHEL systems where installing chkconfig after mlnx-ofa_kernel (pulled in by packages such as doca-ofed and doca-host) could fail during installation. In this sequence, chkconfig could be installed indirectly as a dependency of a package that places init scripts under /etc/init.d, but the install would error out because /etc/init.d already existed as a directory (whereas chkconfig expects to manage it as a symlink). This fix prevents the /etc/init.d directory/symlink conflict that caused the RPM unpacking failure.
• In LAG mode, a firmware reset race could cause the driver to hang during unload while waiting for UMR completion. The fix ensures sys_error notifications are registered early and kept through device unregister so error events reach the bond device during teardown.
• Soft lockup warnings that could occur while releasing large UMEMs by periodically yielding the CPU during the release flow.
• A kernel crash that could occur if the devlink userspace process was terminated while switching the device to switchdev mode.
• Devlink operations were not synchronized with fw_reset, which could lead to various failures. Added a mechanism to coordinate fw_reset with devlink operations.
• The driver could incorrectly initialize polling-only CQs (e.g., ASO CQs), allowing them to receive EQ interrupts in rare cases. The CQ initialization flow was updated to prevent interrupts for polling-only CQs.
• An overflow issue where the max-rate value was stored in a unsigned 8-bit integer type , causing values above 255 to wrap (e.g., 257 became 1).
• An issue that prevented using more than 8 cores to set SF CPU affinity. This restriction has now been removed.

• A BlueField-3 host SF could remain stuck in the inactive+attached state and fail to reactivate after host restart flows.
• A NULL pointer dereference in the mlx5_core driver that could cause a kernel panic and report PCIe completion-timeout errors on ConnectX-8 bare-metal systems.
• An issue that occurred when CONFIG_UBSAN=y and the user provided an invalid value, resulting in the following UBSAN error:UBSAN: shift-out-of-bounds in drivers/net/ethernet/mellanox/mlx5/core/diag/diag_cnt.c:190:11 shift exponent 4294967293 is too large for 32-bit type 'int'
• A race condition in the ib_core kernel module during concurrent address resolution that could produce a zero destination MAC (DMAC), causing silent packet loss and RDMA retry-exceeded errors.
• Upgrading doca-ofed did not always upgrade doca-extra (which includes the module sources and doca-kernel-support build scripts). In some cases, this caused doca-kernel-support to build against sources from an older release.
• Accessing timestamping mode could fail on kernel 7.0 and later.

• An issue on RHEL systems where installing chkconfig after mlnx-ofa_kernel (pulled in by packages such as doca-ofed and doca-host) could fail during installation. In this sequence, chkconfig could be installed indirectly as a dependency of a package that places init scripts under /etc/init.d, but the install would error out because /etc/init.d already existed as a directory (whereas chkconfig expects to manage it as a symlink). This fix prevents the /etc/init.d directory/symlink conflict that caused the RPM unpacking failure.
• In LAG mode, a firmware reset race could cause the driver to hang during unload while waiting for UMR completion. The fix ensures sys_error notifications are registered early and kept through device unregister so error events reach the bond device during teardown.
• Soft lockup warnings that could occur while releasing large UMEMs by periodically yielding the CPU during the release flow.
• A kernel crash that could occur if the devlink userspace process was terminated while switching the device to switchdev mode.
• Devlink operations were not synchronized with fw_reset, which could lead to various failures. Added a mechanism to coordinate fw_reset with devlink operations.
• The driver could incorrectly initialize polling-only CQs (e.g., ASO CQs), allowing them to receive EQ interrupts in rare cases. The CQ initialization flow was updated to prevent interrupts for polling-only CQs.
• An overflow issue where the max-rate value was stored in a unsigned 8-bit integer type , causing values above 255 to wrap (e.g., 257 became 1).
• An issue that prevented using more than 8 cores to set SF CPU affinity. This restriction has now been removed

• A BlueField-3 host SF could remain stuck in the inactive+attached state and fail to reactivate after host restart flows.
• A NULL pointer dereference in the mlx5_core driver that could cause a kernel panic and report PCIe completion-timeout errors on ConnectX-8 bare-metal systems.
• An issue that occurred when CONFIG_UBSAN=y and the user provided an invalid value, resulting in the following UBSAN error:UBSAN: shift-out-of-bounds in drivers/net/ethernet/mellanox/mlx5/core/diag/diag_cnt.c:190:11 shift exponent 4294967293 is too large for 32-bit type 'int'
• A race condition in the ib_core kernel module during concurrent address resolution that could produce a zero destination MAC (DMAC), causing silent packet loss and RDMA retry-exceeded errors.
• Upgrading doca-ofed did not always upgrade doca-extra (which includes the module sources and doca-kernel-support build scripts). In some cases, this caused doca-kernel-support to build against sources from an older release.
• Accessing timestamping mode could fail on kernel 7.0 and later.

• A BlueField-3 host SF could remain stuck in the inactive+attached state and fail to reactivate after host restart flows.
• A NULL pointer dereference in the mlx5_core driver that could cause a kernel panic and report PCIe completion-timeout errors on ConnectX-8 bare-metal systems.
• An issue that occurred when CONFIG_UBSAN=y and the user provided an invalid value, resulting in the following UBSAN error:UBSAN: shift-out-of-bounds in drivers/net/ethernet/mellanox/mlx5/core/diag/diag_cnt.c:190:11 shift exponent 4294967293 is too large for 32-bit type 'int'
• A race condition in the ib_core kernel module during concurrent address resolution that could produce a zero destination MAC (DMAC), causing silent packet loss and RDMA retry-exceeded errors.
• Upgrading doca-ofed did not always upgrade doca-extra (which includes the module sources and doca-kernel-support build scripts). In some cases, this caused doca-kernel-support to build against sources from an older release.
• Accessing timestamping mode could fail on kernel 7.0 and later.

•     corner case performance enhance.
•     Servo change that resolves issue with early heat application from Idle sweep seek terminated that may cause read errors.

• Firmware failed to scan the correct CQs for the PF after the FW entered into the CQ recovery mode., resulting in CQs for the PF not being recovered.

This version of the System ROM contains updates aligned with the Intel IPU2026.3 update. This version of the System ROM should be paired with Server Platform Services (SPS) Firmware 06.01.04.230.0 (2.90_08_16_2026).

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Addressed an issue where BIOS settings might be lost after an iLO factory reset in CNSA mode, causing multiple iLO management functions to stop working.

Addressed an issue where Secure Boot key auto-enrollment might not be triggered after using "Reset All Keys to Platform Defaults" in RBSU with OEM Secure Boot customization enabled.

Addressed an issue where the Secure Boot Auto Enroll Policy setting might not be synchronized correctly between RBSU and Redfish interfaces.

Addressed an issue where the SPDM Overall Boot Policy might not be read from the correct location, resulting in unexpected SPDM boot policy behavior.

Addressed an issue where deleting a Secure Boot signature via the Redfish API might fail.

Known Issues:

After the operating system configures the time zone, subsequent time zone changes made in UEFI System Utilities (RBSU) may not be retained after a system reboot.

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where BIOS settings might be lost after an iLO factory reset in CNSA mode, causing multiple iLO management functions to stop working.

Addressed an issue where Secure Boot key auto-enrollment might not be triggered after using "Reset All Keys to Platform Defaults" in RBSU with OEM Secure Boot customization enabled.

Addressed an issue where the Secure Boot Auto Enroll Policy setting might not be synchronized correctly between RBSU and Redfish interfaces.

Addressed an issue where the SPDM Overall Boot Policy might not be read from the correct location, resulting in unexpected SPDM boot policy behavior.

Addressed an issue where deleting a Secure Boot signature via the Redfish API might fail.

Known Issues:

• Firmware failed to scan the correct CQs for the PF after the FW entered into the CQ recovery mode., resulting in CQs for the PF not being recovered.

This revision of the System ROM includes AMD reference code TurinPI 1.0.0.B for AMD 5th Generation EPYC processors.

This version of the System ROM updates the default UEFI Secure Boot forbidden signature database (dbx) for CVE-2025-47827. Updating the System ROM alone does not apply the updated dbx. Users must reset Secure Boot keys to manufacturing defaults, or enroll the updated dbx through Windows, Linux, RBSU, or Redfish.

This revision of the System ROM supports the following GPUs: Nvidia H200 GPU Nvidia B200 GPU Nvidia B300 GPU AMD Instinct MI355X GPU

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

HPE iLO 6 v1.72 or later. Please update the iLO to iLO6 v1.72 or later prior to updating the system ROM to revision 2.54 or later.

Problems Fixed:

Addressed an issue where servers could halt during POST displaying an "SPDM component authentication failure" even when SPDM was configured as disabled.

Addressed an issue where the system time zone setting could be reset to default when a DST-adjusted offset or stale mnemonic caused validation failure during boot.

Addressed an issue where restoring manufacturing defaults could result in incorrect memory configuration values being applied on AMD EPYC 9005 Series (Turin)-based platforms.

Addressed an issue where restoring defaults on high core count AMD EPYC 9005 Series (Turin) platforms (>=255 logical cores) could trigger an unnecessary full memory training cycle due to incorrect APIC mode handling.

Addressed an issue where the Tiered Memory Page Migration (TMPM) device was not generated in the ACPI SSDT table, preventing the MPDMA device from being recognized by the operating system.

Addressed an issue where the system could experience unnecessary boot halts on heavily loaded SPDM configurations when iLO discovery exceeded the BIOS timeout, even when SPDM policy was disabled.

Addressed an issue where the sysconfig UEFI shell command for enabledcoresperproc returned options inconsistent with the RBSU GUI.

Addressed a security vulnerability in OpenSSL (CVE-2026-7383) where a signed integer overflow in ASN1_mbstring_ncopy() could lead to a heap buffer overflow under specific conditions.

Addressed a security vulnerability in Libpng (CVE-2026-34757) where a use-after-free condition could occur when passing a pointer returned by the PLTE, tRNS, or hIST getters back into the corresponding setters.

Addressed a security vulnerability in OpenSSL (CVE-2026-45447) involving a possible use-after-free condition in PKCS7_verify().

Addressed a security vulnerability in Libpng (CVE-2026-33416) where a dangling pointer could result in reads or writes to freed memory during palette operations.

Addressed an issue where attempting to generate a Blue Screen of Death (BSOD) under Windows via iLO 6’s Virtual NMI Button does not function when Hyper-V is enabled on AMD EPYC 9005 Series (Turin) platforms.

Known Issues:

None

This version of the System ROM contains updates aligned with the Intel Product Update (IPU) version IPU.2026.3 guidance.

This version of the System ROM should be paired with Server Platform Services (SPS) Firmware 06.03.04.069.0 (2.40_01_12_2026).

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Resolved an issue where the Intel Xeon E-2477P (6377P) processor incorrectly reported a supported core count of 8 instead of 12.

Resolved an issue where the system could hang or assert when certain MMCFG configuration options were applied.

Resolved an issue where the system time zone could be unexpectedly reset to the default value during boot when a DST-adjusted offset validation failed.

Resolved an issue where a Red Screen of Death (RSOD) could occur during PCIe error handling under certain conditions.

Resolved an issue where an unexpected processor state could cause a system fault during POST after memory training, potentially resulting in an RSOD during certain diagnostic operations.

Resolved an issue where systems with many SPDM-capable devices could experience unnecessary boot delays even when the SPDM policy was disabled.

Resolved an issue where the deprecated ASIX USB NIC RBSU configuration knob was still visible. The knob has been removed as it is no longer required.

Resolved an issue where eMMC devices of 8GB or 16GB capacity were not handled correctly due to a UINT32 overflow condition.

Known Issues:

After the operating system configures the time zone, subsequent time zone changes made in UEFI System Utilities (RBSU) may not be retained after a system reboot.

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Resolved an issue where the Intel Xeon E-2477P (6377P) processor incorrectly reported a supported core count of 8 instead of 12.

Resolved an issue where the system could hang or assert when certain MMCFG configuration options were applied.

Resolved an issue where the system time zone could be unexpectedly reset to the default value during boot when a DST-adjusted offset validation failed.

Resolved an issue where a Red Screen of Death (RSOD) could occur during PCIe error handling under certain conditions.

Resolved an issue where an unexpected processor state could cause a system fault during POST after memory training, potentially resulting in an RSOD during certain diagnostic operations.

Resolved an issue where systems with many SPDM-capable devices could experience unnecessary boot delays even when the SPDM policy was disabled.

Resolved an issue where the deprecated ASIX USB NIC RBSU configuration knob was still visible. The knob has been removed as it is no longer required.

Resolved an issue where eMMC devices of 8GB or 16GB capacity were not handled correctly due to a UINT32 overflow condition.

Known Issues:

This version of the System ROM contains updates aligned with the Intel IPU2026.3 update. This version of the System ROM should be paired with Server Platform Services (SPS) Firmware 06.01.04.230.0 (2.90_08_16_2026).

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Addressed an issue where BIOS settings might be lost after an iLO factory reset in CNSA mode, causing multiple iLO management functions to stop working.

Addressed an issue where Secure Boot key auto-enrollment might not be triggered after using "Reset All Keys to Platform Defaults" in RBSU with OEM Secure Boot customization enabled.

Addressed an issue where the Secure Boot Auto Enroll Policy setting might not be synchronized correctly between RBSU and Redfish interfaces.

Addressed an issue where the SPDM Overall Boot Policy might not be read from the correct location, resulting in unexpected SPDM boot policy behavior.

Addressed an issue where deleting a Secure Boot signature via the Redfish API might fail.

Known Issues:

After the operating system configures the time zone, subsequent time zone changes made in UEFI System Utilities (RBSU) may not be retained after a system reboot.

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where BIOS settings might be lost after an iLO factory reset in CNSA mode, causing multiple iLO management functions to stop working.

Addressed an issue where Secure Boot key auto-enrollment might not be triggered after using "Reset All Keys to Platform Defaults" in RBSU with OEM Secure Boot customization enabled.

Addressed an issue where the Secure Boot Auto Enroll Policy setting might not be synchronized correctly between RBSU and Redfish interfaces.

Addressed an issue where the SPDM Overall Boot Policy might not be read from the correct location, resulting in unexpected SPDM boot policy behavior.

Addressed an issue where deleting a Secure Boot signature via the Redfish API might fail.

Known Issues:

• Garbled characters are observed in the System Utilities(F9) configuration screens with Japanese Environment when HPE Emulex Fibre Channel Host Bus Adapter is installed on ProLiant Gen11 and ProLiant Gen12 servers
• Unified Extensible Firmware Interface (UEFI) protocol driver does not complete the polling device; causing the UEFI diagnostics system board component test incomplete.

SPDM - Get Certificate response returns out of bound values

• Firmware failed to scan the correct CQs for the PF after the FW entered into the CQ recovery mode., resulting in CQs for the PF not being recovered.

This version of the System ROM contains updates aligned with the Intel IPU2026.3 update. This version of the System ROM should be paired with Server Platform Services (SPS) Firmware 06.01.04.230.0 (2.90_08_16_2026).

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Addressed an issue where BIOS settings might be lost after an iLO factory reset in CNSA mode, causing multiple iLO management functions to stop working.

Addressed an issue where Secure Boot key auto-enrollment might not be triggered after using "Reset All Keys to Platform Defaults" in RBSU with OEM Secure Boot customization enabled.

Addressed an issue where the Secure Boot Auto Enroll Policy setting might not be synchronized correctly between RBSU and Redfish interfaces.

Addressed an issue where the SPDM Overall Boot Policy might not be read from the correct location, resulting in unexpected SPDM boot policy behavior.

Addressed an issue where deleting a Secure Boot signature via the Redfish API might fail.

Known Issues:

After the operating system configures the time zone, subsequent time zone changes made in UEFI System Utilities (RBSU) may not be retained after a system reboot.

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where BIOS settings might be lost after an iLO factory reset in CNSA mode, causing multiple iLO management functions to stop working.

Addressed an issue where Secure Boot key auto-enrollment might not be triggered after using "Reset All Keys to Platform Defaults" in RBSU with OEM Secure Boot customization enabled.

Addressed an issue where the Secure Boot Auto Enroll Policy setting might not be synchronized correctly between RBSU and Redfish interfaces.

Addressed an issue where the SPDM Overall Boot Policy might not be read from the correct location, resulting in unexpected SPDM boot policy behavior.

Addressed an issue where deleting a Secure Boot signature via the Redfish API might fail.

Known Issues:

This version of the System ROM contains updates aligned with the Intel IPU2026.3 update. This version of the System ROM should be paired with Server Platform Services (SPS) Firmware 06.01.04.230.0 (2.90_08_16_2026).

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Addressed an issue where BIOS settings might be lost after an iLO factory reset in CNSA mode, causing multiple iLO management functions to stop working.

Addressed an issue where Secure Boot key auto-enrollment might not be triggered after using "Reset All Keys to Platform Defaults" in RBSU with OEM Secure Boot customization enabled.

Addressed an issue where the Secure Boot Auto Enroll Policy setting might not be synchronized correctly between RBSU and Redfish interfaces.

Addressed an issue where the SPDM Overall Boot Policy might not be read from the correct location, resulting in unexpected SPDM boot policy behavior.

Addressed an issue where deleting a Secure Boot signature via the Redfish API might fail.

Known Issues:

After the operating system configures the time zone, subsequent time zone changes made in UEFI System Utilities (RBSU) may not be retained after a system reboot.

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where BIOS settings might be lost after an iLO factory reset in CNSA mode, causing multiple iLO management functions to stop working.

Addressed an issue where Secure Boot key auto-enrollment might not be triggered after using "Reset All Keys to Platform Defaults" in RBSU with OEM Secure Boot customization enabled.

Addressed an issue where the Secure Boot Auto Enroll Policy setting might not be synchronized correctly between RBSU and Redfish interfaces.

Addressed an issue where the SPDM Overall Boot Policy might not be read from the correct location, resulting in unexpected SPDM boot policy behavior.

Addressed an issue where deleting a Secure Boot signature via the Redfish API might fail.

Known Issues:

• CREATE_PARSE_GRAPH_NODE incorrectly applied validation intended for WA mode, in which header_length_field_offset is adjusted by firmware. Since ConnectX-8 and newer adapters use normal mode only, these checks were redundant and could reject valid input. Validation is now mode-specific: normal-mode rules are applied on ConnectX-8 and newer adapters, while WA-mode rules are applied on older adapters.
• The firmware did not enforce the adapter limit for the number of flow match samples per parse graph node across the device. As a result, creation could succeed even when the total exceeded the hardware-supported limit. Firmware now enforces this limit before allocating samples. Creating a parse graph node that would exceed the maximum number of hardware flow match samples now fails with a “no resources” error.
• When Flex Parser overwrite native arc was enabled, destroying or closing a parse graph node on a native protocol arc did not restore the native protocol parser. As a result, the native parser remained unavailable on the device until a reset or another recovery action was performed. Native protocol parsing is now restored as expected when the parse graph node is closed or destroyed. Native parsers are disabled only while the Flex Parser graph owns the arc.
• A corner-case race condition triggered by DSP resets, causing the link to be unresponsive.
• A DEAD IRISC assert that could occur during TLV NV_DATA flash access by suspending the watchdog while waiting for flash IPC (until timeout), preventing the assert on TLV access.
• In rare cases, certain module types experienced link-up failures.
• After toggling all ports, one port could become unresponsive in the Receiver Detect state.
• Repeatedly writing NVCONFIG TLVs could cause excessive NV_DATA partition swaps during garbage collection. This rapid cycling could accelerate flash wear (end-of-life at 100,000 erases) and potentially render the device inoperable. Firmware now avoids unnecessary physical writes by returning OK when the requested configuration already exists in flash, and increases the maximum supported NV_DATA partition swaps from 100,000 to 200,000.
• NSM did not function reliably in multihost configurations when a DMA physical function (PF) was present.
• ICM_RES_HW_DMFS_ENCAP_H_FW was allocated per GVMI, preventing some RTTs from using it.
• Queue pairs (QPs) created during a PCC process transition could miss congestion-control (CC) information, preventing them from being fully managed.
• The LAG layer steering table had only one strict-SQ entry, causing strict no-port-select traffic to be routed to a single default port. With LOAD_BALANCE_MODE_P1=3, this could lead to link flapping because LACP packets were transmitted only from that default port. The fix expands the LAG layer steering table and adds additional strict-port entries to distribute strict traffic correctly.
• RDMA traffic could stall in large-scale deployments for certain source IP and UDP source-port combinations when DOCA PCC was active and no congestioncontrol algorithm was configured in algorithm slot 0.
• The live migration target did not receive a port state change event on the resume VHCA command. The target now generates this event so software that depends on port state is notified of any changes.
• An issue during hitless upgrade where, after the SACK generation/handler fence, firmware could mark the old port configuration ID as invalid. If SACK causes were still active, a race could cause SACK ISRs to stop unexpectedly. The fix is to always return BUSY while handover is active.
• When using multiplane ZTRCC congestion control with multiple flows, the RTT timeout counter in the PPCC register could increase even when the network was not congested.
• A firmware race condition between packet receive and QP cleanup could move a QP to error when reopening the same QP and sending the same MSN. This could occur when interrupting traffic (e.g., Ctrl+C) and running many iterations until the same QP/MSN combination is reused.
• The FMT Static PF verifier did not account for the Tools PF when verifying the DMA PF. 
• QPs established before loading DOCA PCC could exhibit inconsistent algorithm-selected behavior between ports in LAG mode after DOCA PCC is loaded.
• One-to-one RoCE traffic using a single QP might not achieve line rate on some platforms when using the default ROCE_CC_COMPATIBILITY_MODE setting in mlxconfig.
• In some configurations with ConnectX-8 connected to an MP3 switch, the link might fail to come up on the switch side after toggling ports. In these cases, ConnectX-8 reported opcode 14, indicating detected remote faults and that the partner was not bringing the link up.
• ACS errors could occur due to a race condition when performing LDE/SBR while MCTP traffic to the device was active.
• A potential routing error when IOVAs assigned to the NIC overlap with the PCIe address space. In certain configurations, an IOVA could fall into an “unclaimed address” range, within a PCIe switch’s Upstream Port (USP) window but outside any Downstream Port (DSP) aperture. Note: Since this is a kernel issue, to ensure packets are routed correctly in these scenarios, users must enable the ACS Unclaimed Request Redirect bit in the PCIe bridges’ Access Control Services (ACS) capability via the kernel.
• Partially enabling ACS enhanced capability could cause unexpected driver and system behavior. ACS enhanced capability remains disabled and will not be enabled.

• In certain configurations with the ConnectX-8 PCIe switch enabled, downstream devices (including GPUs) might not be detected and could drop from the PCI bus, with GPU sensors/properties reporting NA. This was caused by the device not receiving the required PERST# assertion during initialization, and was seen only when PCIe settings were manually modified via mlxconfig (e.g., restricting link speed/width or ASPM on specific PCI buses).
• The DPA kernel used unsafe ICM access during process creation/modification, which could cause the DPA kernel to hang during FLR.
• Link failures were occasionally observed at PAM4 speeds over optical interfaces in rare cases.
• An issue in the User Debugger “query caps” where it returned only the number of capabilities, not the capability bitmap.
• CR dumps could time out when accessing xpl_top addresses across all three pcores.
• The Virtio and NVMe EMU_MNG settings were exposed incorrectly, which could cause confusion when using mlxconfig.
• The PHY LED could show green during the initializing state when active speed was set to full speed. In IB mode, the initializing-state LED should be amber only.
• On multi-PF-per-port systems, a PF FLR could impact the traffic bandwidth of other PFs on the same port.
• PTP could converge to an incorrect time/offset and report an inaccurate path delay.
• In Flit Mode, the device could become unresponsive when receiving malformed or invalid traffic from a link partner.
• "mlxlink" reported 0 values for SNR (media and host) due to incorrect local port mapping in firmware and an incorrect page number used by MFT.
• Parallel accesses to the MCIA register could return incorrect data. In some hosts running ethtool -m <interface> repeatedly (e.g., once per second), this could intermittently report Identifier: 0x00 (unknown/no module), causing health checks to fail.
• A rare attestation certificate signature formatting issue leading to an unnecessary zero byte in the “r” or “s” value.
• In certain Gen6 setups, RDMA READ bidirectional traffic required at least 5 QPs to reach full wire speed.
• An issue affecting single-process, unidirectional RDMA READ to GPU memory (4 QPs, 128KB messages) by enabling ZERO_TOUCH_TUNING_ENABLE via MLXCONFIG.
• An issue where probe packets might not be sent under heavy traffic.
• The root complex sent MCTP-over-PCI messages before a BDF was assigned, causing responses to be sent with BDF 0. The fix ensures that MCTP messages routed by ID are ignored until a valid BDF is assigned.
• The steering tables were not updated after enabling partial Spectrum-X capabilities (BTH.AR) via LLPD.
• An intX message was sent with a Requester ID of 0, causing an ACS violation at the root port. The fix uses the correct BDF as the Requester ID instead of 0.

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where the system may encounter reset loop after updating ME/SPS firmware using smart components.

Known Issues:

This version of the System ROM contains updates aligned with the Intel IPU2026.3 update. This version of the System ROM should be paired with Server Platform Services (SPS) Firmware 06.01.04.230.0 (2.90_08_16_2026).

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Addressed an issue where BIOS settings might be lost after an iLO factory reset in CNSA mode, causing multiple iLO management functions to stop working.

Addressed an issue where Secure Boot key auto-enrollment might not be triggered after using "Reset All Keys to Platform Defaults" in RBSU with OEM Secure Boot customization enabled.

Addressed an issue where the Secure Boot Auto Enroll Policy setting might not be synchronized correctly between RBSU and Redfish interfaces.

Addressed an issue where the SPDM Overall Boot Policy might not be read from the correct location, resulting in unexpected SPDM boot policy behavior.

Addressed an issue where deleting a Secure Boot signature via the Redfish API might fail.

Known Issues:

After the operating system configures the time zone, subsequent time zone changes made in UEFI System Utilities (RBSU) may not be retained after a system reboot.

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where BIOS settings might be lost after an iLO factory reset in CNSA mode, causing multiple iLO management functions to stop working.

Addressed an issue where Secure Boot key auto-enrollment might not be triggered after using "Reset All Keys to Platform Defaults" in RBSU with OEM Secure Boot customization enabled.

Addressed an issue where the Secure Boot Auto Enroll Policy setting might not be synchronized correctly between RBSU and Redfish interfaces.

Addressed an issue where the SPDM Overall Boot Policy might not be read from the correct location, resulting in unexpected SPDM boot policy behavior.

Addressed an issue where deleting a Secure Boot signature via the Redfish API might fail.

Known Issues:

•     corner case performance enhance.
•     Servo change that resolves issue with early heat application from Idle sweep seek terminated that may cause read errors.

• vDPA doorbell resources were not released causing failures when running other functionality after a vDPA FLR. Doorbell resources are now properly unlocked.
• Live migration target would not receive a port state change event on the resume VHCA command. The target now generates this event so software that depends on port state is notified of any changes.
• PCC issue where RDMA traffic would stall at large scale for certain IP and UDP source-port combinations when a PCC user algorithm was active and no CC algorithm was configured in slot 0.

• vDPA doorbell resources were not released causing failures when running other functionality after a vDPA FLR. Doorbell resources are now properly unlocked.
• Live migration target would not receive a port state change event on the resume VHCA command. The target now generates this event so software that depends on port state is notified of any changes.
• PCC issue where RDMA traffic would stall at large scale for certain IP and UDP source-port combinations when a PCC user algorithm was active and no CC algorithm was configured in slot 0.

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Corrected a display issue affecting temperature readings.

Known Issues:

None

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Resolved an issue where deleting or enrolling Secure Boot signatures via the Redfish API could fail.

Resolved an issue where Secure Boot key Auto Enrollment was not triggered after performing "Reset All Keys to Platform Defaults" through RBSU or the Redfish API when OEM Secure Boot customization was in use. The system now correctly re-enrolls the default Secure Boot keys after a reset.

Resolved an issue where the Secure Boot Auto Enroll Policy setting configured via the Redfish API was not correctly synchronized with the corresponding RBSU setting, and changes made in RBSU were not reflected in Redfish.

Resolved an issue where someiLO functions may stop working until the next system boot after an iLO factory reset.

Resolved an issue where a SPDM device authentication may be skipped during boot.

Resolved an issue where NVMe-oF IPv6 target hard drives were not detected during VMware 9.0 installation.

- Addressed the following security vulnerabilities:

- CVE-2026-34180 (OpenSSL)

Known Issues:

This revision of the System ROM includes AMD reference code GenoaPI 1.0.0.J for AMD 4th Generation EPYC processors.

This revision of the System ROM includes AMD reference code TurinPI 1.0.0.B for AMD 5th Generation EPYC processors.

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Addressed an issue where HPE Smart Memory DIMMs could be incorrectly identified as non-Smart Memory.

Addressed a security vulnerability in OpenSSL (CVE-2026-7383) where a signed integer overflow in ASN1_mbstring_ncopy() could lead to a heap buffer overflow under specific conditions.

Addressed a security vulnerability in Libpng (CVE-2026-34757) where a use-after-free condition could occur when passing a pointer returned by the PLTE, tRNS, or hIST getters back into the corresponding setters.

Addressed a security vulnerability in OpenSSL (CVE-2026-45447) involving a possible use-after-free condition in PKCS7_verify().

Addressed a security vulnerability in Libpng (CVE-2026-33416) where a dangling pointer could result in reads or writes to freed memory during palette operations.

Addressed an issue where iLO NMI could not generate a BSOD on Windows when Hyper-V was enabled on AMD Gen11 platforms.

Addressed an issue where VMware ESXi 9.1 installation could intermittently fail with a PSOD indicating inconsistent SVM MSR lock status across CPU cores.

Addressed an issue where the Tiered Memory Page Migration (TMPM) device was not generated in the ACPI SSDT table, preventing the MPDMA device from being recognized by the operating system.

Addressed an issue where the system could experience unnecessary boot halts on heavily loaded SPDM configurations when iLO discovery exceeded the BIOS timeout, even when SPDM policy was disabled.

Addressed an issue where the sysconfig shell command for enabledcoresperproc returned options inconsistent with the RBSU GUI.

Addressed an issue where the system timezone could be reset to default when DST-adjusted offset validation or stale mnemonic caused a validation failure during boot.

Addressed an issue where the progress bar was misaligned on the initial POST screen in Quiet Mode when a non-default OEM logo was configured.

Addressed an issue where visual noise appeared on OEM logo during POST screen display.

Addressed an issue where restoring defaults on high core count AMD Turin platforms (>=255 logical cores) could trigger an unnecessary full memory training cycle due to incorrect APIC mode handling.

Known Issues:

None

This version of the System ROM contains updates aligned with the Intel IPU2026.3 update. This version of the System ROM should be paired with Server Platform Services (SPS) Firmware 06.01.04.230.0 (2.90_08_16_2026).

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Addressed an issue where BIOS settings might be lost after an iLO factory reset in CNSA mode, causing multiple iLO management functions to stop working.

Addressed an issue where Secure Boot key auto-enrollment might not be triggered after using "Reset All Keys to Platform Defaults" in RBSU with OEM Secure Boot customization enabled.

Addressed an issue where the Secure Boot Auto Enroll Policy setting might not be synchronized correctly between RBSU and Redfish interfaces.

Addressed an issue where the SPDM Overall Boot Policy might not be read from the correct location, resulting in unexpected SPDM boot policy behavior.

Addressed an issue where deleting a Secure Boot signature via the Redfish API might fail.

Known Issues:

After the operating system configures the time zone, subsequent time zone changes made in UEFI System Utilities (RBSU) may not be retained after a system reboot.

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where BIOS settings might be lost after an iLO factory reset in CNSA mode, causing multiple iLO management functions to stop working.

Addressed an issue where Secure Boot key auto-enrollment might not be triggered after using "Reset All Keys to Platform Defaults" in RBSU with OEM Secure Boot customization enabled.

Addressed an issue where the Secure Boot Auto Enroll Policy setting might not be synchronized correctly between RBSU and Redfish interfaces.

Addressed an issue where the SPDM Overall Boot Policy might not be read from the correct location, resulting in unexpected SPDM boot policy behavior.

Addressed an issue where deleting a Secure Boot signature via the Redfish API might fail.

Known Issues:

This version of the System ROM contains updates aligned with the Intel IPU2026.3 update. This version of the System ROM should be paired with Server Platform Services (SPS) Firmware 06.01.04.230.0 (2.90_08_16_2026).

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Addressed an issue where BIOS settings might be lost after an iLO factory reset in CNSA mode, causing multiple iLO management functions to stop working.

Addressed an issue where Secure Boot key auto-enrollment might not be triggered after using "Reset All Keys to Platform Defaults" in RBSU with OEM Secure Boot customization enabled.

Addressed an issue where the Secure Boot Auto Enroll Policy setting might not be synchronized correctly between RBSU and Redfish interfaces.

Addressed an issue where the SPDM Overall Boot Policy might not be read from the correct location, resulting in unexpected SPDM boot policy behavior.

Addressed an issue where deleting a Secure Boot signature via the Redfish API might fail.

Known Issues:

After the operating system configures the time zone, subsequent time zone changes made in UEFI System Utilities (RBSU) may not be retained after a system reboot.

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where BIOS settings might be lost after an iLO factory reset in CNSA mode, causing multiple iLO management functions to stop working.

Addressed an issue where Secure Boot key auto-enrollment might not be triggered after using "Reset All Keys to Platform Defaults" in RBSU with OEM Secure Boot customization enabled.

Addressed an issue where the Secure Boot Auto Enroll Policy setting might not be synchronized correctly between RBSU and Redfish interfaces.

Addressed an issue where the SPDM Overall Boot Policy might not be read from the correct location, resulting in unexpected SPDM boot policy behavior.

Addressed an issue where deleting a Secure Boot signature via the Redfish API might fail.

Known Issues:

• A BlueField-3 host SF could remain stuck in the inactive+attached state and fail to reactivate after host restart flows.
• A NULL pointer dereference in the mlx5_core driver that could cause a kernel panic and report PCIe completion-timeout errors on ConnectX-8 bare-metal systems.
• An issue that occurred when CONFIG_UBSAN=y and the user provided an invalid value, resulting in the following UBSAN error:UBSAN: shift-out-of-bounds in drivers/net/ethernet/mellanox/mlx5/core/diag/diag_cnt.c:190:11 shift exponent 4294967293 is too large for 32-bit type 'int'
• A race condition in the ib_core kernel module during concurrent address resolution that could produce a zero destination MAC (DMAC), causing silent packet loss and RDMA retry-exceeded errors.
• Upgrading doca-ofed did not always upgrade doca-extra (which includes the module sources and doca-kernel-support build scripts). In some cases, this caused doca-kernel-support to build against sources from an older release.
• Accessing timestamping mode could fail on kernel 7.0 and later.

• A BlueField-3 host SF could remain stuck in the inactive+attached state and fail to reactivate after host restart flows.
• A NULL pointer dereference in the mlx5_core driver that could cause a kernel panic and report PCIe completion-timeout errors on ConnectX-8 bare-metal systems.
• An issue that occurred when CONFIG_UBSAN=y and the user provided an invalid value, resulting in the following UBSAN error:UBSAN: shift-out-of-bounds in drivers/net/ethernet/mellanox/mlx5/core/diag/diag_cnt.c:190:11 shift exponent 4294967293 is too large for 32-bit type 'int'
• A race condition in the ib_core kernel module during concurrent address resolution that could produce a zero destination MAC (DMAC), causing silent packet loss and RDMA retry-exceeded errors.
• Upgrading doca-ofed did not always upgrade doca-extra (which includes the module sources and doca-kernel-support build scripts). In some cases, this caused doca-kernel-support to build against sources from an older release.
• Accessing timestamping mode could fail on kernel 7.0 and later.

• NIC was not enumerated after PCIe disable/enable cycles.
• Fatal firmware crash in HWRM_PORT_ADSM_QSTATES during link-down/module cycling.
• PCI-e BARs were being resized on fast-boot or a normal boot of the firmware.
• dyncc_tables uninitialized memory defect.
• dyncc_tables dump-bin QP number truncation issue.
• Failure to generate yml file from config bin file.
• Incorrect spelling of "parse-yml" in dyncc_tables usage output.

• Bad port speed in MCTP VDM Get PCIe Adapter Attributes response.
• Set/Clear PCIE CRS on PERST assert/deassert.
• Relaxed Ordering and No Snoop were incorrectly enabled in statistics block.
• VF Count Boundary Checking issue.
• Ethtool displayed "No Cable" when a module was inserted.
• Port link flap issue during BMC initiated host power cycle.
• Firmware crash due to 0XFF (AEN) packet received as NCSI cmd.
• Buffer was not freed by PLDM Firmware Update error handling.    
• NC-SI Clear Initial State command resulted in buffers being freed incorrectly.

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Resolved an issue where deleting or enrolling Secure Boot signatures via the Redfish API could fail.

Resolved an issue where Secure Boot key Auto Enrollment was not triggered after performing "Reset All Keys to Platform Defaults" through RBSU or the Redfish API when OEM Secure Boot customization was in use. The system now correctly re-enrolls the default Secure Boot keys after a reset.

Resolved an issue where the Secure Boot Auto Enroll Policy setting configured via the Redfish API was not correctly synchronized with the corresponding RBSU setting, and changes made in RBSU were not reflected in Redfish.

Resolved an issue where someiLO functions may stop working until the next system boot after an iLO factory reset.

Resolved an issue where a SPDM device authentication may be skipped during boot.

Resolved an issue where NVMe-oF IPv6 target hard drives were not detected during VMware 9.0 installation.

- Addressed the following security vulnerabilities:

- CVE-2026-34180 (OpenSSL)

Known Issues:

This revision of the System ROM includes AMD reference code GenoaPI 1.0.0.J for AMD 4th Generation EPYC processors.

This revision of the System ROM includes AMD reference code TurinPI 1.0.0.B for AMD 5th Generation EPYC processors.

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Addressed an issue where HPE Smart Memory DIMMs could be incorrectly identified as non-Smart Memory.

Addressed a security vulnerability in OpenSSL (CVE-2026-7383) where a signed integer overflow in ASN1_mbstring_ncopy() could lead to a heap buffer overflow under specific conditions.

Addressed a security vulnerability in Libpng (CVE-2026-34757) where a use-after-free condition could occur when passing a pointer returned by the PLTE, tRNS, or hIST getters back into the corresponding setters.

Addressed a security vulnerability in OpenSSL (CVE-2026-45447) involving a possible use-after-free condition in PKCS7_verify().

Addressed a security vulnerability in Libpng (CVE-2026-33416) where a dangling pointer could result in reads or writes to freed memory during palette operations.

Addressed an issue where iLO NMI could not generate a BSOD on Windows when Hyper-V was enabled on AMD Gen11 platforms.

Addressed an issue where VMware ESXi 9.1 installation could intermittently fail with a PSOD indicating inconsistent SVM MSR lock status across CPU cores.

Addressed an issue where the Tiered Memory Page Migration (TMPM) device was not generated in the ACPI SSDT table, preventing the MPDMA device from being recognized by the operating system.

Addressed an issue where the system could experience unnecessary boot halts on heavily loaded SPDM configurations when iLO discovery exceeded the BIOS timeout, even when SPDM policy was disabled.

Addressed an issue where the sysconfig shell command for enabledcoresperproc returned options inconsistent with the RBSU GUI.

Addressed an issue where the system timezone could be reset to default when DST-adjusted offset validation or stale mnemonic caused a validation failure during boot.

Addressed an issue where the progress bar was misaligned on the initial POST screen in Quiet Mode when a non-default OEM logo was configured.

Addressed an issue where visual noise appeared on OEM logo during POST screen display.

Addressed an issue where restoring defaults on high core count AMD Turin platforms (>=255 logical cores) could trigger an unnecessary full memory training cycle due to incorrect APIC mode handling.

Known Issues:

None

Garbled characters are observed in the System Utilities(F9) configuration screens with Japanese Environment when HPE Emulex Fibre Channel Host Bus Adapter is installed on ProLiant Gen11 and ProLiant Gen12 servers

SPDM - Get Certificate response returns out of bound values

This revision of the System ROM includes AMD reference code GenoaPI 1.0.0.J for AMD 4th Generation EPYC processors.

This revision of the System ROM includes AMD reference code TurinPI 1.0.0.B for AMD 5th Generation EPYC processors.

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Addressed an issue where HPE Smart Memory DIMMs could be incorrectly identified as non-Smart Memory.

Addressed a security vulnerability in OpenSSL (CVE-2026-7383) where a signed integer overflow in ASN1_mbstring_ncopy() could lead to a heap buffer overflow under specific conditions.

Addressed a security vulnerability in Libpng (CVE-2026-34757) where a use-after-free condition could occur when passing a pointer returned by the PLTE, tRNS, or hIST getters back into the corresponding setters.

Addressed a security vulnerability in OpenSSL (CVE-2026-45447) involving a possible use-after-free condition in PKCS7_verify().

Addressed a security vulnerability in Libpng (CVE-2026-33416) where a dangling pointer could result in reads or writes to freed memory during palette operations.

Addressed an issue where iLO NMI could not generate a BSOD on Windows when Hyper-V was enabled on AMD Gen11 platforms.

Addressed an issue where VMware ESXi 9.1 installation could intermittently fail with a PSOD indicating inconsistent SVM MSR lock status across CPU cores.

Addressed an issue where the Tiered Memory Page Migration (TMPM) device was not generated in the ACPI SSDT table, preventing the MPDMA device from being recognized by the operating system.

Addressed an issue where the system could experience unnecessary boot halts on heavily loaded SPDM configurations when iLO discovery exceeded the BIOS timeout, even when SPDM policy was disabled.

Addressed an issue where the sysconfig shell command for enabledcoresperproc returned options inconsistent with the RBSU GUI.

Addressed an issue where the system timezone could be reset to default when DST-adjusted offset validation or stale mnemonic caused a validation failure during boot.

Addressed an issue where the progress bar was misaligned on the initial POST screen in Quiet Mode when a non-default OEM logo was configured.

Addressed an issue where visual noise appeared on OEM logo during POST screen display.

Addressed an issue where restoring defaults on high core count AMD Turin platforms (>=255 logical cores) could trigger an unnecessary full memory training cycle due to incorrect APIC mode handling.

Known Issues:

None

• NSM Get-Port-Network-Addresses returned an invalid format on B200/B300 HMC. It now follows the documented non-compact format.
• An issue that could prevent the adapter’s PCIe link from re-establishing after the host resumed from a deep power-down state. This fix improves the reliability of suspend/resume cycles.
• A DEAD IRISC assert that could occur during TLV NV_DATA flash access by suspending the watchdog while waiting for flash IPC (until timeout), preventing the assert on TLV access.
• An issue where repeatedly writing NVCONFIG TLVs could cause excessive NV_DATA partition swaps during garbage collection. This rapid cycling could accelerate flash wear (end-of-life at 100,000 erases) and potentially render the device inoperable. Firmware now avoids unnecessary physical writes by returning OK when the requested configuration already exists in flash, and increases the maximum supported NV_DATA partition swaps from 100,000 to 200,000.
• ICM_RES_HW_DMFS_ENCAP_H_FW was allocated per GVMI, preventing some RTTs from using it.
• vDPA doorbell resources were not released, which could cause failures when running other functionality after a vDPA FLR. Doorbell resources are now properly unlocked.
• RDMA traffic could stall in large-scale deployments for certain source IP and UDP source-port combinations when DOCA PCC was active and no congestion-control algorithm was configured in algorithm slot 0.
• The live migration target did not receive a port state change event on the resume VHCA command. The target now generates this event so software that depends on port state is notified of any changes.
• A precopy image was processed during the stop-copy phase, causing prolonged downtime due to a software limitation. The handling was slow because the handler performed a linear search for data; this was improved by replacing it with a faster search approach enabled via compile-time preprocessing.
• QPs established before loading DOCA PCC could exhibit inconsistent algorithm-selected behavior between ports in LAG mode after DOCA PCC is loaded.

• An interoperability issue where, when ConnectX-7 communicates with ConnectX-8 using the probe-based algorithm, bandwidth could become extremely low due to probe packets being dropped.
• The DPA kernel used unsafe ICM access during process creation/modification, which would cause the DPA kernel to hang during FLR.
• User Debugger “query caps” returned only the number of capabilities, not the capability bitmap.
• Race condition in standby/boot power sequencing. In certain timing windows, port power-down would be delayed such that the power-up flow detected the port still transitioning to power-down, causing the sequence to fail and leaving the port stuck in a powered-down state.
• mlxlink reported 0 values for SNR (media and host) due to incorrect local port mapping in firmware and an incorrect page number used by MFT.
• Due to an SMBus release race condition, the I2C bus would become stuck.
• Fuse values were not aligned with the updated values burned across different ConnectX-7 setups.
• Issue in the steering definers used for LAG with IPv6 traffic.
• A spurious CNP was sent in response to an out-of-sequence packet.
• The root complex sent MCTP-over-PCI messages before a BDF was assigned, causing responses to be sent with BDF 0. The fix ensures that MCTP messages routed by ID are ignored until a valid BDF is assigned.
• The steering tables were not updated after enabling partial Spectrum-X capabilities (BTH.AR) via LLPD.
• When decapsulation on a packet occurred, the FCS indication was not calculated correctly.
• In IB system, RTT_response_sl feature did not work with Sniffer tools (e.g., Wireshark/Tcpdump/).
   

This revision of the System ROM includes AMD reference code TurinPI 1.0.0.B for AMD 5th Generation EPYC processors.

This version of the System ROM updates the default UEFI Secure Boot forbidden signature database (dbx) for CVE-2025-47827. Updating the System ROM alone does not apply the updated dbx. Users must reset Secure Boot keys to manufacturing defaults, or enroll the updated dbx through Windows, Linux, RBSU, or Redfish.

This revision of the System ROM supports the following GPUs: Nvidia H200 GPU Nvidia B200 GPU Nvidia B300 GPU AMD Instinct MI355X GPU

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

HPE iLO 6 v1.72 or later. Please update the iLO to iLO6 v1.72 or later prior to updating the system ROM to revision 2.54 or later.

Problems Fixed:

Addressed an issue where servers could halt during POST displaying an "SPDM component authentication failure" even when SPDM was configured as disabled.

Addressed an issue where the system time zone setting could be reset to default when a DST-adjusted offset or stale mnemonic caused validation failure during boot.

Addressed an issue where restoring manufacturing defaults could result in incorrect memory configuration values being applied on AMD EPYC 9005 Series (Turin)-based platforms.

Addressed an issue where restoring defaults on high core count AMD EPYC 9005 Series (Turin) platforms (>=255 logical cores) could trigger an unnecessary full memory training cycle due to incorrect APIC mode handling.

Addressed an issue where the Tiered Memory Page Migration (TMPM) device was not generated in the ACPI SSDT table, preventing the MPDMA device from being recognized by the operating system.

Addressed an issue where the system could experience unnecessary boot halts on heavily loaded SPDM configurations when iLO discovery exceeded the BIOS timeout, even when SPDM policy was disabled.

Addressed an issue where the sysconfig UEFI shell command for enabledcoresperproc returned options inconsistent with the RBSU GUI.

Addressed a security vulnerability in OpenSSL (CVE-2026-7383) where a signed integer overflow in ASN1_mbstring_ncopy() could lead to a heap buffer overflow under specific conditions.

Addressed a security vulnerability in Libpng (CVE-2026-34757) where a use-after-free condition could occur when passing a pointer returned by the PLTE, tRNS, or hIST getters back into the corresponding setters.

Addressed a security vulnerability in OpenSSL (CVE-2026-45447) involving a possible use-after-free condition in PKCS7_verify().

Addressed a security vulnerability in Libpng (CVE-2026-33416) where a dangling pointer could result in reads or writes to freed memory during palette operations.

Addressed an issue where attempting to generate a Blue Screen of Death (BSOD) under Windows via iLO 6’s Virtual NMI Button does not function when Hyper-V is enabled on AMD EPYC 9005 Series (Turin) platforms.

Known Issues:

None

This version of the System ROM contains updates aligned with the Intel IPU2026.3 update. This version of the System ROM should be paired with Server Platform Services (SPS) Firmware 06.01.04.230.0 (2.90_08_16_2026).

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Addressed an issue where BIOS settings might be lost after an iLO factory reset in CNSA mode, causing multiple iLO management functions to stop working.

Addressed an issue where Secure Boot key auto-enrollment might not be triggered after using "Reset All Keys to Platform Defaults" in RBSU with OEM Secure Boot customization enabled.

Addressed an issue where the Secure Boot Auto Enroll Policy setting might not be synchronized correctly between RBSU and Redfish interfaces.

Addressed an issue where the SPDM Overall Boot Policy might not be read from the correct location, resulting in unexpected SPDM boot policy behavior.

Addressed an issue where deleting a Secure Boot signature via the Redfish API might fail.

Known Issues:

After the operating system configures the time zone, subsequent time zone changes made in UEFI System Utilities (RBSU) may not be retained after a system reboot.

This version of the System ROM contains updates aligned with the Intel IPU2026.3 update. This version of the System ROM should be paired with Server Platform Services (SPS) Firmware 06.01.04.230.0 (2.90_08_16_2026).

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Addressed an issue where BIOS settings might be lost after an iLO factory reset in CNSA mode, causing multiple iLO management functions to stop working.

Addressed an issue where Secure Boot key auto-enrollment might not be triggered after using "Reset All Keys to Platform Defaults" in RBSU with OEM Secure Boot customization enabled.

Addressed an issue where the Secure Boot Auto Enroll Policy setting might not be synchronized correctly between RBSU and Redfish interfaces.

Addressed an issue where the SPDM Overall Boot Policy might not be read from the correct location, resulting in unexpected SPDM boot policy behavior.

Addressed an issue where deleting a Secure Boot signature via the Redfish API might fail.

Known Issues:

None

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where the system may encounter reset loop after updating ME/SPS firmware using smart components.

Known Issues:

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Corrected a display issue affecting temperature readings.

Known Issues:

None

This version of the System ROM contains updates aligned with the Intel IPU2026.3 update. This version of the System ROM should be paired with Server Platform Services (SPS) Firmware 06.01.04.230.0 (2.90_08_16_2026).

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

None

Problems Fixed:

Addressed an issue where BIOS settings might be lost after an iLO factory reset in CNSA mode, causing multiple iLO management functions to stop working.

Addressed an issue where Secure Boot key auto-enrollment might not be triggered after using "Reset All Keys to Platform Defaults" in RBSU with OEM Secure Boot customization enabled.

Addressed an issue where the Secure Boot Auto Enroll Policy setting might not be synchronized correctly between RBSU and Redfish interfaces.

Addressed an issue where the SPDM Overall Boot Policy might not be read from the correct location, resulting in unexpected SPDM boot policy behavior.

Addressed an issue where deleting a Secure Boot signature via the Redfish API might fail.

Known Issues:

After the operating system configures the time zone, subsequent time zone changes made in UEFI System Utilities (RBSU) may not be retained after a system reboot.

Details about reported security vulnerabilities and their mitigation can be found at the following link Security Bulletin Library | HPE Support.

Firmware Dependencies:

Problems Fixed:

Addressed an issue where BIOS settings might be lost after an iLO factory reset in CNSA mode, causing multiple iLO management functions to stop working.

Addressed an issue where Secure Boot key auto-enrollment might not be triggered after using "Reset All Keys to Platform Defaults" in RBSU with OEM Secure Boot customization enabled.

Addressed an issue where the Secure Boot Auto Enroll Policy setting might not be synchronized correctly between RBSU and Redfish interfaces.

Addressed an issue where the SPDM Overall Boot Policy might not be read from the correct location, resulting in unexpected SPDM boot policy behavior.

Addressed an issue where deleting a Secure Boot signature via the Redfish API might fail.

Known Issues:

• CREATE_PARSE_GRAPH_NODE incorrectly applied validation intended for WA mode, in which header_length_field_offset is adjusted by firmware. Since ConnectX-8 and newer adapters use normal mode only, these checks were redundant and could reject valid input. Validation is now mode-specific: normal-mode rules are applied on ConnectX-8 and newer adapters, while WA-mode rules are applied on older adapters.
• The firmware did not enforce the adapter limit for the number of flow match samples per parse graph node across the device. As a result, creation could succeed even when the total exceeded the hardware-supported limit. Firmware now enforces this limit before allocating samples. Creating a parse graph node that would exceed the maximum number of hardware flow match samples now fails with a “no resources” error.
• When Flex Parser overwrite native arc was enabled, destroying or closing a parse graph node on a native protocol arc did not restore the native protocol parser. As a result, the native parser remained unavailable on the device until a reset or another recovery action was performed. Native protocol parsing is now restored as expected when the parse graph node is closed or destroyed. Native parsers are disabled only while the Flex Parser graph owns the arc.
• A corner-case race condition triggered by DSP resets, causing the link to be unresponsive.
• A DEAD IRISC assert that could occur during TLV NV_DATA flash access by suspending the watchdog while waiting for flash IPC (until timeout), preventing the assert on TLV access.
• In rare cases, certain module types experienced link-up failures.
• After toggling all ports, one port could become unresponsive in the Receiver Detect state.
• Repeatedly writing NVCONFIG TLVs could cause excessive NV_DATA partition swaps during garbage collection. This rapid cycling could accelerate flash wear (end-of-life at 100,000 erases) and potentially render the device inoperable. Firmware now avoids unnecessary physical writes by returning OK when the requested configuration already exists in flash, and increases the maximum supported NV_DATA partition swaps from 100,000 to 200,000.
• NSM did not function reliably in multihost configurations when a DMA physical function (PF) was present.
• ICM_RES_HW_DMFS_ENCAP_H_FW was allocated per GVMI, preventing some RTTs from using it.
• Queue pairs (QPs) created during a PCC process transition could miss congestion-control (CC) information, preventing them from being fully managed.
• The LAG layer steering table had only one strict-SQ entry, causing strict no-port-select traffic to be routed to a single default port. With LOAD_BALANCE_MODE_P1=3, this could lead to link flapping because LACP packets were transmitted only from that default port. The fix expands the LAG layer steering table and adds additional strict-port entries to distribute strict traffic correctly.
• RDMA traffic could stall in large-scale deployments for certain source IP and UDP source-port combinations when DOCA PCC was active and no congestioncontrol algorithm was configured in algorithm slot 0.
• The live migration target did not receive a port state change event on the resume VHCA command. The target now generates this event so software that depends on port state is notified of any changes.
• An issue during hitless upgrade where, after the SACK generation/handler fence, firmware could mark the old port configuration ID as invalid. If SACK causes were still active, a race could cause SACK ISRs to stop unexpectedly. The fix is to always return BUSY while handover is active.
• When using multiplane ZTRCC congestion control with multiple flows, the RTT timeout counter in the PPCC register could increase even when the network was not congested.
• A firmware race condition between packet receive and QP cleanup could move a QP to error when reopening the same QP and sending the same MSN. This could occur when interrupting traffic (e.g., Ctrl+C) and running many iterations until the same QP/MSN combination is reused.
• The FMT Static PF verifier did not account for the Tools PF when verifying the DMA PF. 
• QPs established before loading DOCA PCC could exhibit inconsistent algorithm-selected behavior between ports in LAG mode after DOCA PCC is loaded.
• One-to-one RoCE traffic using a single QP might not achieve line rate on some platforms when using the default ROCE_CC_COMPATIBILITY_MODE setting in mlxconfig.
• In some configurations with ConnectX-8 connected to an MP3 switch, the link might fail to come up on the switch side after toggling ports. In these cases, ConnectX-8 reported opcode 14, indicating detected remote faults and that the partner was not bringing the link up.
• ACS errors could occur due to a race condition when performing LDE/SBR while MCTP traffic to the device was active.
• A potential routing error when IOVAs assigned to the NIC overlap with the PCIe address space. In certain configurations, an IOVA could fall into an “unclaimed address” range, within a PCIe switch’s Upstream Port (USP) window but outside any Downstream Port (DSP) aperture. Note: Since this is a kernel issue, to ensure packets are routed correctly in these scenarios, users must enable the ACS Unclaimed Request Redirect bit in the PCIe bridges’ Access Control Services (ACS) capability via the kernel.
• Partially enabling ACS enhanced capability could cause unexpected driver and system behavior. ACS enhanced capability remains disabled and will not be enabled.

• In certain configurations with the ConnectX-8 PCIe switch enabled, downstream devices (including GPUs) might not be detected and could drop from the PCI bus, with GPU sensors/properties reporting NA. This was caused by the device not receiving the required PERST# assertion during initialization, and was seen only when PCIe settings were manually modified via mlxconfig (e.g., restricting link speed/width or ASPM on specific PCI buses).
• The DPA kernel used unsafe ICM access during process creation/modification, which could cause the DPA kernel to hang during FLR.
• Link failures were occasionally observed at PAM4 speeds over optical interfaces in rare cases.
• An issue in the User Debugger “query caps” where it returned only the number of capabilities, not the capability bitmap.
• CR dumps could time out when accessing xpl_top addresses across all three pcores.
• The Virtio and NVMe EMU_MNG settings were exposed incorrectly, which could cause confusion when using mlxconfig.
• The PHY LED could show green during the initializing state when active speed was set to full speed. In IB mode, the initializing-state LED should be amber only.
• On multi-PF-per-port systems, a PF FLR could impact the traffic bandwidth of other PFs on the same port.
• PTP could converge to an incorrect time/offset and report an inaccurate path delay.
• In Flit Mode, the device could become unresponsive when receiving malformed or invalid traffic from a link partner.
• "mlxlink" reported 0 values for SNR (media and host) due to incorrect local port mapping in firmware and an incorrect page number used by MFT.
• Parallel accesses to the MCIA register could return incorrect data. In some hosts running ethtool -m <interface> repeatedly (e.g., once per second), this could intermittently report Identifier: 0x00 (unknown/no module), causing health checks to fail.
• A rare attestation certificate signature formatting issue leading to an unnecessary zero byte in the “r” or “s” value.
• In certain Gen6 setups, RDMA READ bidirectional traffic required at least 5 QPs to reach full wire speed.
• An issue affecting single-process, unidirectional RDMA READ to GPU memory (4 QPs, 128KB messages) by enabling ZERO_TOUCH_TUNING_ENABLE via MLXCONFIG.
• An issue where probe packets might not be sent under heavy traffic.
• The root complex sent MCTP-over-PCI messages before a BDF was assigned, causing responses to be sent with BDF 0. The fix ensures that MCTP messages routed by ID are ignored until a valid BDF is assigned.
• The steering tables were not updated after enabling partial Spectrum-X capabilities (BTH.AR) via LLPD.
• An intX message was sent with a Requester ID of 0, causing an ACS violation at the root port. The fix uses the correct BDF as the Requester ID instead of 0.

• The Enabled-ClusterS2D command now completes successfully when executed on a SATA drive within a D3610 disk enclosure for a NonStop solution.

• The smart carrier, which is the drive case for SAS drives, now authenticates in the D3610/D3710 drive enclosure.

• Added new 7-segment error codes E0 and E1 to report issues with Fan modules A and B, respectively. These new codes only apply to the D3610/D3710 and only display when running firmware 5.04.

• If the storage enclosure processor within the I/O module fails, a hard reset (power down and then power up) is executed to ensure the processor comes back online.

Please refer to the Release Notes for the complete listing of fixes, enhancements, known issues and work-arounds corresponding to this firmware.