diff --git a/third_party/openthread-br/Makefile b/third_party/openthread-br/Makefile
index df54311..e760d22 100644
--- a/third_party/openthread-br/Makefile
+++ b/third_party/openthread-br/Makefile
@@ -34,9 +34,9 @@ PKG_RELEASE:=1
 PKG_SOURCE_URL:=https://github.com/openthread/ot-br-posix.git
 PKG_SOURCE_PROTO:=git-with-metadata
 
-PKG_SOURCE_DATE:=2026-05-22
-PKG_SOURCE_VERSION:=9e56492ef19b6d43cc8be4a69ac7ae6376194f69
-PKG_MIRROR_HASH:=2ba2e9aeeeb8c5ee7411f18d3303340bf35817f6c1f12fa35bebeae5974ac45a
+PKG_SOURCE_DATE:=2026-09-01
+PKG_SOURCE_VERSION:=fd872ab9d4afdfaf034b3b1154fed08b8b6d1e43
+PKG_MIRROR_HASH:=c323d8c5f8f156bada623cd6cdd8280c8dfd2fd2601ceda2f298b448eef58075
 
 PKG_LICENSE:=BSD-3-Clause
 PKG_LICENSE_FILES:=LICENSE
@@ -57,7 +57,7 @@ define Package/openthread-br/Default
   CATEGORY:=Network
   TITLE:=OpenThread Border Router
   URL:=https://github.com/openthread/ot-br-posix
-  DEPENDS:=+libstdcpp +OPENTHREADBR_SHARED_MBEDTLS:libmbedtls +libjson-c +libubus +libubox +kmod-usb-acm +kmod-tun +jsonfilter
+  DEPENDS:=+libstdcpp +OPENTHREADBR_SHARED_MBEDTLS:libmbedtls +libjson-c +libubus +libubox +libmnl +libnftnl +kmod-nft-core +kmod-nft-nat +kmod-usb-acm +kmod-tun +jsonfilter
 endef
 
 define Package/openthread-br/Default/description
@@ -69,18 +69,17 @@ endef
 
 define Package/openthread-br
   $(call Package/openthread-br/Default)
-  VARIANT:=default
-  DEPENDS+= +PACKAGE_openthread-br:libdnssd
+  DEPENDS+= +libdnssd
 endef
 
 define Package/openthread-br/description
 $(call Package/openthread-br/Default/description)
 
-This default variant of the package uses mDNSResponder for mDNS / DNS-SD.
+The package uses mDNSResponder for mDNS / DNS-SD.
 endef
 
 define Package/openthread-br/config
-if PACKAGE_openthread-br || PACKAGE_openthread-br-avahi
+if PACKAGE_openthread-br
 config OPENTHREADBR_SHARED_MBEDTLS
 	bool "Use shared mbedTLS library for OpenThread"
 	default n
@@ -92,32 +91,15 @@ config OPENTHREADBR_SHARED_MBEDTLS
 endif
 endef
 
-define Package/openthread-br-avahi
-  $(call Package/openthread-br/Default)
-  VARIANT:=avahi
-  PROVIDES:=openthread-br
-  CONFLICTS:=openthread-br
-  DEPENDS+= +PACKAGE_openthread-br-avahi:libavahi-client
-endef
-
-define Package/openthread-br-avahi/description
-$(call Package/openthread-br/Default/description)
-
-This variant of the package uses Avahi for mDNS / DNS-SD.
-endef
-
-
-define Package/openthread-br-luci
-  $(call Package/openthread-br/Default)
-  TITLE+= (LuCI module)
-  DEPENDS:=+luci-lua-runtime @PACKAGE_openthread-br||PACKAGE_openthread-br-avahi
-endef
-
-define Package/openthread-br-luci/description
-LuCI user interface for the OpenThread Border Router.
-endef
-
-# Disable firewall integration due to https://github.com/openthread/ot-br-posix/issues/1675
+# The OT posix platform firewall (OT_FIREWALL) produces ipset/ip6tables
+# rules, which nftables-based OpenWrt does not run, so it stays off - the
+# original reason firewall integration was disabled here
+# (https://github.com/openthread/ot-br-posix/issues/1675). OTBR_NFTABLES
+# is that issue delivered: otbr-agent installs the Thread ingress filter
+# and the NAT44 masquerade in-process, through nftables in an isolated
+# table. It needs nf_tables kernel support at runtime (kmod-nft-core,
+# kmod-nft-nat): with the backend compiled in, a failed firewall install
+# aborts the agent rather than silently forwarding unfiltered traffic.
 CMAKE_OPTIONS+= \
 	-DOTBR_GIT_VERSION=$(call GitWithMetadata/resolve,OTBR_GIT_VERSION)$(if $(PKG_RELEASE),-r$(PKG_RELEASE)) \
 	-DOT_PACKAGE_VERSION=$(call GitWithMetadata/resolve,OT_GIT_VERSION) \
@@ -128,8 +110,8 @@ CMAKE_OPTIONS+= \
 	-DOTBR_VENDOR_NAME=$(VERSION_MANUFACTURER) \
 	-DOTBR_BORDER_AGENT=ON \
 	-DOTBR_BORDER_ROUTING=ON \
-	-DOTBR_SRP_ADVERTISING_PROXY=ON \
 	-DOTBR_NAT64=OFF \
+	-DOTBR_NFTABLES=ON \
 	-DOTBR_SETTINGS_FILE_USE_INTERFACE_NAME=ON \
 	-DOT_POSIX_SETTINGS_PATH=\"/etc/openthread\" \
 	-DOT_FIREWALL=OFF \
@@ -145,15 +127,12 @@ ifneq ($(CONFIG_OPENTHREADBR_SHARED_MBEDTLS),)
 CMAKE_OPTIONS+= -DOTBR_EXTERNAL_MBEDTLS="mbedtls;mbedcrypto;mbedx509"
 endif
 
-ifeq ($(BUILD_VARIANT),avahi)
-CMAKE_OPTIONS+= -DOTBR_MDNS=avahi
-else
 CMAKE_OPTIONS+= -DOTBR_MDNS=mDNSResponder
-endif
 
 define Package/openthread-br/install
-	$(INSTALL_DIR) $(1)/usr/sbin $(1)/etc/init.d $(1)/etc/config $(1)/etc/uci-defaults $(1)/etc/hotplug.d/usb
+	$(INSTALL_DIR) $(1)/usr/sbin $(1)/etc/init.d $(1)/etc/config $(1)/etc/uci-defaults $(1)/etc/hotplug.d/usb $(1)/usr/share/otbr
 	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/otbr-agent $(1)/usr/sbin
+	$(INSTALL_DATA) $(PKG_INSTALL_DIR)/usr/share/otbr/nftables-backend $(1)/usr/share/otbr
 	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/ot-ctl $(1)/usr/sbin
 	$(INSTALL_BIN) ./files/otbr-rcp $(1)/usr/sbin
 	$(INSTALL_BIN) ./files/otbr-agent.init $(1)/etc/init.d/otbr-agent
@@ -167,20 +146,4 @@ define Package/openthread-br/conffiles
 /etc/openthread/
 endef
 
-Package/openthread-br-avahi/install=$(Package/openthread-br/install)
-Package/openthread-br-avahi/conffiles=$(Package/openthread-br/conffiles)
-
-define Package/openthread-br-luci/install
-	$(INSTALL_DIR) $(1)/usr/lib/lua/luci/controller/admin
-	$(INSTALL_BIN) $(PKG_BUILD_DIR)/src/openwrt/controller/thread.lua $(1)/usr/lib/lua/luci/controller/admin
-
-	$(INSTALL_DIR) $(1)/usr/lib/lua/luci/view
-	$(CP) $(PKG_BUILD_DIR)/src/openwrt/view/admin_thread $(1)/usr/lib/lua/luci/view
-
-	$(INSTALL_DIR) $(1)/www/luci-static/resources
-	$(CP) $(PKG_BUILD_DIR)/src/openwrt/handle_error.js $(1)/www/luci-static/resources
-endef
-
 $(eval $(call BuildPackage,openthread-br))
-$(eval $(call BuildPackage,openthread-br-avahi))
-$(eval $(call BuildPackage,openthread-br-luci))
diff --git a/third_party/openthread-br/patches/020-external-mbedtls.patch b/third_party/openthread-br/patches/020-external-mbedtls.patch
index 536852e..cee782a 100644
--- a/third_party/openthread-br/patches/020-external-mbedtls.patch
+++ b/third_party/openthread-br/patches/020-external-mbedtls.patch
@@ -1,4 +1,4 @@
-From 875543a791f91c2ada64977ce5fc75502c8daf1e Mon Sep 17 00:00:00 2001
+From 4c068e0ba07007d62bd8aad515d1f47370b7193b Mon Sep 17 00:00:00 2001
 From: Karsten Sperling <ksperling@apple.com>
 Date: Fri, 10 Oct 2025 22:29:18 +1300
 Subject: [PATCH] Add OTBR_EXTERNAL_MBEDTLS build setting
@@ -14,11 +14,11 @@ This works the same as (and propagates to OT_EXTERNAL_MBEDTLS).
  6 files changed, 14 insertions(+), 6 deletions(-)
 
 diff --git a/etc/cmake/options.cmake b/etc/cmake/options.cmake
-index 1339b3b2..8183bb19 100644
+index c82916e9..c18e56fb 100644
 --- a/etc/cmake/options.cmake
 +++ b/etc/cmake/options.cmake
-@@ -40,6 +40,13 @@ elseif (OTBR_MDNS STREQUAL "openthread")
-     target_compile_definitions(otbr-config INTERFACE OTBR_ENABLE_MDNS_OPENTHREAD=1)
+@@ -39,6 +39,13 @@ elseif (OTBR_MDNS STREQUAL "avahi")
+     message(FATAL_ERROR "OTBR_MDNS=avahi is no longer supported. Use OTBR_MDNS=openthread or OTBR_MDNS=mDNSResponder.")
  endif()
  
 +set(OTBR_EXTERNAL_MBEDTLS "" CACHE STRING "Specify external mbedtls library")
@@ -56,10 +56,10 @@ index 217341ba..270e28a1 100644
  )
  install(
 diff --git a/tests/gtest/CMakeLists.txt b/tests/gtest/CMakeLists.txt
-index 2974cf52..79e559d3 100644
+index c03af338..ba38ec94 100644
 --- a/tests/gtest/CMakeLists.txt
 +++ b/tests/gtest/CMakeLists.txt
-@@ -47,7 +47,7 @@ add_executable(otbr-gtest-unit
+@@ -48,7 +48,7 @@ add_executable(otbr-gtest-unit
      test_task_runner.cpp
  )
  target_link_libraries(otbr-gtest-unit
@@ -68,7 +68,7 @@ index 2974cf52..79e559d3 100644
      otbr-common
      otbr-host
      otbr-utils
-@@ -132,7 +132,7 @@ target_include_directories(otbr-gtest-host-api
+@@ -182,7 +182,7 @@ target_include_directories(otbr-gtest-host-api
          ${OPENTHREAD_PROJECT_DIRECTORY}/tests/gtest
  )
  target_link_libraries(otbr-gtest-host-api
@@ -78,17 +78,17 @@ index 2974cf52..79e559d3 100644
      otbr-utils
      otbr-posix
 diff --git a/third_party/openthread/CMakeLists.txt b/third_party/openthread/CMakeLists.txt
-index eddf5ce1..3b7dbf1e 100644
+index 156c9c59..3a14c382 100644
 --- a/third_party/openthread/CMakeLists.txt
 +++ b/third_party/openthread/CMakeLists.txt
-@@ -51,6 +51,7 @@ set(OT_DNS_CLIENT_OVER_TCP OFF CACHE STRING "disable DNS query over TCP")
+@@ -50,6 +50,7 @@ set(OT_DNS_CLIENT_OVER_TCP OFF CACHE STRING "disable DNS query over TCP")
  set(OT_DNS_UPSTREAM_QUERY ${OTBR_DNS_UPSTREAM_QUERY} CACHE STRING "enable sending DNS queries to upstream" FORCE)
  set(OT_ECDSA ON CACHE STRING "enable ECDSA" FORCE)
  set(OT_EXTERNAL_HEAP ON CACHE STRING "enable external heap" FORCE)
 +set(OT_EXTERNAL_MBEDTLS ${OTBR_EXTERNAL_MBEDTLS} CACHE STRING "Specify external mbedtls library" FORCE)
- set(OT_FIREWALL ON CACHE STRING "enable firewall feature")
- set(OT_HISTORY_TRACKER ON CACHE STRING "enable history tracker" FORCE)
- set(OT_JOINER ON CACHE STRING "enable joiner" FORCE)
+ if (OTBR_NFTABLES)
+     # otbr-agent owns the OTBR ingress firewall in-process (nftables), including
+     # producing the ingress prefix sets from Thread network data, so the OT posix
 diff --git a/tools/CMakeLists.txt b/tools/CMakeLists.txt
 index 5e8451af..7df5c690 100644
 --- a/tools/CMakeLists.txt
@@ -111,6 +111,3 @@ index 5e8451af..7df5c690 100644
  )
  
  if ($ENV{REFERENCE_DEVICE})
--- 
-2.50.1 (Apple Git-155)
-
diff --git a/third_party/openthread-br/patches/100-ubus-uloop-main-thread.patch b/third_party/openthread-br/patches/100-ubus-uloop-main-thread.patch
index 0070ba9..712b68c 100644
--- a/third_party/openthread-br/patches/100-ubus-uloop-main-thread.patch
+++ b/third_party/openthread-br/patches/100-ubus-uloop-main-thread.patch
@@ -1,4 +1,4 @@
-From 1f56fbac66f0d545a43c5f6f46c5eba78e57ddc5 Mon Sep 17 00:00:00 2001
+From 9239cabf0d8e9f38eca0c54c6158ab5a26a732eb Mon Sep 17 00:00:00 2001
 From: Karsten Sperling <ksperling@apple.com>
 Date: Thu, 2 Oct 2025 08:10:30 +1300
 Subject: [PATCH] Ubus: Move ubus / uloop integration onto the main thread
@@ -9,17 +9,17 @@ overall and aligns with how the DBus integration is implemented.
 
 Also remove unused blobmsg_json dependency.
 ---
- src/agent/application.cpp       |  11 +-
+ src/agent/application.cpp       |   5 +
  src/openwrt/ubus/CMakeLists.txt |   2 -
  src/openwrt/ubus/otubus.cpp     | 226 ++++++++++++++------------------
  src/openwrt/ubus/otubus.hpp     |  72 +++++-----
- 4 files changed, 145 insertions(+), 166 deletions(-)
+ 4 files changed, 145 insertions(+), 160 deletions(-)
 
 diff --git a/src/agent/application.cpp b/src/agent/application.cpp
-index fe2aa55b..751622c0 100644
+index 9f510b37..5ed69bec 100644
 --- a/src/agent/application.cpp
 +++ b/src/agent/application.cpp
-@@ -100,6 +100,11 @@ void Application::Init(const std::string &aRestListenAddress, int aRestListenPor
+@@ -117,6 +117,11 @@ void Application::Init(const std::string &aRestListenAddress, int aRestListenPor
  {
      CoprocessorType type;
  
@@ -31,19 +31,6 @@ index fe2aa55b..751622c0 100644
      mHost.Init();
  
      type = mHost.GetCoprocessorType();
-@@ -173,12 +178,6 @@ otbrError Application::Run(void)
-     }
- #endif
- 
--    // allow quitting elegantly
--    signal(SIGTERM, HandleSignal);
--
--    // avoid exiting on SIGPIPE
--    signal(SIGPIPE, SIG_IGN);
--
-     while (!sShouldTerminate)
-     {
-         otbr::MainloopContext mainloop;
 diff --git a/src/openwrt/ubus/CMakeLists.txt b/src/openwrt/ubus/CMakeLists.txt
 index 9d0a086e..8e868f2b 100644
 --- a/src/openwrt/ubus/CMakeLists.txt
@@ -56,7 +43,7 @@ index 9d0a086e..8e868f2b 100644
 -    json-c
  )
 diff --git a/src/openwrt/ubus/otubus.cpp b/src/openwrt/ubus/otubus.cpp
-index 45b9ed4e..5d2724a8 100644
+index 8c633d14..5c2a698a 100644
 --- a/src/openwrt/ubus/otubus.cpp
 +++ b/src/openwrt/ubus/otubus.cpp
 @@ -34,23 +34,18 @@
@@ -346,7 +333,7 @@ index 45b9ed4e..5d2724a8 100644
      if (!strcmp(aAction, "networkname"))
      {
          struct blob_attr *tb[SET_NETWORK_MAX];
-@@ -1613,7 +1563,6 @@ int UbusServer::UbusSetInformation(struct ubus_context      *aContext,
+@@ -1614,7 +1564,6 @@ int UbusServer::UbusSetInformation(struct ubus_context      *aContext,
      }
  
  exit:
@@ -354,7 +341,7 @@ index 45b9ed4e..5d2724a8 100644
      AppendResult(error, aContext, aRequest);
      return 0;
  }
-@@ -1692,9 +1641,6 @@ void UbusServer::UbusConnectionLost(struct ubus_context *aContext)
+@@ -1693,9 +1642,6 @@ void UbusServer::UbusConnectionLost(struct ubus_context *aContext)
  
  int UbusServer::DisplayUbusInit(const char *aPath)
  {
@@ -364,7 +351,7 @@ index 45b9ed4e..5d2724a8 100644
      mSockPath = aPath;
  
      mContext = ubus_connect(aPath);
-@@ -1738,13 +1684,6 @@ void UbusServer::InstallUbusObject(void)
+@@ -1739,13 +1685,6 @@ void UbusServer::InstallUbusObject(void)
          otbrLogErr("Ubus connect failed");
          return;
      }
@@ -378,7 +365,7 @@ index 45b9ed4e..5d2724a8 100644
  }
  
  otError UbusServer::ParseLong(char *aString, long &aLong)
-@@ -1805,52 +1744,85 @@ exit:
+@@ -1806,52 +1745,85 @@ exit:
      return rval;
  }
  
@@ -630,6 +617,3 @@ index f87e9c1c..77e4237c 100644
  };
  } // namespace ubus
  } // namespace otbr
--- 
-2.50.1 (Apple Git-155)
-
diff --git a/third_party/openthread-br/patches/101-ubus-connection-handling.patch b/third_party/openthread-br/patches/101-ubus-connection-handling.patch
index ef50e30..a38ce14 100644
--- a/third_party/openthread-br/patches/101-ubus-connection-handling.patch
+++ b/third_party/openthread-br/patches/101-ubus-connection-handling.patch
@@ -1,4 +1,4 @@
-From c735382f18325a47a8fcae280893b4527a510982 Mon Sep 17 00:00:00 2001
+From 02a21012607733c442fe57b7fc2636daf5557b9d Mon Sep 17 00:00:00 2001
 From: Karsten Sperling <ksperling@apple.com>
 Date: Thu, 2 Oct 2025 13:09:47 +1300
 Subject: [PATCH] Ubus: Move connection logic into UBusAgent and reduce
@@ -10,7 +10,7 @@ Subject: [PATCH] Ubus: Move connection logic into UBusAgent and reduce
  2 files changed, 84 insertions(+), 144 deletions(-)
 
 diff --git a/src/openwrt/ubus/otubus.cpp b/src/openwrt/ubus/otubus.cpp
-index 5d2724a8..a18af82a 100644
+index 5c2a698a..be85f1e5 100644
 --- a/src/openwrt/ubus/otubus.cpp
 +++ b/src/openwrt/ubus/otubus.cpp
 @@ -53,9 +53,8 @@ const static int PANID_LENGTH      = 10;
@@ -57,7 +57,7 @@ index 5d2724a8..a18af82a 100644
      blob_buf_init(&mScanBuf, 0);
      mScanArray = blobmsg_open_array(&mScanBuf, "scan_list");
  
-@@ -1596,93 +1595,11 @@ void UbusServer::GetState(otInstance *aInstance, char *aState)
+@@ -1597,93 +1596,11 @@ void UbusServer::GetState(otInstance *aInstance, char *aState)
      }
  }
  
@@ -153,7 +153,7 @@ index 5d2724a8..a18af82a 100644
      }
  }
  
-@@ -1818,12 +1735,58 @@ void UloopProcessor::Process(const MainloopContext &aMainloop)
+@@ -1819,12 +1736,58 @@ void UloopProcessor::Process(const MainloopContext &aMainloop)
  
  // === UBusAgent ===
  
@@ -364,6 +364,3 @@ index 77e4237c..6396dfa9 100644
      otbr::Host::RcpHost &mHost;
  };
  } // namespace ubus
--- 
-2.50.1 (Apple Git-155)
-
diff --git a/third_party/openthread-br/patches/102-ubus-dispatching.patch b/third_party/openthread-br/patches/102-ubus-dispatching.patch
index b515f8f..9445806 100644
--- a/third_party/openthread-br/patches/102-ubus-dispatching.patch
+++ b/third_party/openthread-br/patches/102-ubus-dispatching.patch
@@ -1,4 +1,4 @@
-From 4c2e015785327a860487fe2bd08de1283547b8f1 Mon Sep 17 00:00:00 2001
+From 7de01fde24b99bd0bcb5a91ea80ce771c47bada9 Mon Sep 17 00:00:00 2001
 From: Karsten Sperling <ksperling@apple.com>
 Date: Fri, 3 Oct 2025 17:08:49 +1300
 Subject: [PATCH] Ubus: Handle dispatching via a template to avoid boilerplate
@@ -7,14 +7,14 @@ Subject: [PATCH] Ubus: Handle dispatching via a template to avoid boilerplate
 Also get rid of the remaining statics / globals in UbusServer.
 Fix uninitialized otLinkModeConfig in "setmode" handler.
 ---
- src/openwrt/ubus/otubus.cpp     | 1577 ++++++++++++-------------------
+ src/openwrt/ubus/otubus.cpp     | 1578 ++++++++++++-------------------
  src/openwrt/ubus/otubus.hpp     |  982 ++-----------------
  src/openwrt/ubus/ubus_utils.hpp |  117 +++
- 3 files changed, 799 insertions(+), 1877 deletions(-)
+ 3 files changed, 799 insertions(+), 1878 deletions(-)
  create mode 100644 src/openwrt/ubus/ubus_utils.hpp
 
 diff --git a/src/openwrt/ubus/otubus.cpp b/src/openwrt/ubus/otubus.cpp
-index a18af82a..78860e40 100644
+index be85f1e5..2123cdf9 100644
 --- a/src/openwrt/ubus/otubus.cpp
 +++ b/src/openwrt/ubus/otubus.cpp
 @@ -34,6 +34,8 @@
@@ -1148,8 +1148,7 @@ index a18af82a..78860e40 100644
 +    AppendResult(OT_ERROR_NONE, &mContext, aRequest);
 +    return 0;
 +}
- 
--        SuccessOrExit(error = otThreadGetLeaderData(mHost->GetInstance(), &leaderData));
++
 +int UbusServer::HandlePartitionId(ubus_request_data *aRequest)
 +{
 +    blobmsg_add_u32(&mBuf, "Partitionid", otThreadGetPartitionId(mHost->GetInstance()));
@@ -1157,25 +1156,26 @@ index a18af82a..78860e40 100644
 +    return 0;
 +}
  
--        sJsonUri = blobmsg_open_table(&mBuf, "leaderdata");
+-        SuccessOrExit(error = otThreadGetLeaderData(mHost->GetInstance(), &leaderData));
 +int UbusServer::HandleLeaderData(ubus_request_data *aRequest)
 +{
 +    otError      error = OT_ERROR_NONE;
 +    void        *jsonTable;
 +    otLeaderData leaderData;
  
+-        sJsonUri = blobmsg_open_table(&mBuf, "leaderdata");
++    SuccessOrExit(error = otThreadGetLeaderData(mHost->GetInstance(), &leaderData));
+ 
 -        blobmsg_add_u32(&mBuf, "PartitionId", leaderData.mPartitionId);
 -        blobmsg_add_u32(&mBuf, "Weighting", leaderData.mWeighting);
 -        blobmsg_add_u32(&mBuf, "DataVersion", leaderData.mDataVersion);
 -        blobmsg_add_u32(&mBuf, "StableDataVersion", leaderData.mStableDataVersion);
 -        blobmsg_add_u32(&mBuf, "LeaderRouterId", leaderData.mLeaderRouterId);
-+    SuccessOrExit(error = otThreadGetLeaderData(mHost->GetInstance(), &leaderData));
++    jsonTable = blobmsg_open_table(&mBuf, "leaderdata");
  
 -        blobmsg_close_table(&mBuf, sJsonUri);
 -    }
 -    else if (!strcmp(aAction, "networkdata"))
-+    jsonTable = blobmsg_open_table(&mBuf, "leaderdata");
-+
 +    blobmsg_add_u32(&mBuf, "PartitionId", leaderData.mPartitionId);
 +    blobmsg_add_u32(&mBuf, "Weighting", leaderData.mWeighting);
 +    blobmsg_add_u32(&mBuf, "DataVersion", leaderData.mDataVersion);
@@ -1428,7 +1428,7 @@ index a18af82a..78860e40 100644
  
  exit:
      if (aError != OT_ERROR_NONE)
-@@ -1374,198 +915,285 @@ exit:
+@@ -1374,199 +915,285 @@ exit:
      }
  }
  
@@ -1592,7 +1592,7 @@ index a18af82a..78860e40 100644
 -        struct blob_attr *tb[SET_NETWORK_MAX];
 +        otExtendedPanId extPanId;
 +        char           *input = blobmsg_get_string(aArgs[0]);
-+        VerifyOrExit(Hex2Bin(input, extPanId.m8, sizeof(extPanId)) >= 0, error = OT_ERROR_PARSE);
++        VerifyOrExit(Hex2Bin(input, extPanId.m8, sizeof(extPanId.m8)) == OT_EXT_PAN_ID_SIZE, error = OT_ERROR_PARSE);
 +        error = otThreadSetExtendedPanId(mHost->GetInstance(), &extPanId);
 +    }
 +exit:
@@ -1626,14 +1626,15 @@ index a18af82a..78860e40 100644
 -        {
 -            otExtendedPanId extPanId;
 -            char           *input = blobmsg_get_string(tb[SETNETWORK]);
--            VerifyOrExit(Hex2Bin(input, extPanId.m8, sizeof(extPanId)) >= 0, error = OT_ERROR_PARSE);
+-            VerifyOrExit(Hex2Bin(input, extPanId.m8, sizeof(extPanId.m8)) == OT_EXT_PAN_ID_SIZE,
+-                         error = OT_ERROR_PARSE);
 -            error = otThreadSetExtendedPanId(mHost->GetInstance(), &extPanId);
 -        }
 -    }
 -    else if (!strcmp(aAction, "mode"))
 +    if (aArgs[0] != nullptr)
      {
--        otLinkModeConfig  linkMode;
+-        otLinkModeConfig  linkMode = {};
 -        struct blob_attr *tb[SET_NETWORK_MAX];
 -
 -        blobmsg_parse(setModePolicy, SET_NETWORK_MAX, tb, blob_data(aMsg), blob_len(aMsg));
@@ -1861,7 +1862,7 @@ index a18af82a..78860e40 100644
  void UbusServer::GetState(otInstance *aInstance, char *aState)
  {
      switch (otThreadGetDeviceRole(aInstance))
-@@ -1595,14 +1223,6 @@ void UbusServer::GetState(otInstance *aInstance, char *aState)
+@@ -1596,14 +1223,6 @@ void UbusServer::GetState(otInstance *aInstance, char *aState)
      }
  }
  
@@ -1876,7 +1877,7 @@ index a18af82a..78860e40 100644
  otError UbusServer::ParseLong(char *aString, long &aLong)
  {
      char *endptr;
-@@ -1738,7 +1358,7 @@ void UloopProcessor::Process(const MainloopContext &aMainloop)
+@@ -1739,7 +1358,7 @@ void UloopProcessor::Process(const MainloopContext &aMainloop)
  UBusAgent::UBusAgent(otbr::Host::RcpHost &aHost)
      : ubus_context{}
      , uloop_timeout{}
@@ -1885,7 +1886,7 @@ index a18af82a..78860e40 100644
  {
  }
  
-@@ -1756,8 +1376,7 @@ void UBusAgent::Init()
+@@ -1757,8 +1376,7 @@ void UBusAgent::Init()
      VerifyOrDie(ubus_connect_ctx(&Context(), nullptr) == 0, "Unable to connect to ubus");
      UbusConnected();
  
@@ -3051,6 +3052,3 @@ index 00000000..74a8da29
 +} // namespace otbr
 +
 +#endif // OTBR_AGENT_UBUS_UTILS_HPP_
--- 
-2.50.1 (Apple Git-155)
-
diff --git a/third_party/openthread-br/patches/103-ubus-blobmsg-printf.patch b/third_party/openthread-br/patches/103-ubus-blobmsg-printf.patch
index a799bc5..e4bb2fb 100644
--- a/third_party/openthread-br/patches/103-ubus-blobmsg-printf.patch
+++ b/third_party/openthread-br/patches/103-ubus-blobmsg-printf.patch
@@ -1,4 +1,4 @@
-From a8aef8564a073dd537148d7044297ac564abc3ba Mon Sep 17 00:00:00 2001
+From b17c9cdf25eb64bc3a12625e1a354ee4253fc9aa Mon Sep 17 00:00:00 2001
 From: Karsten Sperling <ksperling@apple.com>
 Date: Fri, 3 Oct 2025 17:29:54 +1300
 Subject: [PATCH] Ubus: Use blobmsg_printf instead of sprintf with explicit
@@ -9,7 +9,7 @@ Subject: [PATCH] Ubus: Use blobmsg_printf instead of sprintf with explicit
  1 file changed, 12 insertions(+), 37 deletions(-)
 
 diff --git a/src/openwrt/ubus/otubus.cpp b/src/openwrt/ubus/otubus.cpp
-index 78860e40..05b7cf99 100644
+index 2123cdf9..4a641e93 100644
 --- a/src/openwrt/ubus/otubus.cpp
 +++ b/src/openwrt/ubus/otubus.cpp
 @@ -50,7 +50,6 @@ namespace ubus {
@@ -151,6 +151,3 @@ index 78860e40..05b7cf99 100644
  
                  mode = (entry.mMode.mRxOnWhenIdle ? kModeRxOnWhenIdle : 0) |
                         (entry.mMode.mDeviceType ? kModeFullThreadDevice : 0) |
--- 
-2.50.1 (Apple Git-155)
-
diff --git a/third_party/openthread-br/patches/104-ubus-blobmsg-add-hex-string.patch b/third_party/openthread-br/patches/104-ubus-blobmsg-add-hex-string.patch
index c473be6..24f0768 100644
--- a/third_party/openthread-br/patches/104-ubus-blobmsg-add-hex-string.patch
+++ b/third_party/openthread-br/patches/104-ubus-blobmsg-add-hex-string.patch
@@ -1,4 +1,4 @@
-From 05b59334a5966b455115c88d21a7b8d4df3589fd Mon Sep 17 00:00:00 2001
+From d37de933c539c75e7cb77a20a15991bfbf442f9c Mon Sep 17 00:00:00 2001
 From: Karsten Sperling <ksperling@apple.com>
 Date: Fri, 3 Oct 2025 17:49:01 +1300
 Subject: [PATCH] Ubus: Add blobmsg_add_hex_string for emitting hex values
@@ -27,7 +27,7 @@ index 8e868f2b..714a759f 100644
  target_link_libraries(otbr-ubus PRIVATE
      otbr-config
 diff --git a/src/openwrt/ubus/otubus.cpp b/src/openwrt/ubus/otubus.cpp
-index 05b7cf99..114d36bf 100644
+index 4a641e93..ae1d7d60 100644
 --- a/src/openwrt/ubus/otubus.cpp
 +++ b/src/openwrt/ubus/otubus.cpp
 @@ -50,9 +50,6 @@ namespace ubus {
@@ -312,6 +312,3 @@ index 74a8da29..dfd3c990 100644
  } // namespace ubus
  } // namespace otbr
  
--- 
-2.50.1 (Apple Git-155)
-
diff --git a/third_party/openthread-br/patches/105-ubus-blobmsg-get-hex-string.patch b/third_party/openthread-br/patches/105-ubus-blobmsg-get-hex-string.patch
index 2e64f2a..2b18eda 100644
--- a/third_party/openthread-br/patches/105-ubus-blobmsg-get-hex-string.patch
+++ b/third_party/openthread-br/patches/105-ubus-blobmsg-get-hex-string.patch
@@ -1,4 +1,4 @@
-From c2c69b2d4111e3995abd562c267d18b6d2c71a5c Mon Sep 17 00:00:00 2001
+From 30df5c383347b409b85d52ae1dfb0101f594c2a3 Mon Sep 17 00:00:00 2001
 From: Karsten Sperling <ksperling@apple.com>
 Date: Thu, 30 Apr 2026 13:56:58 +1200
 Subject: [PATCH] Ubus: Add blobmsg_get_hex_string for parsing hex values
@@ -15,7 +15,7 @@ Also don't accept ExtendedPanID's < 16 hex characters in "mgmtset" and
  4 files changed, 72 insertions(+), 87 deletions(-)
 
 diff --git a/src/openwrt/ubus/otubus.cpp b/src/openwrt/ubus/otubus.cpp
-index 114d36bf..028e6901 100644
+index ae1d7d60..028e6901 100644
 --- a/src/openwrt/ubus/otubus.cpp
 +++ b/src/openwrt/ubus/otubus.cpp
 @@ -294,9 +294,9 @@ int UbusServer::HandleMgmtSet(ubus_request_data *aRequest, blob_attr *(&tb)[6])
@@ -36,7 +36,7 @@ index 114d36bf..028e6901 100644
      {
          dataset.mComponents.mIsExtendedPanIdPresent = true;
 -        VerifyOrExit(Hex2Bin(blobmsg_get_string(tb[EXTPANID]), dataset.mExtendedPanId.m8,
--                             sizeof(dataset.mExtendedPanId.m8)) >= 0,
+-                             sizeof(dataset.mExtendedPanId.m8)) == OT_EXT_PAN_ID_SIZE,
 +        VerifyOrExit(blobmsg_get_hex_string_fixed(tb[EXTPANID], dataset.mExtendedPanId.m8,
 +                                                  sizeof(dataset.mExtendedPanId.m8)) > 0,
                       error = OT_ERROR_PARSE);
@@ -101,7 +101,7 @@ index 114d36bf..028e6901 100644
      {
          otExtendedPanId extPanId;
 -        char           *input = blobmsg_get_string(aArgs[0]);
--        VerifyOrExit(Hex2Bin(input, extPanId.m8, sizeof(extPanId)) >= 0, error = OT_ERROR_PARSE);
+-        VerifyOrExit(Hex2Bin(input, extPanId.m8, sizeof(extPanId.m8)) == OT_EXT_PAN_ID_SIZE, error = OT_ERROR_PARSE);
 +        VerifyOrExit(blobmsg_get_hex_string_fixed(aArgs[0], extPanId.m8, sizeof(extPanId.m8)) > 0,
 +                     error = OT_ERROR_PARSE);
          error = otThreadSetExtendedPanId(mHost->GetInstance(), &extPanId);
@@ -294,6 +294,3 @@ index dfd3c990..68b18d39 100644
  } // namespace ubus
  } // namespace otbr
  
--- 
-2.50.1 (Apple Git-155)
-
diff --git a/third_party/openthread-br/patches/106-ubus-miscellaneous-tweaks.patch b/third_party/openthread-br/patches/106-ubus-miscellaneous-tweaks.patch
index 5d3d356..25f2dc2 100644
--- a/third_party/openthread-br/patches/106-ubus-miscellaneous-tweaks.patch
+++ b/third_party/openthread-br/patches/106-ubus-miscellaneous-tweaks.patch
@@ -1,4 +1,4 @@
-From 55c3912f2fbf4a6b0d583bd67c3350f1ec6ed0b3 Mon Sep 17 00:00:00 2001
+From 33504a67ab6fb8b10fffbb43e65d64059cdb1052 Mon Sep 17 00:00:00 2001
 From: Karsten Sperling <ksperling@apple.com>
 Date: Fri, 3 Oct 2025 22:13:18 +1300
 Subject: [PATCH] Ubus: Miscellaneous tweaks
@@ -775,6 +775,3 @@ index bda458b3..676a10b9 100644
  
      blob_buf mBuf{}; // default buffer for sync responses
  
--- 
-2.50.1 (Apple Git-155)
-
diff --git a/third_party/openthread-br/patches/110-ubus-matter-integration.patch b/third_party/openthread-br/patches/110-ubus-matter-integration.patch
index 47c6c6a..1ff1ba8 100644
--- a/third_party/openthread-br/patches/110-ubus-matter-integration.patch
+++ b/third_party/openthread-br/patches/110-ubus-matter-integration.patch
@@ -1,4 +1,4 @@
-From 270d44915e4d64c51e02ce5f8297d4282e827dc7 Mon Sep 17 00:00:00 2001
+From 4e6bdc8e61569f9f204b56f9a4acd92b3ddebda0 Mon Sep 17 00:00:00 2001
 From: Karsten Sperling <ksperling@apple.com>
 Date: Sat, 4 Oct 2025 01:44:01 +1300
 Subject: [PATCH] Ubus: Add methods and notifications for Matter integration
@@ -187,6 +187,3 @@ index 676a10b9..02c49116 100644
      // === Internal helpers ===
  
      static UbusServer &PrepareInvocation(ubus_object *aObj, ubus_request_data *aRequest, const char *aMethod);
--- 
-2.50.1 (Apple Git-155)
-