diff --git a/.vitepress/theme/components/CrcVerifier.vue b/.vitepress/theme/components/CrcVerifier.vue
new file mode 100644
index 00000000..74eab023
--- /dev/null
+++ b/.vitepress/theme/components/CrcVerifier.vue
@@ -0,0 +1,138 @@
+<script setup lang="ts">
+import { ref } from 'vue'
+
+const fileName = ref('')
+const result = ref<{ expected: string; calculated: string; match: boolean } | null>(null)
+const error = ref('')
+const dragging = ref(false)
+
+function crc32Bzip2(data: Uint8Array): number {
+  const poly = 0x04C11DB7
+  let crc = 0xFFFFFFFF >>> 0
+  for (const byte of data) {
+    crc ^= (byte << 24) >>> 0
+    for (let i = 0; i < 8; i++) {
+      crc = crc & 0x80000000 ? ((crc << 1) ^ poly) >>> 0 : (crc << 1) >>> 0
+    }
+  }
+  return (crc ^ 0xFFFFFFFF) >>> 0
+}
+
+function hex32(n: number): string {
+  return '0x' + n.toString(16).padStart(8, '0')
+}
+
+function processFile(file: File) {
+  error.value = ''
+  result.value = null
+  fileName.value = file.name
+
+  const reader = new FileReader()
+  reader.onload = () => {
+    const buf = new Uint8Array(reader.result as ArrayBuffer)
+    if (buf.length < 256) {
+      error.value = `File too small: ${buf.length} bytes (need at least 256)`
+      return
+    }
+    const expected = new DataView(buf.buffer).getUint32(252, true)
+    const calculated = crc32Bzip2(buf.slice(0, 236))
+    result.value = {
+      expected: hex32(expected),
+      calculated: hex32(calculated),
+      match: expected === calculated
+    }
+  }
+  reader.onerror = () => { error.value = 'Failed to read file' }
+  reader.readAsArrayBuffer(file)
+}
+
+function onFileChange(event: Event) {
+  const input = event.target as HTMLInputElement
+  if (input.files?.[0]) processFile(input.files[0])
+}
+
+function onDrop(event: DragEvent) {
+  dragging.value = false
+  if (event.dataTransfer?.files?.[0]) processFile(event.dataTransfer.files[0])
+}
+</script>
+
+<template>
+  <div
+    class="hg-form"
+    @dragover.prevent="dragging = true"
+    @dragleave="dragging = false"
+    @drop.prevent="onDrop"
+  >
+    <label
+      class="dropzone"
+      :class="{ active: dragging }"
+    >
+      <span>Drop your mfginfo partition dump here, or click to select</span>
+      <input type="file" accept=".bin,.img,.dump,*" style="display:none" @change="onFileChange" />
+      <small v-if="fileName">{{ fileName }}</small>
+    </label>
+
+    <div v-if="error" class="crc-result error">{{ error }}</div>
+
+    <div v-if="result" class="crc-result" :class="result.match ? 'success' : 'error'">
+      <table>
+        <tr><td>Expected CRC</td><td><code>{{ result.expected }}</code></td></tr>
+        <tr><td>Calculated CRC</td><td><code>{{ result.calculated }}</code></td></tr>
+        <tr><td>Result</td><td><strong>{{ result.match ? 'MATCH' : 'MISMATCH' }}</strong></td></tr>
+      </table>
+    </div>
+  </div>
+</template>
+
+<style scoped>
+.dropzone {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  gap: 8px;
+  padding: 24px;
+  border: 2px dashed var(--vp-c-divider);
+  border-radius: 8px;
+  cursor: pointer;
+  transition: border-color 0.25s, background-color 0.25s;
+  text-align: center;
+}
+
+.dropzone:hover,
+.dropzone.active {
+  border-color: var(--vp-c-brand-1);
+  background-color: var(--vp-c-bg-soft);
+}
+
+.crc-result {
+  padding: 12px 16px;
+  border-radius: 8px;
+  border: 1px solid;
+}
+
+.crc-result.success {
+  border-color: var(--vp-c-green-2);
+  background-color: var(--vp-c-green-soft);
+}
+
+.crc-result.error {
+  border-color: var(--vp-c-red-2);
+  background-color: var(--vp-c-red-soft);
+}
+
+.crc-result table {
+  width: 100%;
+  border-collapse: collapse;
+}
+
+.crc-result td {
+  padding: 4px 8px;
+}
+
+.crc-result td:first-child {
+  font-weight: 500;
+  white-space: nowrap;
+}
+</style>
diff --git a/.vitepress/theme/index.ts b/.vitepress/theme/index.ts
index 36cada2e..6b8ee811 100644
--- a/.vitepress/theme/index.ts
+++ b/.vitepress/theme/index.ts
@@ -3,6 +3,7 @@ import DefaultTheme from 'vitepress/theme'
 import Layout from './Layout.vue'
 import AsciiHex from './components/AsciiHex.vue'
 import CigPassword from './components/CigPassword.vue'
+import CrcVerifier from './components/CrcVerifier.vue'
 import CiteAs from './components/CiteAs.vue'
 import HisensePloam from './components/HisensePloam.vue'
 import ImageFigure from './components/ImageFigure.vue'
@@ -20,6 +21,7 @@ export default {
   enhanceApp({ app, router }) {
     app.component('AsciiHex', AsciiHex)
     app.component('CigPassword', CigPassword)
+    app.component('CrcVerifier', CrcVerifier)
     app.component('CiteAs', CiteAs)
     app.component('HisensePloam', HisensePloam)
     app.component('ImageFigure', ImageFigure)
diff --git a/gpon/ont.md b/gpon/ont.md
index a05f7a00..9810fce3 100644
--- a/gpon/ont.md
+++ b/gpon/ont.md
@@ -69,6 +69,8 @@ Currently, there are only a few main PON chipset vendors:
 - Airoha (continuation of EcoNet)
     * AN7581
     * AN7583/AN7553
+- Faraday Technology (Galachip)
+    * GC1601
 ## Realtek Chipsets
 
 HSGMII chipsets are relatively recent, they became more common starting in 2020, and are used in many ONTs. Realtek offers an official SDK, Luna SDK, which offers very good performance in queue management, unfortunately it is not used by all devices based on these chipsets.
diff --git a/ont-xgs/ont-ECIN-EN-XGSFPP-OMAC-v2.md b/ont-xgs/ont-ECIN-EN-XGSFPP-OMAC-v2.md
new file mode 100644
index 00000000..06eff132
--- /dev/null
+++ b/ont-xgs/ont-ECIN-EN-XGSFPP-OMAC-v2.md
@@ -0,0 +1,58 @@
+---
+title: E.C.I. Networks EN-XGSPP-OMAC V2
+has_children: false
+parent: E.C.I. Networks
+---
+
+# Hardware Specifications
+
+|                  |                                          |
+| ---------------- | ---------------------------------------- |
+| Vendor/Brand     | E.C.I. Networks                          |
+| Model            | EN-XGSPP-OMAC-V2                        |
+| Chipset          | MaxLinear PRX126                         |
+| Flash            |                                          |
+| RAM              |                                          |
+| System           | Linux (PRX126 SDK)                       |
+| SFP interfaces   | 10GBASE-R                                |
+| Optics           | SC/APC                                   |
+| IP address       |                                          |
+| Web Gui          | ✅                                       |
+| SSH              |                                          |
+| Telnet           |                                          |
+| Serial           |                                          |
+| Serial baud      | 115200                                   |
+| Serial encoding  | 8-N-1                                    |
+| Form Factor      | miniONT SFP+                             |
+
+::: warning Note
+This is the V2 version of the E.C.I. Networks stick, based on the MaxLinear PRX126 chipset. It is **not** the same hardware as the [V1](/xgs/ont-ECIN-EN-XGSFPP-OMAC-v1), which is a Cortina CA8271A-based stick identical to the [FS.com XGS-ONU-25-20NI](/xgs/ont-fs-XGS-ONU-25-20NI). The firmware, commands, and configuration procedures are completely different between V1 and V2.
+:::
+
+The V2 has a web-based GUI for configuration, including PON status, LAN settings, and ONU authentication. It also supports a CLI interface.
+
+## Web GUI
+
+The web GUI provides pages for:
+- Device information and PON state
+- LAN settings
+- ONU authentication (Serial Number, Registration ID/LOID)
+
+The web interface enforces a Registration ID field, which corresponds to the LOID.
+
+## VEIP support
+
+This stick supports VEIP (HGU) mode, but requires the [8311 community firmware](https://github.com/djGrrr/8311-was-110-firmware-builder) to function universally.
+
+## PLOAM debugging
+
+PLOAM messages can be captured from the Linux shell using the `pond` command:
+
+```sh
+pond -v
+```
+
+# Miscellaneous Links
+
+- [E.C.I. Networks product page](https://ecin.ca/custom-xgs-pon-sfp-stick-module-xgspon-ont-w-t-mac-function-mounted-on-sfp-package/)
+- [MaxLinear 10G PON Chipset Solution](https://maxlinear-assets.azureedge.net/web/documents/10g%20pon%20chipset%20solution%20flyer_006flr01.pdf)
diff --git a/ont-xgs/ont-hisense-ltf7267-bha+.md b/ont-xgs/ont-hisense-ltf7267-bha+.md
index 17ba706e..e770fd3c 100644
--- a/ont-xgs/ont-hisense-ltf7267-bha+.md
+++ b/ont-xgs/ont-hisense-ltf7267-bha+.md
@@ -455,7 +455,12 @@ CHAR            CFG_ID_OMCC_VERSION                             = 0xB2;
 Reboot ONT to apply the change.
 
 
+## Variants
+
+The LTF7267-BH+ is a variant of the LTF7267-BHA+ with the same Cortina CA8271A chipset. The information on this page applies to both models.
+
 # Known Bugs
 - `ALCL` OLT mode uses some static configurations on MIBs, so if your OLT has strict configuration checks it might not work properly.
 - During initial tests the only currently working mode of the stick is `PPTP EthUni`.
 - Stick can be configured to also emulate `VEIP` mode (adding it to the scfg.txt file), but the current firmware doesn't link correctly the XGBE interface, so no traffic is passing between LAN and PON interfaces.
+- On some SFP+ cages that do not support USXGMII, the kernel may log `Warning!!! port 6 isnt USXGMII and can't do AN` during activation. This can cause repeated ONU deactivation/reactivation cycles (`DEACTIVE_ONUID_REQ`). Ensure your host device's SFP+ cage supports 10GBase-R or USXGMII auto-negotiation.
diff --git a/ont-xgs/ont-nokia-xs-010x-q.md b/ont-xgs/ont-nokia-xs-010x-q.md
index 63904de5..f2ad0067 100644
--- a/ont-xgs/ont-nokia-xs-010x-q.md
+++ b/ont-xgs/ont-nokia-xs-010x-q.md
@@ -29,6 +29,13 @@ parent: Nokia
 | Form Factor      | ONT                                                                              |
 
 
+## Accessing the Web GUI
+
+The ONT's web GUI is available at `192.168.100.1` on port 80. To access it, your device must be on the same subnet (`192.168.100.0/24`). If your router uses a different subnet (e.g. `10.0.0.0/20`), you have two options:
+
+- **Direct connection**: connect your PC directly to the ONT's Ethernet port and set a static IP address (e.g. `192.168.100.2`, netmask `255.255.255.0`)
+- **Via router**: add a virtual IP in the `192.168.100.0/24` range to your router's WAN interface and create the appropriate routing/NAT rules
+
 # External/Internal Photo
 
 <ImageFigure file="ont-nokia_xs-010x-q_front.jpg" alt="Nokia XS-010X-Q Front" caption="Nokia XS-010X-Q Front" />
diff --git a/ont-xgs/ont-nokia-xs-010x-r.md b/ont-xgs/ont-nokia-xs-010x-r.md
index 341441b8..d50ffcf4 100644
--- a/ont-xgs/ont-nokia-xs-010x-r.md
+++ b/ont-xgs/ont-nokia-xs-010x-r.md
@@ -83,11 +83,16 @@ This ONT supports dual boot.
 
 `kernel0` and `rootfs0` respectively contain the kernel and firmware of the first image, `kernel1` and `rootfs1` the kernel and firmware of the second one.
 
-`mfginfo0` and `mfginfo1` (in the first 256bytes) contain the MAC-addresses and the serial (at offset 0x68). The last 4 byte seem to be a UNKNOWN checksum.<br>
-The third 256 byte block (offsets 0x7800200 and 0x7900200) contains the user configurable PON-ID. Here the 4byte checksum at the end is CRC-32/BZIP2 in BIG-endian (Polynom: 0x04C11DB7).
+`mfginfo0` and `mfginfo1` (in the first 256 bytes) contain the MAC-addresses and the serial (at offset 0x68). The last 4 bytes are a CRC-32/BZIP2 checksum (Polynom: 0x04C11DB7, Init: 0xFFFFFFFF, XorOut: 0xFFFFFFFF) calculated over the first 236 bytes of the block.<br>
+The third 256 byte block (offsets 0x7800200 and 0x7900200) contains the user configurable PON-ID. Here the 4-byte checksum at the end is also CRC-32/BZIP2 in BIG-endian (Polynom: 0x04C11DB7).
 
-<b> I really would be interested what the checksum is / how the checksum of the first block is calculated. </b><br>
-Even the relevant kernel modules "ca_ne.ko" (authored by Aaron ans Raymond Tseng) claims to be GPL - the cortina team didn't respond to my mails asking for source code / details.
+The CRC algorithm is implemented in the `cig-misc.ko` kernel module (function `nvram_nand_eeprom_valid_check()`), which prints the correct length needed for the CRC calculation (236 bytes).
+
+### Verify mfginfo CRC
+
+Upload your mfginfo partition dump (at least 256 bytes) to verify the CRC-32/BZIP2 checksum:
+
+<CrcVerifier />
 
 <!--@partial: ./_partials/ont-nokia-use.md-->
 
@@ -103,3 +108,8 @@ After loggin in as "admin". the telnetd hands over to "/usr/bin/GponSLID".
 
 With the possiblility to unsolder and clone the NAND (I wrote my own C-Tool using spidev) it might be possible to modify the `rootfs0`.<br>
 <b>This could be a practical way to enable full telnet by replacing "/usr/bin/GponSLID" with "/usr/bin/GponCLI" - or even better "/bin/sh"...</b>
+
+# Miscellaneous Links
+
+- [CA8271x documentation and tools](https://github.com/YuukiJapanTech/CA8271x) - includes mtd dumps, root shell methods, and CIG backdoor packet info
+- [pon.wiki: Nokia XS-010X-R](https://pon.wiki/xgs-pon/ont/nokia/xs-010x-r/)
diff --git a/ont/ont-fs-com-gpon-onu-stick-with-mac.md b/ont/ont-fs-com-gpon-onu-stick-with-mac.md
index f1b172ef..9e6acceb 100644
--- a/ont/ont-fs-com-gpon-onu-stick-with-mac.md
+++ b/ont/ont-fs-com-gpon-onu-stick-with-mac.md
@@ -44,6 +44,10 @@ parent: FS.com
 The GPON-SFP-ONT-MAC-I is sold as multiple SKUs; the 133619 SKU is identical to the GPON-ONU-34-20BI, but other SKUs are not the same hardware. The 133619 SKU is now no longer sold.
 :::
 
+::: danger Warning
+Newer FS.com GPON-SFP-ONT-MAC-I SKUs (e.g. 351553, 351565) use a **Faraday/Galachip GC1601** chipset instead of the Lantiq PEB98035. These are completely different hardware and the firmware, commands, and patches on this page do **not** apply to them. The GalaChip-based sticks use `gccli` commands instead of the Lantiq shell.
+:::
+
 ## Firmware is interchangeable with:
 
 - [Huawei MA5671A](/ont-huawei-ma5671a)
@@ -172,6 +176,30 @@ omci_pipe.sh meg MIB_IDX ME_IN
 ```
 Where `MIB_IDX` is the MIB ID and the `ME_IN` is the ME instance number
 
+## Debug menu (gtop)
+
+The `gtop` command provides an interactive debug menu for monitoring and diagnostics. To access it, run:
+```sh
+gtop
+```
+
+Inside the debug menu, composite key commands can be used by pressing two keys simultaneously (e.g. `c` + `a`).
+
+### Getting VLAN table rule
+```sh
+gtop -g "GPE VLAN rule"
+```
+
+### Getting GEM port status table
+```sh
+gtop -g e
+```
+
+## Getting ONU GPON Serial Number (alternative)
+```sh
+onu gtcsng
+```
+
 ## Getting/Setting Speed LAN Mode
 
 To get the LAN Mode:
diff --git a/ont/ont-huawei-hg8010h.md b/ont/ont-huawei-hg8010h.md
index f5ef5a8d..06773e37 100644
--- a/ont/ont-huawei-hg8010h.md
+++ b/ont/ont-huawei-hg8010h.md
@@ -19,13 +19,21 @@ parent: Huawei
 | 2.5GBaseT    | No                                                                                             |
 | Optics       | SC/APC and SC/UPC                                                                              |
 | IP address   | 192.168.100.1                                                                                  |
-| Web Gui      | ✅ user `root`, password `admin` or `adminHW` and user `telecomadmin`, password `admintelecom` |
+| Web Gui      | ✅ user `root`, password `admin` or `adminHW` and user `telecomadmin`, password `admintelecom` (see [Default credentials](#default-credentials)) |
 | SSH          |                                                                                                |
-| Telnet       | After Enabling user `root`, password `admin` or `adminHW`                                      |
+| Telnet       | After Enabling user `root`, password `admin` or `adminHW` (see [Default credentials](#default-credentials)) |
 | Serial       |                                                                                                |
 | Form Factor  | ONT                                                                                            |
 
 
+## Default credentials
+
+The default credentials are `root`/`admin` or `root`/`adminHW`, and `telecomadmin`/`admintelecom`.
+
+::: warning ISP-specific passwords
+Some ISP deployments (e.g. certain Turkish ISPs) use a custom password instead of the defaults above. In this case, the password is an 8-character seemingly random string (mixed uppercase/lowercase letters and numbers) printed on the back of the ONT, in the same location as shown in the sticker photo below. The `telecomadmin` username also works with this ISP-specific password.
+:::
+
 <ImageFigure file="hg8010h.jpg" alt="HG8010H" caption="HG8010H: Horizontal PON port (left, middle); vertical PON port (right)" />
 <ImageFigure file="hg8010hvorr.jpg" alt="HG8010Hv3/4/5" caption="Bottom of the HG8010Hv3/4/5" />
 <ImageFigure file="hg8010hv6.jpg" alt="HG8010Hv6" caption="Bottom of the HG8010Hv6" />
diff --git a/ont/ont-huawei-ma5671a.md b/ont/ont-huawei-ma5671a.md
index e25eb827..c9bce610 100644
--- a/ont/ont-huawei-ma5671a.md
+++ b/ont/ont-huawei-ma5671a.md
@@ -406,6 +406,7 @@ For more information, see the SFF-8472 Rev 10.2 specification.
 
 # Miscellaneous Links
 
+- [Asenheim firmware repository](https://cloud.asenheim.org/s/tqGTgBDSZgoKFyg) - alternative firmware collection for ODI/HSGQ, Alcatel/Nokia and Huawei modules
 - [Huawei MA5671B / OptiXstar S600E (successor)](/ont-huawei-optixstar-s600e)
 - [Support MA5671A SFP GPON - OpenWRT forum](https://forum.openwrt.org/t/support-ma5671a-sfp-gpon/48042)
 - [u boot lantiq falcon - GitHub](https://github.com/minhng99/u-boot_lantiq_falcon)
diff --git a/ont/ont-nokia-g-010g-r.md b/ont/ont-nokia-g-010g-r.md
index aab77476..b8ac2f84 100644
--- a/ont/ont-nokia-g-010g-r.md
+++ b/ont/ont-nokia-g-010g-r.md
@@ -23,10 +23,18 @@ parent: Nokia
 | SSH              | ✅ but no login possible                                                     |
 | Telnet           | ✅ user `admin`, password `1234`, but has access to GponSLID and not GponCLI |
 | Serial           | ✅                                                                           |
-| Serial baud      | 115200                                                                      |
+| Serial baud      | 115200 (some models use 9600 for the `ONT>` console)                        |
 | Serial encoding  | 8-N-1                                                                       |
 | Form Factor      | ONT                                                                         |
 
+## Hardware variants
+
+Some G-010G-R models use a G-97CL PCB with a SEMTECH 25L95 laser driver. On these models, the `ONT>` console may only be accessible at 9600 baud rate instead of the standard 115200.
+
+::: warning Note
+The enable password generator may not work on all variants. If the `ONT>` console is accessible but commands are limited, a flash dump and analysis may be needed to change the serial number.
+:::
+
 ## List of software versions
 - 3FE49717AOCK12 
 - 3FE49717AOCK38
diff --git a/ont/ont-nokia-g-010s-p.md b/ont/ont-nokia-g-010s-p.md
index 4a1c3545..41a3e453 100644
--- a/ont/ont-nokia-g-010s-p.md
+++ b/ont/ont-nokia-g-010s-p.md
@@ -302,6 +302,7 @@ FALCON => saveenv
 
 # Miscellaneous Links
 
+- [Asenheim firmware repository](https://cloud.asenheim.org/s/tqGTgBDSZgoKFyg) - alternative firmware collection for ODI/HSGQ, Alcatel/Nokia and Huawei modules
 - [alcatel_lucent-lantiq_falcon](https://github.com/minhng99/alcatel_lucent-lantiq_falcon)
 - [uboot lantiq falcon](https://github.com/minhng99/u-boot_lantiq_falcon)
 - [Usage GPON module SFP in Spain](https://forum.mikrotik.com/viewtopic.php?t=116364&start=300)
diff --git a/ont/ont-odi-realtek-dfp-34g-2c2.md b/ont/ont-odi-realtek-dfp-34g-2c2.md
index 47766cfa..1a8e6b83 100644
--- a/ont/ont-odi-realtek-dfp-34g-2c2.md
+++ b/ont/ont-odi-realtek-dfp-34g-2c2.md
@@ -2,7 +2,7 @@
 title: ODI Realtek DFP-34G-2C2 
 description: New model 2022 - v05
 has_children: false
-parent: ODI
+parent: HSGQ (formerly ODI)
 ---
 
 # Hardware Specifications
@@ -88,6 +88,7 @@ omciOLT21: "true"
 # Miscellaneous Links
 
 - [Hacking RTL960x](https://github.com/Anime4000/RTL960x)
+- [Asenheim firmware repository](https://cloud.asenheim.org/s/tqGTgBDSZgoKFyg) - alternative firmware collection for ODI/HSGQ, Alcatel/Nokia and Huawei modules
 - [Ditch ONU, use GPON SFP on Business Grade Router, Mikrotik/Ubiquiti/pfSense (Home Networking)](https://forum.lowyat.net/topic/4925452)
 - [For the new model ODI ZTE DFP-34X-C2C](/ont-odi-zte-dfp-34x-2c2)
 
diff --git a/ont/ont-odi-realtek-dfp-34x-2c2.md b/ont/ont-odi-realtek-dfp-34x-2c2.md
index 1e73b465..5582cf1a 100644
--- a/ont/ont-odi-realtek-dfp-34x-2c2.md
+++ b/ont/ont-odi-realtek-dfp-34x-2c2.md
@@ -2,7 +2,7 @@
 title: ODI Realtek DFP-34X-2C2 
 description: New model 2022 - v05
 has_children: false
-parent: ODI
+parent: HSGQ (formerly ODI)
 ---
 
 # Hardware Specifications
@@ -97,6 +97,7 @@ omciOLT21: "true"
 # Miscellaneous Links
 
 - [Hacking RTL960x](https://github.com/Anime4000/RTL960x)
+- [Asenheim firmware repository](https://cloud.asenheim.org/s/tqGTgBDSZgoKFyg) - alternative firmware collection for ODI/HSGQ, Alcatel/Nokia and Huawei modules
 - [Ditch ONU, use GPON SFP on Business Grade Router, Mikrotik/Ubiquiti/pfSense (Home Networking)](https://forum.lowyat.net/topic/4925452)
 - [For the old model ODI ZTE DFP-34G-C2C](/ont-odi-zte-dfp-34g-2c2)
 
diff --git a/ont/ont-odi-zte-dfp-34g-2c2.md b/ont/ont-odi-zte-dfp-34g-2c2.md
index 98bc4549..afc39373 100644
--- a/ont/ont-odi-zte-dfp-34g-2c2.md
+++ b/ont/ont-odi-zte-dfp-34g-2c2.md
@@ -2,7 +2,7 @@
 title: ODI ZTE DFP-34G-2C2
 description: Old model 2020 - v04
 has_children: false
-parent: ODI
+parent: HSGQ (formerly ODI)
 alias: Usourcetech UGP-N1S
 ---
 
@@ -55,6 +55,7 @@ This stick supports dual boot.
 
 # Miscellaneous Links
 
+- [Asenheim firmware repository](https://cloud.asenheim.org/s/tqGTgBDSZgoKFyg) - alternative firmware collection for ODI/HSGQ, Alcatel/Nokia and Huawei modules
 - [GPON module Dfp-34g-2c2 sfp](https://forum.openwrt.org/t/gpon-module-dfp-34g-2c2-sfp/51641)
 - [Ditch ONU, use GPON SFP on Business Grade Router, Mikrotik/Ubiquiti/pfSense (Home Networking)](https://forum.lowyat.net/topic/4925452)
 - [Usage GPON module SFP in Spain](https://forum.mikrotik.com/viewtopic.php?t=116364&start=300)
diff --git a/ont/ont-odi-zte-dfp-34x-2c2.md b/ont/ont-odi-zte-dfp-34x-2c2.md
index cf26cacf..1620a88b 100644
--- a/ont/ont-odi-zte-dfp-34x-2c2.md
+++ b/ont/ont-odi-zte-dfp-34x-2c2.md
@@ -2,7 +2,7 @@
 title: ODI ZTE DFP-34G-2C2
 description: Old model 2020 - v04
 has_children: false
-parent: ODI
+parent: HSGQ (formerly ODI)
 nav_exclude: true
 redirect_to: /ont-odi-zte-dfp-34g-2c2
 ---
diff --git a/ont/ont-odi.md b/ont/ont-odi.md
index eb3a4ff0..926e5647 100644
--- a/ont/ont-odi.md
+++ b/ont/ont-odi.md
@@ -1,4 +1,9 @@
 ---
-title: ODI
+title: HSGQ (formerly ODI)
 has_children: true
+alias: ODI
 ---
+
+::: info Note
+ODI has rebranded as HSGQ. The devices are the same; only the company name has changed.
+:::
diff --git a/ont/ont-sercomm-fg1000b.md b/ont/ont-sercomm-fg1000b.md
index eac62416..e6126946 100644
--- a/ont/ont-sercomm-fg1000b.md
+++ b/ont/ont-sercomm-fg1000b.md
@@ -60,7 +60,11 @@ The ONT seems to only display output of the ROM CFE and flash CFE, but doesn't s
 | 090144.1.0.004   |               | Deutsche Telekom (FG1000B.11) |
 | 090144.1.0.006   |               | Deutsche Telekom (FG1000B.11) |
 | 090144.1.0.009   | 23.05.2025    | Deutsche Telekom (FG1000B.11) |
+| 090165.1.0.009   |               | Deutsche Telekom (FG1000B.11) |
 
+::: info Firmware downloads
+Deutsche Telekom makes firmware update files available on their website: [Glasfaser-Modem firmware](https://www.telekom.de/hilfe/geraete/router/zubehoer/glasfaser-modem). Note that the firmware files appear to be encrypted/obfuscated (Sercomm proprietary format).
+:::
 
 ## List of partitions
 `cat /proc/mtd`
diff --git a/ont/ont-technicolor.md b/ont/ont-technicolor.md
index 32cb65cb..37941cbb 100644
--- a/ont/ont-technicolor.md
+++ b/ont/ont-technicolor.md
@@ -1,4 +1,9 @@
 ---
 title: Vantiva (formerly Technicolor)
 has_children: true
+alias: Technicolor
 ---
+
+::: info Note
+Technicolor rebranded as Vantiva in 2022. The devices are the same; only the company name has changed.
+:::
diff --git a/ont/ont-tplink-xz000-g7.md b/ont/ont-tplink-xz000-g7.md
new file mode 100644
index 00000000..e2c59b4e
--- /dev/null
+++ b/ont/ont-tplink-xz000-g7.md
@@ -0,0 +1,34 @@
+---
+title: TP-Link XZ000-G7
+has_children: false
+parent: TP-Link
+---
+
+# Hardware Specifications
+
+|              |                                       |
+| ------------ | ------------------------------------- |
+| Vendor/Brand | TP-Link                               |
+| Model        | XZ000-G7                              |
+| Chipset      | Faraday/Galachip GC1601               |
+| CPU          | ARM 32-bit                            |
+| Flash        |                                       |
+| RAM          |                                       |
+| System       | Linux (Kernel 3.16, uClibc)           |
+| HSGMII       |                                       |
+| Optics       | SC/APC                                |
+| IP address   |                                       |
+| Web Gui      |                                       |
+| SSH          |                                       |
+| Telnet       |                                       |
+| Serial       |                                       |
+| Form Factor  | ONT                                   |
+
+::: info Note
+This ONT uses the Faraday/Galachip GC1601 chipset, which is relatively uncommon. The device uses a custom Galachip-specific SDK. Very little public documentation exists about this chipset.
+:::
+
+# Miscellaneous Links
+
+- [TP-Link XZ000-G7 product page](https://www.tp-link.com/nordic/service-provider/gpon/xz000-g7/)
+- [XZ000-G7 additional info (Portuguese)](https://www.tripleoxygen.net/wiki/ont/tplink/xz000-g7-br-v1)
diff --git a/ont/ont-zyxel-pmg3000-d20b.md b/ont/ont-zyxel-pmg3000-d20b.md
index b4d01b5f..14a69e9c 100644
--- a/ont/ont-zyxel-pmg3000-d20b.md
+++ b/ont/ont-zyxel-pmg3000-d20b.md
@@ -208,6 +208,17 @@ The equipment id must be encoded in hex format and right padded to 39 characters
 
 # Advanced settings
 
+## Setting root password via bootloader (V2.50 only)
+
+On firmware V2.50(ABVJ.1), the root password can be set via the bootloader environment variable `remote_account_pwd`:
+
+```sh
+setenv remote_account_pwd thepassword
+saveenv
+```
+
+After rebooting, the password set here can be used for root access.
+
 ## Resetting Web GUI admin credentials
 
 Under certain circumstances, the Web GUI admin credentials might get changed from the default `admin`/`1234` combination.
diff --git a/sfp-cage/fiberethernet-media-converter-2.5.md b/sfp-cage/fiberethernet-media-converter-2.5.md
index 5cd19446..8c85f3ac 100644
--- a/sfp-cage/fiberethernet-media-converter-2.5.md
+++ b/sfp-cage/fiberethernet-media-converter-2.5.md
@@ -22,4 +22,13 @@ has_children: false
 
 
 
+## Variants with TTL serial pins
+
+Some 2.5G SFP media converters include built-in TTL serial pins, eliminating the need for a separate SFP-to-TTL adapter:
+
+- [2.5G SFP Media Converter with TTL pins (variant 1)](https://aliexpress.com/item/1005010123324704.html)
+- [2.5G SFP Media Converter with TTL pins (variant 2)](https://aliexpress.com/item/1005010111907029.html)
+
+# Miscellaneous Links
+
 - [2.5G Fiber Optic Media Converter Gigabit SFP Transceiver 1000Mbps Compatible With Common E/GPON](https://aliexpress.com/item/1005004340369253.html)
diff --git a/sfp-cage/zyxel.md b/sfp-cage/zyxel.md
index ad43cf03..d9298cac 100644
--- a/sfp-cage/zyxel.md
+++ b/sfp-cage/zyxel.md
@@ -72,6 +72,10 @@ By default zloader access is blocked.
 
 ### Unlocking zloader 
 
+::: danger Warning
+Starting from firmware version 34.0 (released 9th May 2025), Zyxel has patched the `EngDebugFlag` security flaw. The procedure below to unlock zloader via `fw_setenv EngDebugFlag 0x1` no longer works on firmware 34.0 and newer. If your device has been updated to this firmware, the root/zloader access methods described here are not available.
+:::
+
 ::: danger Warning
 The following procedure is provided as-is, if you damage the device this community is not responsibile for any damage in any way.
 :::