diff --git a/package/kernel/mt76/patches/0156-npu-init-rsv-memory.patch b/package/kernel/mt76/patches/0156-npu-init-rsv-memory.patch
new file mode 100644
index 00000000000000..d7959caa0f1070
--- /dev/null
+++ b/package/kernel/mt76/patches/0156-npu-init-rsv-memory.patch
@@ -0,0 +1,13 @@
+--- a/npu.c
++++ b/npu.c
+@@ -535,6 +535,10 @@ int mt76_npu_init(struct mt76_dev *dev)
+ 		goto unlock;
+ 	}
+ 
++	err = airoha_npu_wlan_init_reserved_memory(npu);
++	if (err)
++		goto unlock;
++
+ 	dev->dma_dev = npu->dev;
+ 	rcu_assign_pointer(dev->mmio.npu, npu);
+ 	rcu_assign_pointer(dev->mmio.ppe_dev, ppe_dev);
diff --git a/package/kernel/mt76/patches/0157-fix-RRO-OOM.patch b/package/kernel/mt76/patches/0157-fix-RRO-OOM.patch
new file mode 100644
index 00000000000000..649d1fbbe49f26
--- /dev/null
+++ b/package/kernel/mt76/patches/0157-fix-RRO-OOM.patch
@@ -0,0 +1,81 @@
+--- a/mt76.h
++++ b/mt76.h
+@@ -25,7 +25,6 @@
+ #endif
+ #include "util.h"
+ #include "testmode.h"
+-#define MAGIC_ENABLE 0
+ 
+ #define CHAN2G(_idx, _freq) {			\
+ 	.band = NL80211_BAND_2GHZ,		\
+@@ -2014,6 +2013,12 @@ static inline bool mt76_queue_is_wed_rro
+ 	return q->flags & MT_QFLAG_WED_RRO;
+ }
+ 
++static inline bool mt76_queue_is_rro_active(struct mt76_queue *q)
++{
++	return !mt76_npu_device_active(q->dev) &&
++	       (q->flags & MT_QFLAG_WED_RRO_EN);
++}
++
+ static inline bool mt76_queue_is_wed_rro_ind(struct mt76_queue *q)
+ {
+ 	return mt76_queue_is_wed_rro(q) &&
+--- a/dma.c
++++ b/dma.c
+@@ -157,13 +157,13 @@ EXPORT_SYMBOL_GPL(mt76_free_pending_rxwi
+ static void
+ mt76_dma_sync_idx(struct mt76_dev *dev, struct mt76_queue *q)
+ {
++	u32 val = q->ndesc;
++
+ 	Q_WRITE(q, desc_base, q->desc_dma);
+-#if MAGIC_ENABLE	
+-	if (q->flags & MT_QFLAG_WED_RRO_EN)
+-		Q_WRITE(q, ring_size, MT_DMA_RRO_EN | q->ndesc);
+-	else
+-#endif		
+-		Q_WRITE(q, ring_size, q->ndesc);
++
++	if (mt76_queue_is_rro_active(q))
++		val |= MT_DMA_RRO_EN;
++	Q_WRITE(q, ring_size, val);
+ 
+ 	if (mt76_queue_is_npu_tx(q)) {
+ 		writel(q->desc_dma, &q->regs->desc_base);
+@@ -255,13 +255,13 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev
+ 		if (dev->drv->rx_rro_fill_msdu_pg(dev, q, buf->addr, data))
+ 			return	-ENOMEM;
+ 	}
+-#if MAGIC_ENABLE
+-	if (q->flags & MT_QFLAG_WED_RRO_EN) {
++
++	if (mt76_queue_is_rro_active(q)) {
+ 		info |= FIELD_PREP(MT_DMA_MAGIC_MASK, q->magic_cnt);
+ 		if ((q->head + 1) == q->ndesc)
+ 			q->magic_cnt = (q->magic_cnt + 1) % MT_DMA_MAGIC_CNT;
+ 	}
+-#endif
++
+ 	WRITE_ONCE(desc->buf0, cpu_to_le32(buf->addr));
+ 	WRITE_ONCE(desc->buf1, cpu_to_le32(buf1));
+ 	WRITE_ONCE(desc->ctrl, cpu_to_le32(ctrl));
+@@ -989,14 +989,14 @@ mt76_dma_rx_process(struct mt76_dev *dev
+ 	bool check_ddone = false;
+ 	bool allow_direct = !mt76_queue_is_wed_rx(q);
+ 	bool more;
+-#if MAGIC_ENABLE
+-	if ((q->flags & MT_QFLAG_WED_RRO_EN) ||
++
++	if (mt76_queue_is_rro_active(q) ||
+ 	    (IS_ENABLED(CONFIG_NET_MEDIATEK_SOC_WED) &&
+-	    mt76_queue_is_wed_tx_free(q))) {
++	     mt76_queue_is_wed_tx_free(q))) {
+ 		dma_idx = Q_READ(q, dma_idx);
+ 		check_ddone = true;
+ 	}
+-#endif
++
+ 	while (done < budget) {
+ 		bool drop = false;
+ 		u32 info;
diff --git a/package/libs/libiconv-full/Makefile b/package/libs/libiconv-full/Makefile
index 0c793973a05f8a..5ebd9eea57bd36 100644
--- a/package/libs/libiconv-full/Makefile
+++ b/package/libs/libiconv-full/Makefile
@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=libiconv-full
-PKG_VERSION:=1.17
+PKG_VERSION:=1.18
 PKG_RELEASE:=1
 
 PKG_SOURCE:=libiconv-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=@GNU/libiconv
-PKG_HASH:=8f74213b56238c85a50a5329f77e06198771e70dd9a739779f4c02f65d971313
+PKG_HASH:=3b08f5f4f9b4eb82f151a7040bfd6fe6c6fb922efe4b1659c66ea933276965e8
 PKG_BUILD_DIR:=$(BUILD_DIR)/libiconv-$(PKG_VERSION)
 HOST_BUILD_DIR:=$(BUILD_DIR_HOST)/libiconv-$(PKG_VERSION)
 
@@ -21,7 +21,6 @@ PKG_MAINTAINER:=Jo-Philipp Wich <jo@mein.io>
 PKG_LICENSE:=LGPL-2.1-or-later
 PKG_LICENSE_FILES:=COPYING.LIB
 
-PKG_FIXUP:=patch-libtool
 PKG_INSTALL:=1
 PKG_BUILD_PARALLEL:=1
 
diff --git a/target/linux/airoha/patches-6.6/999-63-airoha-npu-wlan-init-from-wifi-drv.patch b/target/linux/airoha/patches-6.6/999-63-airoha-npu-wlan-init-from-wifi-drv.patch
new file mode 100644
index 00000000000000..a06a73be63ba56
--- /dev/null
+++ b/target/linux/airoha/patches-6.6/999-63-airoha-npu-wlan-init-from-wifi-drv.patch
@@ -0,0 +1,64 @@
+--- a/drivers/net/ethernet/airoha/airoha_npu.c
++++ b/drivers/net/ethernet/airoha/airoha_npu.c
+@@ -635,7 +635,7 @@ static u32 airoha_npu_wlan_queue_addr_ge
+ 	return REG_RX_BASE(qid);
+ }
+ 
+-static int airoha_npu_wlan_init(struct airoha_npu *npu)
++static int airoha_npu_wlan_init_memory(struct airoha_npu *npu)
+ {
+ 	int err, cmd = WLAN_FUNC_SET_WAIT_NPU_BAND0_ONCPU;
+ 
+@@ -788,6 +788,7 @@ static int airoha_npu_probe(struct platf
+ 	npu->ops.ppe_deinit = airoha_npu_ppe_deinit;
+ 	npu->ops.ppe_flush_sram_entries = airoha_npu_ppe_flush_sram_entries;
+ 	npu->ops.ppe_foe_commit_entry = airoha_npu_foe_commit_entry;
++	npu->ops.wlan_init_reserved_memory = airoha_npu_wlan_init_memory;
+ 	npu->ops.wlan_set_txrx_reg_addr = airoha_npu_wlan_txrx_reg_addr_set;
+ 	npu->ops.wlan_set_pcie_port_type = airoha_npu_wlan_pcie_port_type_set;
+ 	npu->ops.wlan_set_pcie_addr = airoha_npu_wlan_pcie_addr_set;
+@@ -879,10 +880,6 @@ static int airoha_npu_probe(struct platf
+ 	regmap_write(npu->regmap, REG_CR_BOOT_TRIGGER, 0x1);
+ 	msleep(100);
+ 
+-	err = airoha_npu_wlan_init(npu);
+-	if (err)
+-		return err;
+-
+ 	platform_set_drvdata(pdev, npu);
+ 
+ 	return 0;
+--- a/include/linux/soc/airoha/airoha_offload.h
++++ b/include/linux/soc/airoha/airoha_offload.h
+@@ -136,6 +136,7 @@ struct airoha_npu {
+ 					    dma_addr_t foe_addr,
+ 					    u32 entry_size, u32 hash,
+ 					    bool ppe2);
++		int (*wlan_init_reserved_memory)(struct airoha_npu *npu);
+ 		int (*wlan_set_txrx_reg_addr)(struct airoha_npu *npu,
+ 					      int ifindex, u32 dir,
+ 					      u32 in_counter_addr,
+@@ -169,6 +170,11 @@ struct airoha_npu {
+ struct airoha_npu *airoha_npu_get(struct device *dev, dma_addr_t *stats_addr);
+ void airoha_npu_put(struct airoha_npu *npu);
+ 
++static inline int airoha_npu_wlan_init_reserved_memory(struct airoha_npu *npu)
++{
++	return npu->ops.wlan_init_reserved_memory(npu);
++}
++
+ static inline int airoha_npu_wlan_set_txrx_reg_addr(struct airoha_npu *npu,
+ 						    int ifindex, u32 dir,
+ 						    u32 in_counter_addr,
+@@ -261,6 +267,11 @@ static inline void airoha_npu_put(struct
+ {
+ }
+ 
++static inline int airoha_npu_wlan_init_reserved_memory(struct airoha_npu *npu)
++{
++	return -EOPNOTSUPP;
++}
++
+ static inline int airoha_npu_wlan_set_txrx_reg_addr(struct airoha_npu *npu,
+ 						    int ifindex, u32 dir,
+ 						    u32 in_counter_addr,