diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a5e93953..707c7600 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -18,7 +18,12 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
         with:
-          submodules: recursive
+          # Init the direct submodules (devourer + wfb-ng) but NOT recursively:
+          # devourer's reference/* vendor-kernel submodules are only used by its
+          # extraction tooling / hardware tests, never compiled into the APK, and
+          # one of them currently pins an unpushed commit that breaks a recursive
+          # clone. wfb-ng has no nested submodules.
+          submodules: true
 
       - name: Set up JDK 17
         uses: actions/setup-java@v3
diff --git a/app/wfbngrtl8812/src/main/cpp/CMakeLists.txt b/app/wfbngrtl8812/src/main/cpp/CMakeLists.txt
index a7320129..f2314025 100644
--- a/app/wfbngrtl8812/src/main/cpp/CMakeLists.txt
+++ b/app/wfbngrtl8812/src/main/cpp/CMakeLists.txt
@@ -47,6 +47,7 @@ add_library(devourer STATIC
         ${CMAKE_SOURCE_DIR}/devourer/src/SignalStop.cpp
         ${CMAKE_SOURCE_DIR}/devourer/src/WiFiDriver.cpp
         ${CMAKE_SOURCE_DIR}/devourer/src/PhyTableLoader.cpp
+        ${CMAKE_SOURCE_DIR}/devourer/src/LaCapture.cpp
 
         # --- Jaguar1 (RTL8812AU / 8811AU / 8821AU) ---
         ${CMAKE_SOURCE_DIR}/devourer/hal/hal8812a_fw.c
@@ -71,6 +72,7 @@ add_library(devourer STATIC
         ${CMAKE_SOURCE_DIR}/devourer/src/jaguar3/HalmacJaguar3Fw.cpp
         ${CMAKE_SOURCE_DIR}/devourer/src/jaguar3/HalmacJaguar3MacInit.cpp
         ${CMAKE_SOURCE_DIR}/devourer/src/jaguar3/RadioManagementJaguar3.cpp
+        ${CMAKE_SOURCE_DIR}/devourer/src/jaguar3/PhydmRuntimeJaguar3.cpp
         ${CMAKE_SOURCE_DIR}/devourer/src/jaguar3/PhyTableLoaderJaguar3.cpp
         ${CMAKE_SOURCE_DIR}/devourer/src/jaguar3/Phy8822cTables.cpp
         ${CMAKE_SOURCE_DIR}/devourer/src/jaguar3/Halrf8822c.cpp
diff --git a/app/wfbngrtl8812/src/main/cpp/WfbngLink.cpp b/app/wfbngrtl8812/src/main/cpp/WfbngLink.cpp
index 217a9214..e8d9c14c 100644
--- a/app/wfbngrtl8812/src/main/cpp/WfbngLink.cpp
+++ b/app/wfbngrtl8812/src/main/cpp/WfbngLink.cpp
@@ -124,6 +124,12 @@ int WfbngLink::run(JNIEnv *env, jobject context, jint wifiChannel, jint bw, jint
     // The per-adapter advisory lock defaults to /tmp, which doesn't exist on
     // Android — use the app's files dir (same location as gs.key).
     cfg.usb.lock_dir = "/data/user/0/com.openipc.pixelpilot/files";
+    // Keep the RX ring on plain heap buffers. The zerocopy dev-mem path
+    // (libusb_dev_mem_alloc / USBDEVFS mmap) is unvalidated on Android vendor
+    // kernels; if the mmap succeeds but the HCD's zerocopy path is broken,
+    // the heap fallback never triggers. Heap is the behavior every working
+    // Android build has shipped.
+    cfg.usb.rx_zerocopy = false;
 
     rtl_devices[fd] = wifi_driver->CreateRtlDevice(dev_handle, ctx, nullptr, cfg);
     if (!rtl_devices.at(fd)) {
diff --git a/app/wfbngrtl8812/src/main/cpp/devourer b/app/wfbngrtl8812/src/main/cpp/devourer
index 73f1cb4b..b7c50ece 160000
--- a/app/wfbngrtl8812/src/main/cpp/devourer
+++ b/app/wfbngrtl8812/src/main/cpp/devourer
@@ -1 +1 @@
-Subproject commit 73f1cb4bcc6d1cfd6c5560f6637ce34aeaa94803
+Subproject commit b7c50eceaeb43f10cbdee3726cc2245ae6fc3c71