--- dts/msm8916-jz08-aurora-bam1.dts	2026-09-30 04:59:05.936797233 +0600
+++ dts/msm8916-jz08-aurora-b8b.dts	2026-10-02 23:34:53.742978524 +0600
@@ -1,7 +1,8 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
  * Project Aurora — JZ08AU-XPA-7J-R3 (MSM8916, 512 MB, ST7735S SPI panel).
- * RAM-BOOT MODEM1: EMMC1 + MPSS remoteproc (native Aurora firmware, rmtfs -r). No BAM-DMUX/WWAN/WCNSS. Everything that could touch
+ * B8B (RAM test only): bam1 + Pronto/WCNSS remoteproc + Iris (no WLAN stack, no NV).
+ * Base was RAM-BOOT MODEM1: EMMC1 + MPSS remoteproc (native Aurora firmware, rmtfs -r). No BAM-DMUX/WWAN/WCNSS. Everything that could touch
  * storage, radios or power management is explicitly disabled.
  *
  * Hardware facts from stock Aurora dtb_01 (see NOTES.md S2.1/S12):
@@ -14,7 +15,7 @@
 #include "msm8916-pm8916.dtsi"	/* + RPM regulators (USB PHY L7/L13) */
 
 / {
-	model = "JZ08AU Aurora (RAM boot BAM1)";
+	model = "JZ08AU Aurora (RAM boot B8B)";
 	compatible = "jz08au,aurora", "qcom,msm8916";
 	chassis-type = "embedded";
 
@@ -26,6 +27,21 @@
 	chosen {
 		stdout-path = "serial0:115200n8";
 	};
+
+	/*
+	 * B8B: WCNSS/Pronto carve-out at the stock Aurora address. Stock dtb_01 "peripheral_mem"
+	 * (pronto PIL region) = 0x8b600000 size 0x600000; wcnss.mdt is linked at 0x8b600000.
+	 * Directly follows mpss_mem (0x86800000 + 0x4e00000 = 0x8b600000) -> no overlap.
+	 * Same fixed-address pattern as upstream msm8916-longcheer-l8150.dts.
+	 */
+	reserved-memory {
+		/delete-node/ wcnss;
+
+		wcnss_mem: wcnss@8b600000 {
+			reg = <0x0 0x8b600000 0x0 0x600000>;
+			no-map;
+		};
+	};
 };
 
 &blsp_uart2 {
@@ -42,7 +58,7 @@
 /* mpss: enabled below */
 &bam_dmux { status = "okay"; };	/* B4b1: data-plane mux driver (no bearer) */
 &bam_dmux_dma { status = "okay"; };
-&wcnss { status = "disabled"; };	/* WCNSS/pronto remoteproc */
+/* wcnss: enabled below (B8B) */
 
 /*
  * USB peripheral only (ChipIdea ci-hdrc + qcom,usb-hs-phy-msm8916, upstream bindings).
@@ -118,3 +134,20 @@
 		};
 	};
 };
+
+/*
+ * B8B: Pronto (WCNSS) remoteproc + Iris RF. Firmware = default "wcnss.mdt" from /firmware/image (RO FAT).
+ * Supplies come from msm8916-pm8916.dtsi and match stock dtb_01: vddpx/vddxo = L7 1.8 V, vddrfa = S3,
+ * vddpa = L9 3.3 V, vdddig = L5 1.8 V.
+ * Iris compatible: stock DT has none (generic qcom,wcnss_wlan + qcom,has-autodetect-xo). Stock voltages exclude
+ * WCN3660 (vddpa 2.9-3.0 V, vdddig 1.2 V); WCN3620 vs WCN3680 have identical vregs (differ in 48 MHz XO);
+ * stock Pronto FW caps lack DOT11AC -> WCN3620 (controlled hypothesis, see logs/b8/b8b).
+ * WLAN/cfg80211/wcn36xx are NOT in this kernel; wcnss_ctrl NV download is expected to fail (no NV in rootfs).
+ */
+&wcnss {
+	status = "okay";
+};
+
+&wcnss_iris {
+	compatible = "qcom,wcn3620";
+};