[Screamshow]

Native WG/AWG TCP rings limit high-RTT throughput even when CPU has headroom. Use 2 MiB RX/TX rings within a process-wide additional-capacity budget: 32 MiB on ARM64/x86 (8 large connections), 8 MiB on 32-bit MIPS (2). Connections beyond the allowance retain the old 128/64 KiB rings; closing/failing connections returns the reservation. No configuration or AWG crypto/obfuscation changes.

Also make the existing FakeIP exit-gate test independent of external DNS: its old google.com query hit an earlier evaluate action. The explicit FakeIP-domain query passes with loopback only.

Validation:

• Local workspace: 1570 passed, 14 explicitly ignored; 49 WG tests; workspace/rust-x Clippy; four Python tests; privileged SO_MARK, exit gate, 14 inbound and six rust-x profile tests passed.
• ARM64/x86_64/MIPS release builds and size budgets passed; MIPS QEMU 24Kc HTTP/SOCKS/TLS/DNS/Clash smoke passed.
• Exact final MT6000 binary: 384 verified WG/AWG transfers, 16-way stress, budget exhaustion/reuse and 32 refused connections per protocol. FD count returns to 11. Rate-limited phases have zero client UDP drops; saturation has recoverable drops (68 AWG / 430 WG).
• MIPS binary under QEMU: two large plus two fallback connections and budget recovery after closure and 32 refused connections.
• TX-only causal test (three repeats): 53.4 -> 145.5 Mbit/s at 70 ms, 27.0 -> 76.7 at 140 ms; about 1.5 MiB extra process RSS. These are local diagnostic series, not universal WAN/reference parity claims.

Known limits: one earlier 70 ms download fell to 11.64 Mbit/s and remains unlocalized; ten captured retries were normal. Larger windows trade memory and saturation latency for speed. The allowance is not a total RSS cap. Physical low-RAM MIPS and long-running production memory behavior were not benchmarked.

See docs/wireguard-tcp-windows-2026-11-11.md for evidence and limits. GitHub CI passed all five jobs on 9f6c722: Linux including privileged gates, differential, ARM64, x86_64 and MIPS cross-builds. This draft prepares the change for a separate release decision.