diff --git a/device/testing/device-motorola-rtwo/APKBUILD b/device/testing/device-motorola-rtwo/APKBUILD
index 776ca83d8..f536cf0db 100644
--- a/device/testing/device-motorola-rtwo/APKBUILD
+++ b/device/testing/device-motorola-rtwo/APKBUILD
@@ -2,7 +2,7 @@
 maintainer="snlavaise <snlavaise@gmail.com>"
 pkgname=device-motorola-rtwo
 pkgver=1
-pkgrel=14
+pkgrel=15
 pkgdesc="Motorola Moto Edge 40 Pro"
 url="https://postmarketos.org"
 arch="aarch64"
@@ -36,6 +36,6 @@ package() {
 }
 
 sha512sums="
-2625f12ae797bf8b2ad03aed507d86cac728e37a202d92ed565900e449f03f4164b5a1e08304916e5e73c5c53338176c2ea0d8251b5f473894637af317519aa3  deviceinfo
+2a152f5a33e503f255fb3e0201f204e2066a95a763d1bf517f99f61821c2db66da6f1e0132ce24cdf420502f7831aad4a9e25b2c6d020403b3974ef63b2fb399  deviceinfo
 44085ab61668201f3091046586a333f017bc0e11af7624d7bd5bfe13e98eed3943a2daa02922db48ce8cac8de3c08622ac2c32cf959daf96bd416f217863f62c  modules-initfs
 "
diff --git a/device/testing/device-motorola-rtwo/deviceinfo b/device/testing/device-motorola-rtwo/deviceinfo
index b8091a392..86bd8bb6d 100644
--- a/device/testing/device-motorola-rtwo/deviceinfo
+++ b/device/testing/device-motorola-rtwo/deviceinfo
@@ -21,6 +21,12 @@ deviceinfo_no_framebuffer="true"
 
 # Small base initramfs (fits init_boot) + a separate initramfs-extra.
 deviceinfo_create_initfs_extra="true"
+# The stock LineageOS boot chain packs both Android-v4 ramdisks with LZ4
+# legacy. When the bootloader concatenates our vendor_ramdisk with the
+# init_boot ramdisk, a gzip stream after an LZ4-legacy one makes the
+# kernel's unpacker choke ("invalid magic" -> panic unknown-block(0,0)).
+# Match the stock format.
+deviceinfo_initfs_compression="lz4:legacy"
 
 # Bootloader: Android 13 GKI. The kernel goes in boot, the DTB + cmdline +
 # initramfs in vendor_boot. init_boot holds the generic (first-stage)
diff --git a/device/testing/linux-postmarketos-qcom-sm8550/APKBUILD b/device/testing/linux-postmarketos-qcom-sm8550/APKBUILD
index 960ee3ed3..2ac04c596 100644
--- a/device/testing/linux-postmarketos-qcom-sm8550/APKBUILD
+++ b/device/testing/linux-postmarketos-qcom-sm8550/APKBUILD
@@ -5,7 +5,7 @@ maintainer="snlavaise <snlavaise@gmail.com>"
 _flavor="postmarketos-qcom-sm8550"
 pkgname=linux-$_flavor
 pkgver=7.2
-pkgrel=12
+pkgrel=13
 pkgdesc="Mainline kernel for Qualcomm SM8550 (Snapdragon 8 Gen 2) + Motorola rtwo"
 arch="aarch64"
 _carch="arm64"
@@ -112,5 +112,5 @@ sha512sums="
 52d5aa7f94f6aa6141debf4ceb4fc7a2e75505a7cd38b8854e501be83c2b57863020f463f2fdb2fc93667e6cfe13274d077e5207a611e4797bd9404ee0e64c58  linux-postmarketos-qcom-sm8550-7.2.tar.gz
 f9ae52489f6b9e6fef64952943cd09732a5bef90a0e8765db03c256483028368687d6d5a1d80dd813a513e7e80d91f8b47f49b91cff67266b76f1d6275a7fea0  config-motorola-rtwo.aarch64
 53441c23146d76bb0eaa358a25f6cce4f21740cfb65b755df52bbb218daf2cda30b3d80fa6ca4e283ea1afe2b0fa708307b678b421898100710b8fb99b08d6c5  rtwo.config
-f05e6c76e546c1287bbfc228e3953c5ef3646a99cf42f21c113debc8846d7442419df685f8f94feb329e60341a0e1bb47f29bdebd49b0f1c0fd097a6a3faa4d5  sm8550-motorola-rtwo.dts
+7f51d30b9e2d7fb781fbf066a8f8696816e881686c9a287b20d5d213955912c783e1534479c9bd9701cd29c1e1769132653a56f7b008eb7368083e5f523fd731  sm8550-motorola-rtwo.dts
 "
diff --git a/device/testing/linux-postmarketos-qcom-sm8550/sm8550-motorola-rtwo.dts b/device/testing/linux-postmarketos-qcom-sm8550/sm8550-motorola-rtwo.dts
index 3f5d6d314..466de5405 100644
--- a/device/testing/linux-postmarketos-qcom-sm8550/sm8550-motorola-rtwo.dts
+++ b/device/testing/linux-postmarketos-qcom-sm8550/sm8550-motorola-rtwo.dts
@@ -23,6 +23,12 @@
  *     that memory the hypervisor faults the access and the SoC resets
  *     with no console output (the <2s reboot we were chasing; the
  *     mainline Samsung Galaxy Tab S9 port hit the same "NoC error")
+ *   - gpio-reserved-ranges for the 17 TLMM pins the stock DT hands to
+ *     the hypervisor / secure VMs; the mainline tlmm probe reading one
+ *     of them is the same NoC fault (Samsung port: this was the actual
+ *     trigger, gpio-reserved-ranges the fix)
+ *   - qcom,select-utmi-as-pipe-clk on the dwc3 glue (mandatory once the
+ *     SuperSpeed PHY is dropped) and the stock eUSB2 repeater tuning
  *   - a ramoops region so a failed boot's console survives
  */
 
@@ -428,9 +434,25 @@
 };
 
 
+/*
+ * The stock TLMM has 17 GPIOs handed to the hypervisor / other VMs
+ * (fingerprint, TrustUI, OEM VM - the stock DT's qcom,tlmm-vm-gpio-list).
+ * The mainline sm8550-tlmm probe walks every GPIO's config registers; a
+ * read of a hyp-owned one faults the NoC and TrustZone resets the SoC
+ * with no console (this was THE trigger of the same <2s reboot on the
+ * mainline Samsung Galaxy Tab S9 port - its fix was gpio-reserved-ranges).
+ */
+&tlmm {
+	gpio-reserved-ranges = <13 1>, <24 2>, <44 5>, <56 4>,
+			       <86 2>, <91 1>, <133 1>, <137 1>;
+};
+
 &pm8550b_eusb2_repeater {
 	vdd18-supply = <&pm8550_l15>;
 	vdd3-supply = <&pm8550_l5>;
+	/* Peripheral-mode tuning writes from the stock DT (<value reg>
+	 * pairs). The mainline driver only de-asserts repeater reset. */
+	qcom,param-override-seq = <0x0b 0x51 0x06 0x53 0x04 0x54 0x06 0x57>;
 };
 
 /* GENI QUP0 wrapper: hosts the debug UART (SE7) */
@@ -447,6 +469,12 @@
 	 * type-C / pmic-glink / SuperSpeed */
 	dr_mode = "peripheral";
 	maximum-speed = "high-speed";
+	/*
+	 * We delete the SuperSpeed QMP PHY below, so the dwc3 glue must
+	 * feed PIPE from UTMI - without this the core never releases the
+	 * soft reset (DCTL.CSFTRST stuck -> -ETIMEDOUT, no usb0).
+	 */
+	qcom,select-utmi-as-pipe-clk;
 	/delete-property/ usb-role-switch;
 	/delete-property/ phys;
 	/delete-property/ phy-names;