# mt7981 firmware 2024-08 → 2026-05: handler-level changelog Method: {id,fn} registration arrays (F9) for WM; dense dispatch table @0x10201304 (F7) for WA. Id-level diff — robust to code relayout (2026 build shifted all code addresses; ~95% of region 0xe003b000 differs byte-wise). ## WM (main firmware) - Command id surface: **identical** — 169 ids present in both builds, 0 added, 0 removed. - Registration arrays: 4 of 15 arrays sit at the same address with the same count; array @0x022320e0 grew (24, 25) - Per-handler code comparison deferred: requires function matching across the relayout (string-anchor matching is the planned method). The byte-diff headline (region 0xe003b000 ~95% changed) is dominated by shift, not rewrite — do not read it as a near-total rewrite. ## WA (offload core) - Handled ids: 29 → 30, with **migration**: 14 newly handled, 13 dropped. - Newly handled in 2026: - `+ 0x00 (internal id)` - `+ 0x05 ID_RADIO_ON_OFF_CTRL` - `+ 0x06 (internal id)` - `+ 0x09 (internal id)` - `+ 0x0c (internal id)` - `+ 0x0d (internal id)` - `+ 0x20 (internal id)` - `+ 0x21 EFUSE_BUFFER_MODE` - `+ 0x26 BSS_INFO_UPDATE` - `+ 0x27 EDCA_UPDATE` - `+ 0x2f (internal id)` - `+ 0x30 (internal id)` - `+ 0x3e PROTECT_CTRL` - `+ 0x3f (internal id)` - No longer handled in 2026: - `- 0x03 (internal id)` - `- 0x04 RF_TEST` - `- 0x07 PM_STATE_CTRL` - `- 0x08 CHANNEL_SWITCH` - `- 0x0b (internal id)` - `- 0x18 (internal id)` - `- 0x19 (internal id)` - `- 0x22 (internal id)` - `- 0x23 THERMAL_PROT` - `- 0x2b (internal id)` - `- 0x2c THERMAL_CTRL` - `- 0x31 (internal id)` - `- 0x32 WTBL_UPDATE` Semantic read (labelled interpretation): responsibility for several commands moved between cores — e.g. WA dropped CHANNEL_SWITCH / WTBL_UPDATE / THERMAL_* handling while gaining BSS_INFO / EDCA / EFUSE_BUFFER_MODE — consistent with MTK rebalancing WM/WA workloads across builds. Verification (decompile the specific handlers) is follow-up work. Cross-reference: byte/string-level diffs in `mt7981_wm-20240823-vs-20260515.md`.