Wireless firmware engineering, from the maintainer of Zephyr's Wi-Fi stack

Drivers, supplicants, and security stacks across ZephyrRTOS, Linux, and Windows. Built and certified for silicon vendors and IoT product teams — landed upstream, kept in a maintained fork, or entirely inside your proprietary tree under NDA.

Engaged by Nordic Semiconductor, wifidabba, Quantum Networks, BluWireless and others.

See engagement options →

dotstar_systems — zsh

click to skip

[ 0x00: DOTSTAR_SYSTEMS ]Official ZephyrRTOS Wi-Fi Maintainer & nRF Wi-Fi driver maintainer. Nearly two decades engineering wireless stacks inside silicon — Linux, Windows, and RTOS — from pre-silicon FPGA bringup to upstream kernel contributions and production deployments.Who engages Dotstar:→ Silicon vendor: 802.11ax/be bringup, driver engineering across Linux, Windows, and RTOS, pre-silicon validation→ IoT product team: Wi-Fi bring-up and security hardening on Nordic nRF→ Firmware team blocked on ZephyrRTOS Wi-Fi, hostap, Linux wireless, or Windows WiFiCx

[ 0x01: CAPABILITIES ]

What we work on

user@lab:~$ ./dotstar --list-capabilities

Led by the official Zephyr Project Wi‑Fi Maintainer, Dotstar delivers end-to-end ZephyrRTOS engineering, consulting, and team enablement — native Wi‑Fi stack, networking, drivers, and security — alongside 802.11ax/be (Wi‑Fi 6/7) driver development (Linux, Windows, RTOS), hostap and Linux wireless kernel engineering, Nordic nRF platform integration alongside Matter, Thread, BLE, and LTE‑M/NB‑IoT, embedded security (TF‑M/TrustZone/PSA Crypto), and NMS/EMS at scale.

dotstar_ssh: ~/service_architecture

Department	Expertise Spectrum
ZephyrRTOS	Native Wi-Fi stack (upstream hostap port), networking and driver integration, WPA2/WPA3, Wi-Fi Alliance certification, debugging, and performance optimization — delivered and maintained upstream by the official Zephyr Project Wi-Fi Maintainer. Consulting, production code, and engineering-team enablement.
Silicon & FW	Pre-silicon prototyping (EMU/FPGA/TLM), post-silicon bringup, and 802.11a/b/g/n/ac/ad/ax/be driver engineering across Linux (cfg80211/mac80211, ath9k/ath12k/iwlwifi), Windows (WiFiCx/WDI), and RTOS.
IoT Ecosystems	Wi-Fi integration on Nordic nRF SoC families. Adjacent to that core: LTE-M/NB-IoT, Matter, Thread, and BLE — platform-level integration and coordination with the teams that own those stacks, rather than a shipped delivery record in each.
Network Management	Architecting scalable NMS/EMS solutions for tens of thousands of devices using gRPC, NETCONF, SNMP, and TIG stacks.
Hardened Security	Production-grade certified Wi-Fi security: WPA3 Personal and Enterprise, PSA Crypto, PSA Root of Trust, Trusted Firmware-M (TF-M/TrustZone), and TLS/DTLS.
Edge AI / TinyML	Adjacent capability: on-device model optimisation, quantisation, and deployment on resource-constrained hardware — offered alongside a wireless engagement, rather than a shipped delivery record in its own right.

[ 0x02: ENGAGEMENTS ]

How to work with us

user@lab:~$ ./dotstar --list-engagements

Three shapes of engagement — a short diagnostic, a scoped project, or ongoing capacity — across any of the domains listed below. Scope and commercial terms are fixed in writing before work starts. The audit exists so you can test how we work on something small before committing to anything larger.

dotstar_ssh: ~/engagements

Technical Audit

5 days

Fixed fee

Quoted within 48 hours

A senior read of your stack, delivered as a written report. The fastest way to find out whether we are the right people for your problem — and the lowest-risk way to start.

Review of the stack, driver integration, and configuration in question
Prioritised defect and risk list, with the reasoning behind each call
Certification readiness assessment (WFA, PSA Certified, regulatory)
Written report plus a 90-minute walkthrough with your engineers

Best when: something is wrong and you are not yet sure what, or you want a second opinion before committing a quarter of engineering time.

Engineering Sprint

4–8 weeks

Fixed price for agreed scope · T&M available for open-ended work

Quoted within 48 hours

A defined, milestone-driven block of engineering to get a specific capability working on your hardware — with the tests that prove it.

Scope, milestones, and acceptance criteria agreed before work starts
Pre-silicon validation scaffolding, or post-silicon bring-up on real hardware
Automated regression tests that run in your CI, not just on our bench
Design notes and handover session so your team owns it afterwards

Best when: you have a shipping deadline and a specific capability that is not working, or not started.

Retainer

monthly · ongoing

Reserved capacity — agreed days per month

Quoted within 48 hours

Continuous senior capacity for teams shipping connected products — upstream work, security updates, certification support, and an escalation path when something breaks.

Landing your patches upstream, with maintainer review handled for you
Tracking Zephyr / hostap / Linux / MbedTLS changes that affect your product
Wi-Fi Alliance and PSA Certified workflow support
Named escalation path for production defects

Best when: you ship continuously and need depth on call rather than a one-off project.

Something else?

This list is examples, not limits. If your problem does not map cleanly onto any of these — or you are not sure which shape it needs — describe it in 30 minutes and we will tell you honestly what it would take, including if it is not ours to solve.

Start with a conversation →

Applied across

ZephyrRTOS Wi-Fi & networking
Linux wireless (cfg80211/mac80211, ath9k/ath12k/iwlwifi)
Windows Wi-Fi (WiFiCx, WDI)
hostapd / wpa_supplicant
Production-grade certified Wi-Fi security (WPA3 Personal/Enterprise, PSA Crypto, PSA RoT, TF-M)
Pre-silicon validation (EMU/FPGA/TLM)
Nordic nRF platform integration
NMS/EMS at scale

Book a 30-minute engineering call →

[ 0x03: FIELD_REPORTS ]

Case studies

user@lab:~$ cat /var/log/engagements/selected

dotstar_ssh: ~/field_reports

CASE::001 — Native Wi-Fi Stack · ZephyrRTOS

[ CHALLENGE ] ZephyrRTOS had offloaded Wi-Fi only — basic connection management delegated entirely to vendor firmware. No native supplicant meant every feature addition, bug fix, or security update depended on the silicon vendor's roadmap and release cycle, with no ability to extend or debug independently.

[ OUTCOME ] Evaluated integration paths — iwd, proprietary options, and hostap — and selected hostap as the right foundation: proven, upstream-maintained, and protocol-complete. Ported hostap from Linux to ZephyrRTOS, designing clean integration hooks into Zephyr's networking stack and driver model. The native stack gives device manufacturers full ownership of the supplicant layer — no vendor dependency for features, fixes, or debug. Maintained upstream as the official Zephyr Project Wi-Fi Maintainer.
CASE::002 — HW-SW Co-Design Validation · 802.11ax Pre-Silicon

[ CHALLENGE ] Silicon vendor needed maximum software validation of their 802.11ax IP before tape-out. Bugs caught post-silicon mean re-spin costs and schedule slip; the goal was to exercise as much of the Wi-Fi stack as possible before real hardware existed.

[ OUTCOME ] Developed a HW-SW co-design validation strategy using the vendor's existing simulators, emulators, and FPGA environments — adapted specifically for 802.11ax protocol testing. Innovated a peer simulation approach enabling full protocol-level testing with and without RF hardware. Critical Wi-Fi IP integration bugs and performance issues were identified and resolved pre-tape-out; new 802.11ax features were validated before silicon was available, compressing the post-tape-out bringup timeline significantly.
CASE::003 — MbedTLS 4.x Migration · Wi-Fi Security Stack (ZephyrRTOS / NCS)

[ CHALLENGE ] Wi-Fi security in ZephyrRTOS and silicon vendor stacks ran on legacy MbedTLS APIs. MbedTLS 4.x + TF-PSA-Crypto was required for PSA Certified compliance and EU Cyber Resilience Act readiness — but 4.x removed or privatised primitives Wi-Fi security protocols depend on: DHM dropped entirely, ECP curves (secp192r1, 224r1/k1) gone, legacy crypto headers made private. WPA3-PSA was not yet a MbedTLS project priority, requiring community-level pressure to land it.

[ OUTCOME ] Ported hostap within ZephyrRTOS to work with MbedTLS 4.x + TF-PSA-Crypto LTS — adapting to a set of breaking changes that had no upstream hostap support. Manually ported DHM into hostap; disabled dropped ECP curves from TLS handshakes; resolved private header access for upstream integration. Coordinated testing across Nordic Semiconductor, NXP, and the MbedTLS team — running mac80211_hwsim simulation testing while vendors covered hardware validation. All Wi-Fi security modes (Personal, Enterprise, WPS, DPP) ported to PSA APIs with fallbacks for gaps in the spec. Integration into Nordic Connect SDK (NCS) ongoing.

[ 0x04: CLIENT_ROSTER ]

Clients

user@lab:~$ ls /clients/

Organisations that have engaged Dotstar under contract for the work described below. Listed with permission; engagement details beyond this are covered by NDA.

dotstar_ssh: ~/clients

Nordic Semiconductor

Wi-Fi Systems & Driver Consultant

Wi-Fi Driver, MAC firmware, Security/crypto, Training.

wifidabba

Linux Wireless Consultant

linux-wireless feature bringup on Intel NUC, performance profiling and fine-tuning, Ansible-based network configuration framework development.

Quantum Networks

Wi-Fi Consultant & Architect

Wi-Fi strategy development, WFA FlexTrack and QuickTrack integration planning, STL and MRCL certification strategy for continuous certification.

MeshPlusPlus

Wi-Fi, Mesh & NMS Consultant

Wi-Fi router performance improvements and debugging, BATMAN/BMX7 mesh integration, offline dashboard (MQTT + PostgreSQL + React), SNMPv3 integration and monitoring.

Nearhop

Wi-Fi & Embedded Systems Consultant

OpenWRT, TIP OpenWifi, proprietary network dashboards, and OpenWifi-based network management.

BluWireless

CI/CD & Build Automation

Designed and built a Jenkins / Groovy / Python CI/CD pipeline for an RF firmware partner — tracking pushes, integrating builds with rest of the firmware, running automated checks, and delivering packaged output.

Lyptus Technologies

Wi-Fi SME & Drivers Consultant

Wi-Fi SME and Wi-Fi drivers consultant: Windows and Linux.

[ 0x05: FOUNDER ]

Founder

user@lab:~$ whoami

dotstar_ssh: ~/founder

Chaitanya Tata

Founder & CTO

Chaitanya, founder and principal of Dotstar Systems, brings nearly two decades of cross-functional experience in networking, Wi‑Fi, embedded systems, IoT, and AI. His patent-backed work in intelligent Wi‑Fi power saving and wireless end-node communication underpins silicon-to-cloud engagements across 802.11ax/be (Wi‑Fi 6/7), Matter, Thread, and Nordic nRF platforms.

Open Source Credentials

✓ Official Zephyr Wi‑Fi stack & drivers Maintainer
✓ nRF Wi‑Fi Driver Maintainer (nRF70, nRF71)
✓ Zephyr Networking stack — collaborator

Contributions to linux-wireless, hostap, wireshark, openwrt, TIP-openwifi.

LinkedIn · GitHub

[ 0x06: TEAM_STRUCTURE ]

How the team is structured

user@lab:~$ ls -l /organization/

dotstar_ssh: ~/organization

Founder & CTO (Chaitanya Tata) — Sole point of accountability on every engagement. Owns scoping, architecture, delivery, and sign-off. You always have a named principal with skin in the game, not a project manager fronting a team you'll never meet.
Vetted Senior Associates — Domain specialists pulled in per engagement as the scope demands. No junior bench, no staffing-agency placements. Associates are selected for the specific technical depth the problem requires, and are named, CV'd, and under NDA at proposal stage — you know exactly who is on your project before you sign anything.
Continuity — Delivery does not depend on any single person staying reachable. Work lands upstream or in your repository as it is completed, never in a private branch; every engagement includes design notes, a reproducible test setup, and a handover session. If we disappeared tomorrow, your team could carry the work forward.
Engagement Model — Structured to fit the work: fixed-scope, time-boxed, or ongoing T&M. Every deliverable is reviewed and signed off at principal level before release. Scope and billing structure are agreed upfront — no surprises.

[ INFO ] All work reviewed and signed off at principal level. No black-box subcontracting.

[ 0x07: HOW_WE_WORK ]

How engagements run

user@lab:~$ ./dotstar --engagement-report

dotstar_ssh: ~/how_we_work

Engagements are scoped tightly, milestones are defined upfront, and every deliverable is reviewed and signed off at principal level before it reaches you. Scope and billing are agreed before work starts.

Claims are verified, not asserted A feature is not done when it compiles. It is done when the test that would catch its absence fails without it and passes with it — and we report what actually happened, including the parts that did not work.
Delivery that fits your codebase Upstream where the work belongs there, a clean rebasable fork where it does not, and entirely inside your tree for proprietary drivers and firmware. Whichever applies, the delta is documented rather than living in one person's head.
Documented handover as standard Every engagement ends with design notes, reproducible test setup, and a walkthrough with your engineers. The goal is that your team can carry the work without us.
No unreviewed output Every line of code goes through principal review before release. You are never handed output that has not been through senior technical review.

[ INFO ] Principal-led, outcome-accountable, NDA-standard.

[ 0x08: GOVERNANCE ]

IP, confidentiality & compliance

user@lab:~$ ./check_compliance --results

dotstar_ssh: ~/governance

IP Ownership

All work product is assigned to the client upon payment. Any open-source components are disclosed upfront with licence classification. No proprietary Dotstar code is silently embedded in deliverables — what you receive is yours, clean.

Upstream, Fork, or Proprietary

Three delivery models, chosen to fit your codebase rather than our preference. Upstream: where work belongs in Zephyr, hostap, or the Linux kernel, we land it there and your product stops carrying the delta. Fork: where upstreaming is premature or inappropriate — unreleased silicon, vendor-specific changes, a feature ahead of upstream consensus — we maintain a clean, rebasable fork with a documented delta, so upstreaming stays possible later. Proprietary: closed drivers, MAC firmware, Windows WiFiCx/WDI — work happens inside your tree under NDA and nothing leaves it. In all three, maintainer status on the projects underneath your stack means we can tell you which upstream changes are about to break you, and land fixes when you need them.

Certification & Compliance

Dotstar supports certification workflows for WFA (Wi‑Fi Alliance), CSA (Matter/Thread), FCC/ETSI/CE, and PSA Certified. Deliverables include test automation frameworks and interoperability test suites compatible with DevOps pipelines.

Confidentiality

NDA-first engagements as standard. No cross-client disclosure. Associates brought in for a specific engagement are not briefed on unrelated client work. Compartmentalisation is structural, not policy-dependent.

[ 0x09: FIELD_NOTES ]

Engineering notes

user@lab:~$ ls -t ~/blog | head -3

Constant-time isn't enough: why WPA3-SAE had to abandon Hunting-and-Pecking for Hash-to-Element Jul 24, 2026 WPA3-SAE turns your password into an elliptic-curve point, and the old Hunting-and-Pecking method leaked it through timing. Padding the loop didn't fix it — and neither does SSWU alone. A deep look at constant-time crypto as a property of the silicon: why the leak channel changes across Cortex-M, Cortex-A and x86, why DIT/DOITM and your compiler matter, and how you'd actually measure it.
- Wi-Fi
- Security
Three Ways to Fake Wi-Fi, One Merged: Zephyr's New hwsim Jul 19, 2026 Linux has had mac80211_hwsim for years; Zephyr had nothing like it — you couldn't test the Wi-Fi supplicant without a radio on the bench. Three different fixes landed on the table at once; an RFC and a Wi-Fi telco sorted out which does what, and I built and merged the in-process one: N virtual radios in a single image, running real WPA2 and WPA3 handshakes with zero hardware. Here's the design call, the one problem that makes it hard on Zephyr specifically, and the war story of getting SAE green.
Same Bug, Two Models: One Wasted a Day, One Found the Silicon Limit Jul 15, 2026 Two real nRF Wi-Fi bugs debugged with AI agents. On the same bug, a cheap model burned a day on confident fiction while a frontier model found a hardware limit in minutes — and a fix that passed on the board was still wrong. A field report on model choice, the symptom lying about its layer, and the instruments — sniffer, profiler, bisect — that actually settle it.

view all field notes →