diff --git a/src/port/stm32f4/stm32f4_eth.c b/src/port/stm32f4/stm32f4_eth.c
new file mode 100644
index 00000000..e2edbc7d
--- /dev/null
+++ b/src/port/stm32f4/stm32f4_eth.c
@@ -0,0 +1,637 @@
+/* stm32f4_eth.c
+ *
+ * STM32F4xx Ethernet driver for wolfIP.
+ *
+ * Targets the Synopsys DWC GMAC (legacy 16-byte descriptors, ATDS=0)
+ * found on STM32F407/F417/F427/F437/F439/F469/F479.  The descriptor
+ * layout for these MAC variants differs from the EQOS used on STM32H5
+ * /H7/N6 (see src/port/stm32/stm32_eth.c) and also from the legacy
+ * GMAC variant on the Vorago VA416xx (which uses control bits in
+ * TDES1).  On STM32F4 the control bits live in TDES0.
+ *
+ * Copyright (C) 2026 wolfSSL Inc.
+ *
+ * This file is part of wolfIP TCP/IP stack.
+ *
+ * wolfIP is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * wolfIP is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+ */
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+#include "config.h"
+#include "stm32f4_eth.h"
+
+/* Define DEBUG_ETH to enable verbose hardware diagnostic output. */
+#ifdef DEBUG_ETH
+#define ETH_DEBUG(...) printf(__VA_ARGS__)
+#else
+#define ETH_DEBUG(...) do { } while (0)
+#endif
+
+/* HAL_time_ms (declared in stm32f4_eth.h) is the SysTick-driven millisecond
+ * tick maintained by the board port.  Use stm32f4_hal_time_ms() to read it
+ * tear-free. */
+
+/* HCLK frequency provided by the board port (used to pick MDIO divider). */
+extern uint32_t stm32f4_eth_hclk_hz(void);
+
+/* PHY address.  Must be set by the board port (via -DSTM32F4_ETH_PHY_ADDR
+ * in CFLAGS) to match the strap pins on the attached PHY.  Common values:
+ * 0 = LAN8742A on NUCLEO-F439ZI, 1 = DP83848 on STM32439I-EVAL. */
+#ifndef STM32F4_ETH_PHY_ADDR
+#define STM32F4_ETH_PHY_ADDR  1U
+#endif
+
+/* ===================================================================== */
+/* Register layout                                                       */
+/* ===================================================================== */
+
+#define ETH_BASE        0x40028000UL
+
+#define ETH_REG(off)    (*(volatile uint32_t *)(ETH_BASE + (off)))
+
+/* MAC registers */
+#define ETH_MACCR       ETH_REG(0x0000U)
+#define ETH_MACFFR      ETH_REG(0x0004U)
+#define ETH_MACMIIAR    ETH_REG(0x0010U)
+#define ETH_MACMIIDR    ETH_REG(0x0014U)
+#define ETH_MACDBGR     ETH_REG(0x0024U)
+#define ETH_MACA0HR     ETH_REG(0x0040U)
+#define ETH_MACA0LR     ETH_REG(0x0044U)
+
+/* DMA registers */
+#define ETH_DMABMR      ETH_REG(0x1000U)
+#define ETH_DMATPDR     ETH_REG(0x1004U)
+#define ETH_DMARPDR     ETH_REG(0x1008U)
+#define ETH_DMARDLAR    ETH_REG(0x100CU)
+#define ETH_DMATDLAR    ETH_REG(0x1010U)
+#define ETH_DMASR       ETH_REG(0x1014U)
+#define ETH_DMAOMR      ETH_REG(0x1018U)
+#define ETH_DMAIER      ETH_REG(0x101CU)
+
+/* MACCR bits */
+#define MACCR_RE        (1U << 2)   /* Receiver enable */
+#define MACCR_TE        (1U << 3)   /* Transmitter enable */
+#define MACCR_ACS       (1U << 7)   /* Auto pad/CRC strip */
+#define MACCR_IPCO      (1U << 10)  /* IPv4 checksum offload */
+#define MACCR_DM        (1U << 11)  /* Duplex mode (1=Full) */
+#define MACCR_FES       (1U << 14)  /* Fast Ethernet Speed (1=100M) */
+
+/* MACMIIAR bits */
+#define MACMIIAR_MB     (1U << 0)
+#define MACMIIAR_MW     (1U << 1)
+#define MACMIIAR_CR_POS 2
+#define MACMIIAR_MR_POS 6
+#define MACMIIAR_PA_POS 11
+
+/* DMABMR bits */
+#define DMABMR_SR       (1U << 0)
+#define DMABMR_PBL_POS  8            /* Burst length, bits 13:8 */
+
+/* DMAOMR bits */
+#define DMAOMR_SR       (1U << 1)    /* Start RX */
+#define DMAOMR_OSF      (1U << 2)    /* Operate On Second Frame */
+#define DMAOMR_ST       (1U << 13)   /* Start TX */
+#define DMAOMR_FTF      (1U << 20)   /* Flush TX FIFO */
+#define DMAOMR_TSF      (1U << 21)   /* Transmit Store and Forward */
+#define DMAOMR_RSF      (1U << 25)   /* Receive Store and Forward */
+
+/* DMASR bits we react to (clear-on-write-1) */
+#define DMASR_TBUS      (1U << 2)
+#define DMASR_RBUS      (1U << 7)
+
+/* ===================================================================== */
+/* TX descriptor bits (TDES0)                                            */
+/*                                                                       */
+/* STM32F4 GMAC normal-mode TDES0 holds OWN + frame control + status.    */
+/* CPU sets: OWN | IC | LS | FS | TCH (chain mode).                      */
+/* DMA writes back error/status bits on completion.                      */
+/* ===================================================================== */
+#define TDES0_OWN       (1U << 31)
+#define TDES0_IC        (1U << 30)
+#define TDES0_LS        (1U << 29)
+#define TDES0_FS        (1U << 28)
+#define TDES0_TCH       (1U << 20)
+
+/* TDES1: buffer sizes */
+#define TDES1_TBS1_MASK 0x00001FFFU  /* bits 12:0 */
+
+/* RX descriptor bits */
+#define RDES0_OWN       (1U << 31)
+#define RDES0_FL_SHIFT  16
+#define RDES0_FL_MASK   (0x3FFFU << RDES0_FL_SHIFT)
+#define RDES0_ES        (1U << 15)
+#define RDES0_FS        (1U <<  9)
+#define RDES0_LS        (1U <<  8)
+
+#define RDES1_RER       (1U << 15)
+#define RDES1_RBS1_MASK 0x00001FFFU
+
+/* Generic PHY register set */
+#define PHY_BCR         0x00U
+#define PHY_BSR         0x01U
+#define PHY_ID1         0x02U
+#define PHY_ID2         0x03U
+#define PHY_ANAR        0x04U
+#define PHY_ANLPAR      0x05U
+
+#define BCR_RESET           (1U << 15)
+#define BCR_AUTONEG         (1U << 12)
+#define BCR_RESTART_AN      (1U << 9)
+
+#define BSR_LINK            (1U << 2)
+#define BSR_AN_COMPLETE     (1U << 5)
+
+#define ANAR_100_FD         (1U << 8)
+#define ANAR_100_HD         (1U << 7)
+#define ANAR_10_FD          (1U << 6)
+#define ANAR_10_HD          (1U << 5)
+#define ANAR_SELECTOR_802_3 0x01U
+
+/* ===================================================================== */
+/* Descriptor + buffer storage                                            */
+/*                                                                       */
+/* The STM32F4 Ethernet DMA can access main SRAM (0x20000000) but not    */
+/* CCM data RAM (0x10000000).  The linker places .bss in main SRAM by   */
+/* default, so plain static placement is fine here -- no special section */
+/* attribute is required.  We over-align to 32 bytes for cleanliness    */
+/* (matches HAL ETH driver) and to ensure burst-aligned DMA bursts.     */
+/* ===================================================================== */
+
+#define RX_DESC_COUNT   4U
+#define TX_DESC_COUNT   3U
+#define RX_BUF_SIZE     LINK_MTU
+#define TX_BUF_SIZE     LINK_MTU
+#define FRAME_MIN_LEN   60U
+
+struct eth_desc {
+    volatile uint32_t des0;
+    volatile uint32_t des1;
+    volatile uint32_t des2;
+    volatile uint32_t des3;
+};
+
+static struct eth_desc rx_ring[RX_DESC_COUNT] __attribute__((aligned(32)));
+static struct eth_desc tx_ring[TX_DESC_COUNT] __attribute__((aligned(32)));
+static uint8_t rx_buffers[RX_DESC_COUNT][RX_BUF_SIZE] __attribute__((aligned(4)));
+static uint8_t tx_buffers[TX_DESC_COUNT][TX_BUF_SIZE] __attribute__((aligned(4)));
+
+static uint32_t rx_idx;
+static uint32_t tx_idx;
+
+static uint32_t rx_poll_count;
+static uint32_t rx_pkt_count;
+static uint32_t tx_pkt_count;
+static uint32_t tx_err_count;
+
+/* ===================================================================== */
+/* MDIO                                                                  */
+/* ===================================================================== */
+
+static uint32_t mdio_cr_for_hclk(uint32_t hz)
+{
+    /* CR field encoding for STM32F4 GMAC (RM0090 sec 33.6.7) */
+    if      (hz <  35000000U) return 2U; /* HCLK 20-35   -> /16 */
+    else if (hz <  60000000U) return 3U; /* HCLK 35-60   -> /26 */
+    else if (hz < 100000000U) return 0U; /* HCLK 60-100  -> /42 */
+    else if (hz < 150000000U) return 1U; /* HCLK 100-150 -> /62 */
+    else                       return 4U; /* HCLK 150-168 -> /102 */
+}
+
+static int mdio_wait_idle(void)
+{
+    uint32_t timeout = 100000U;
+    while ((ETH_MACMIIAR & MACMIIAR_MB) && (timeout > 0U)) {
+        timeout--;
+    }
+    return (timeout > 0U) ? 0 : -1;
+}
+
+static uint16_t mdio_read(uint32_t phy, uint32_t reg)
+{
+    uint32_t cr;
+
+    if (mdio_wait_idle() != 0)
+        return 0xFFFFU;
+
+    cr = mdio_cr_for_hclk(stm32f4_eth_hclk_hz());
+
+    ETH_MACMIIAR = ((phy & 0x1FU) << MACMIIAR_PA_POS) |
+                   ((reg & 0x1FU) << MACMIIAR_MR_POS) |
+                   ((cr  & 0x07U) << MACMIIAR_CR_POS) |
+                   MACMIIAR_MB;
+
+    if (mdio_wait_idle() != 0)
+        return 0xFFFFU;
+
+    return (uint16_t)(ETH_MACMIIDR & 0xFFFFU);
+}
+
+static int mdio_write(uint32_t phy, uint32_t reg, uint16_t value)
+{
+    uint32_t cr;
+
+    if (mdio_wait_idle() != 0)
+        return -1;
+
+    cr = mdio_cr_for_hclk(stm32f4_eth_hclk_hz());
+
+    ETH_MACMIIDR = value;
+    ETH_MACMIIAR = ((phy & 0x1FU) << MACMIIAR_PA_POS) |
+                   ((reg & 0x1FU) << MACMIIAR_MR_POS) |
+                   ((cr  & 0x07U) << MACMIIAR_CR_POS) |
+                   MACMIIAR_MW |
+                   MACMIIAR_MB;
+
+    return mdio_wait_idle();
+}
+
+/* ===================================================================== */
+/* Hardware reset / MAC config                                            */
+/* ===================================================================== */
+
+static int eth_hw_reset(void)
+{
+    uint32_t timeout = 1000000U;
+
+    ETH_DMABMR |= DMABMR_SR;
+    while ((ETH_DMABMR & DMABMR_SR) && (timeout > 0U)) {
+        timeout--;
+    }
+    return (timeout > 0U) ? 0 : -1;
+}
+
+static void eth_config_mac(const uint8_t *mac)
+{
+    /* MAC address in MACA0HR/MACA0LR.  MACA0HR bit 31 must be set. */
+    ETH_MACA0HR = ((uint32_t)mac[5] << 8) | (uint32_t)mac[4] | 0x80000000U;
+    ETH_MACA0LR = ((uint32_t)mac[3] << 24) | ((uint32_t)mac[2] << 16) |
+                  ((uint32_t)mac[1] <<  8) |  (uint32_t)mac[0];
+
+    /* Initial MACCR: ACS + IPCO + DM.  FES is filled in later by
+     * eth_config_speed_duplex() from PHY auto-neg result.  STM32F4 GMAC has
+     * no PS bit (no GMII support). */
+    ETH_MACCR = MACCR_ACS | MACCR_IPCO | MACCR_DM;
+
+    /* Perfect filter, broadcast allowed (DBF=0). */
+#ifdef DEBUG_ETH
+    ETH_MACFFR = (1U << 0); /* PR=1 promiscuous for diag */
+#else
+    ETH_MACFFR = 0U;
+#endif
+}
+
+static void eth_config_speed_duplex(void)
+{
+    uint32_t maccr;
+    uint16_t adv, lpa;
+    uint16_t common;
+    int full_duplex, speed_100;
+
+    adv = mdio_read(STM32F4_ETH_PHY_ADDR, PHY_ANAR);
+    lpa = mdio_read(STM32F4_ETH_PHY_ADDR, PHY_ANLPAR);
+    common = adv & lpa;
+
+    if (common & ANAR_100_FD) {
+        full_duplex = 1;
+        speed_100   = 1;
+    } else if (common & ANAR_100_HD) {
+        full_duplex = 0;
+        speed_100   = 1;
+    } else if (common & ANAR_10_FD) {
+        full_duplex = 1;
+        speed_100   = 0;
+    } else {
+        /* Includes 10-HD or no overlap (default to 10-HD). */
+        full_duplex = 0;
+        speed_100   = 0;
+    }
+
+    ETH_DEBUG("  PHY AN_ADV=0x%04X AN_LPA=0x%04X common=0x%04X -> %s %s\n",
+              adv, lpa, common,
+              speed_100   ? "100M" : "10M",
+              full_duplex ? "FD"   : "HD");
+
+    maccr = MACCR_ACS | MACCR_IPCO;
+    if (full_duplex) maccr |= MACCR_DM;
+    if (speed_100)   maccr |= MACCR_FES;
+
+    ETH_MACCR = maccr;
+}
+
+/* ===================================================================== */
+/* DMA config + descriptor init                                           */
+/* ===================================================================== */
+
+static void eth_config_dma(void)
+{
+    /* DMA bus mode: PBL=32, no fixed burst.  ATDS=0 (16-byte legacy
+     * descriptors).  DA=0 (round-robin TX/RX). */
+    ETH_DMABMR = (32U << DMABMR_PBL_POS);
+
+    /* Op mode: RX store-and-forward, TX store-and-forward, OSF on. */
+    ETH_DMAOMR = DMAOMR_RSF | DMAOMR_TSF | DMAOMR_OSF;
+
+    /* Polling mode -- disable DMA interrupts. */
+    ETH_DMAIER = 0U;
+}
+
+static void eth_init_desc(void)
+{
+    uint32_t i;
+
+    /* TX ring: chain mode (TCH=1).  des3 = next descriptor pointer; last
+     * wraps to first.  TER is unused -- the DMA always follows des3 in
+     * chain mode.  CPU owns initially (OWN=0). */
+    for (i = 0; i < TX_DESC_COUNT; i++) {
+        tx_ring[i].des0 = TDES0_TCH;     /* TCH set permanently */
+        tx_ring[i].des1 = 0U;
+        tx_ring[i].des2 = (uint32_t)tx_buffers[i];
+        tx_ring[i].des3 = (uint32_t)&tx_ring[(i + 1U) % TX_DESC_COUNT];
+    }
+
+    /* RX ring: ring mode with RER on last descriptor.  DMA owns all
+     * (OWN=1). */
+    for (i = 0; i < RX_DESC_COUNT; i++) {
+        rx_ring[i].des0 = RDES0_OWN;
+        rx_ring[i].des1 = (RX_BUF_SIZE & RDES1_RBS1_MASK);
+        rx_ring[i].des2 = (uint32_t)rx_buffers[i];
+        rx_ring[i].des3 = 0U;
+    }
+    rx_ring[RX_DESC_COUNT - 1U].des1 |= RDES1_RER;
+
+    rx_idx = 0U;
+    tx_idx = 0U;
+
+    __asm volatile ("dsb sy" ::: "memory");
+
+    ETH_DMARDLAR = (uint32_t)&rx_ring[0];
+    ETH_DMATDLAR = (uint32_t)&tx_ring[0];
+
+    __asm volatile ("dsb sy" ::: "memory");
+}
+
+/* ===================================================================== */
+/* PHY init                                                              */
+/* ===================================================================== */
+
+static int eth_phy_init(void)
+{
+    uint16_t id1, id2;
+    uint16_t bmcr, bsr;
+    uint16_t adv;
+    uint64_t deadline;
+
+    id1 = mdio_read(STM32F4_ETH_PHY_ADDR, PHY_ID1);
+    id2 = mdio_read(STM32F4_ETH_PHY_ADDR, PHY_ID2);
+    if (id1 == 0xFFFFU || (id1 == 0U && id2 == 0U)) {
+        printf("  PHY: not found at addr %u (ID1=0x%04X ID2=0x%04X)\n",
+               (unsigned)STM32F4_ETH_PHY_ADDR, id1, id2);
+        return -1;
+    }
+    printf("  PHY ID at addr %u: 0x%04X / 0x%04X\n",
+           (unsigned)STM32F4_ETH_PHY_ADDR, id1, id2);
+
+    /* Soft reset and wait. */
+    (void)mdio_write(STM32F4_ETH_PHY_ADDR, PHY_BCR, BCR_RESET);
+    deadline = stm32f4_hal_time_ms() + 500U;
+    do {
+        bmcr = mdio_read(STM32F4_ETH_PHY_ADDR, PHY_BCR);
+    } while ((bmcr & BCR_RESET) && (stm32f4_hal_time_ms() < deadline));
+    if (bmcr & BCR_RESET) {
+        printf("  PHY: reset did not clear\n");
+        return -1;
+    }
+
+    /* Advertise full set of 10/100 capabilities. */
+    adv = ANAR_100_FD | ANAR_100_HD | ANAR_10_FD | ANAR_10_HD |
+          ANAR_SELECTOR_802_3;
+    (void)mdio_write(STM32F4_ETH_PHY_ADDR, PHY_ANAR, adv);
+
+    /* Enable + restart auto-neg. */
+    (void)mdio_write(STM32F4_ETH_PHY_ADDR, PHY_BCR,
+                     BCR_AUTONEG | BCR_RESTART_AN);
+
+    /* Wait up to 5s for link up + AN complete. */
+    deadline = stm32f4_hal_time_ms() + 5000U;
+    do {
+        bsr = mdio_read(STM32F4_ETH_PHY_ADDR, PHY_BSR);
+        bsr = mdio_read(STM32F4_ETH_PHY_ADDR, PHY_BSR); /* latch-clear */
+    } while (((bsr & (BSR_LINK | BSR_AN_COMPLETE)) !=
+              (BSR_LINK | BSR_AN_COMPLETE)) &&
+             (stm32f4_hal_time_ms() < deadline));
+
+    printf("  PHY link: %s, AN: %s\n",
+           (bsr & BSR_LINK) ? "UP" : "DOWN",
+           (bsr & BSR_AN_COMPLETE) ? "complete" : "incomplete");
+
+    return (bsr & BSR_LINK) ? 0 : -2;
+}
+
+/* ===================================================================== */
+/* Start / stop                                                          */
+/* ===================================================================== */
+
+static void eth_start(void)
+{
+    /* Enable MAC TX and RX. */
+    ETH_MACCR |= MACCR_TE | MACCR_RE;
+
+    /* Small settle for FIFO controllers. */
+    { volatile uint32_t d; for (d = 0; d < 10000U; d++) { } }
+
+    /* Flush TX FIFO before starting DMA TX (matches u-boot DWC reference). */
+    ETH_DMAOMR |= DMAOMR_FTF;
+    {
+        uint32_t t = 100000U;
+        while ((ETH_DMAOMR & DMAOMR_FTF) && (t > 0U)) {
+            t--;
+        }
+    }
+
+    /* Start DMA RX + TX. */
+    ETH_DMAOMR |= DMAOMR_SR | DMAOMR_ST;
+
+    __asm volatile ("dsb sy" ::: "memory");
+
+    /* Kick RX. */
+    ETH_DMARPDR = 0U;
+}
+
+static void eth_stop(void)
+{
+    ETH_DMAOMR &= ~(DMAOMR_SR | DMAOMR_ST);
+    ETH_MACCR  &= ~(MACCR_RE | MACCR_TE);
+}
+
+/* ===================================================================== */
+/* RX poll / TX send                                                      */
+/* ===================================================================== */
+
+static int eth_poll(struct wolfIP_ll_dev *dev, void *frame, uint32_t len)
+{
+    struct eth_desc *desc;
+    uint32_t status;
+    uint32_t frame_len = 0U;
+
+    (void)dev;
+    rx_poll_count++;
+
+    desc = &rx_ring[rx_idx];
+    if (desc->des0 & RDES0_OWN)
+        return 0;
+
+    rx_pkt_count++;
+    status = desc->des0;
+
+    if (((status & (RDES0_FS | RDES0_LS)) == (RDES0_FS | RDES0_LS)) &&
+        !(status & RDES0_ES)) {
+        frame_len = (status & RDES0_FL_MASK) >> RDES0_FL_SHIFT;
+        if (frame_len > len)
+            frame_len = len;
+        memcpy(frame, rx_buffers[rx_idx], frame_len);
+    }
+
+    /* Re-arm. */
+    desc->des0 = RDES0_OWN;
+    desc->des1 = (RX_BUF_SIZE & RDES1_RBS1_MASK);
+    if (rx_idx == (RX_DESC_COUNT - 1U))
+        desc->des1 |= RDES1_RER;
+
+    __asm volatile ("dsb sy" ::: "memory");
+
+    /* Clear RBUS if set, then kick RX. */
+    if (ETH_DMASR & DMASR_RBUS)
+        ETH_DMASR = DMASR_RBUS;
+    ETH_DMARPDR = 0U;
+
+    rx_idx = (rx_idx + 1U) % RX_DESC_COUNT;
+    return (int)frame_len;
+}
+
+static int eth_send(struct wolfIP_ll_dev *dev, void *frame, uint32_t len)
+{
+    struct eth_desc *desc;
+    uint32_t dma_len;
+
+    (void)dev;
+    if (len == 0U || len > TX_BUF_SIZE) {
+        tx_err_count++;
+        return -1;
+    }
+
+    desc = &tx_ring[tx_idx];
+    if (desc->des0 & TDES0_OWN) {
+        tx_err_count++;
+        return -2;
+    }
+
+    tx_pkt_count++;
+
+    memcpy(tx_buffers[tx_idx], frame, len);
+    dma_len = (len < FRAME_MIN_LEN) ? FRAME_MIN_LEN : len;
+    if (dma_len > len)
+        memset(tx_buffers[tx_idx] + len, 0, dma_len - len);
+
+    desc->des2 = (uint32_t)tx_buffers[tx_idx];
+    desc->des1 = (dma_len & TDES1_TBS1_MASK);
+
+    __asm volatile ("dsb sy" ::: "memory");
+
+    /* On STM32F4 GMAC, frame control (FS/LS/IC/TCH) lives in TDES0
+     * alongside the OWN doorbell.  Write everything together; the DMA
+     * latches the bits after OWN flips to 1. */
+    desc->des0 = TDES0_OWN | TDES0_IC | TDES0_LS | TDES0_FS | TDES0_TCH;
+
+    __asm volatile ("dsb sy" ::: "memory");
+
+    /* Clear TBUS if set, then kick TX. */
+    if (ETH_DMASR & DMASR_TBUS)
+        ETH_DMASR = DMASR_TBUS;
+    ETH_DMATPDR = 0U;
+
+    tx_idx = (tx_idx + 1U) % TX_DESC_COUNT;
+    return (int)len;
+}
+
+/* ===================================================================== */
+/* Public                                                                */
+/* ===================================================================== */
+
+static void stm32f4_eth_default_mac(uint8_t mac[6])
+{
+    mac[0] = 0x02; /* locally administered */
+    mac[1] = 0x55;
+    mac[2] = 0xAA;
+    mac[3] = 0xBB;
+    mac[4] = 0xF4; /* 'F4' family */
+    mac[5] = 0x37; /* '37' */
+}
+
+void stm32f4_eth_get_stats(uint32_t *polls, uint32_t *pkts, uint32_t *tx_pkts,
+                           uint32_t *tx_errs)
+{
+    if (polls)    *polls    = rx_poll_count;
+    if (pkts)     *pkts     = rx_pkt_count;
+    if (tx_pkts)  *tx_pkts  = tx_pkt_count;
+    if (tx_errs)  *tx_errs  = tx_err_count;
+}
+
+uint32_t stm32f4_eth_get_dma_status(void)
+{
+    return ETH_DMASR;
+}
+
+void stm32f4_eth_get_mac_diag(uint32_t *mac_cfg, uint32_t *mac_dbg)
+{
+    if (mac_cfg) *mac_cfg = ETH_MACCR;
+    if (mac_dbg) *mac_dbg = ETH_MACDBGR;
+}
+
+int stm32f4_eth_init(struct wolfIP_ll_dev *ll, const uint8_t *mac)
+{
+    uint8_t local_mac[6];
+    int ret;
+
+    if (ll == NULL)
+        return -1;
+
+    if (mac == NULL) {
+        stm32f4_eth_default_mac(local_mac);
+        mac = local_mac;
+    }
+
+    memcpy(ll->mac, mac, 6);
+    strncpy(ll->ifname, "eth0", sizeof(ll->ifname) - 1);
+    ll->ifname[sizeof(ll->ifname) - 1] = '\0';
+    ll->poll = eth_poll;
+    ll->send = eth_send;
+
+    eth_stop();
+
+    if (eth_hw_reset() != 0)
+        return -1;
+
+    eth_config_dma();
+    eth_init_desc();
+    eth_config_mac(mac);
+
+    ret = eth_phy_init();
+
+    eth_config_speed_duplex();
+    eth_start();
+
+    return ret;
+}
diff --git a/src/port/stm32f4/stm32f4_eth.h b/src/port/stm32f4/stm32f4_eth.h
new file mode 100644
index 00000000..79cb45c5
--- /dev/null
+++ b/src/port/stm32f4/stm32f4_eth.h
@@ -0,0 +1,63 @@
+/* stm32f4_eth.h
+ *
+ * Shared Ethernet driver for STM32F4xx (DWC GMAC legacy v1 descriptors).
+ * Used by STM32F407/F417/F427/F437/F439/F469/F479 wolfIP ports.
+ *
+ * Copyright (C) 2026 wolfSSL Inc.
+ *
+ * This file is part of wolfIP TCP/IP stack.
+ *
+ * wolfIP is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * wolfIP is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+ */
+#ifndef WOLFIP_STM32F4_ETH_H
+#define WOLFIP_STM32F4_ETH_H
+
+#include <stdint.h>
+#include "wolfip.h"
+
+/* Millisecond tick counter, maintained by SysTick_Handler in the port's
+ * main.c.  Reads on Cortex-M4 are non-atomic (LDRD is interruptible), so
+ * always read it through stm32f4_hal_time_ms() below to avoid tearing. */
+extern volatile uint64_t HAL_time_ms;
+
+/* Tear-free read of HAL_time_ms.  Lamport double-read: in the worst case a
+ * SysTick fires between the two halves and a/b disagree, so re-read. */
+static inline uint64_t stm32f4_hal_time_ms(void)
+{
+    uint64_t a, b;
+    do {
+        a = HAL_time_ms;
+        b = HAL_time_ms;
+    } while (a != b);
+    return b;
+}
+
+/* Initialize the STM32F4 Ethernet MAC + DMA + PHY and hook the driver into
+ * the wolfIP link-layer device.  PHY auto-negotiation is run synchronously
+ * with a 5-second timeout.  Returns 0 on success, -2 if the PHY is reachable
+ * but link did not come up (MAC/DMA still left running so a late link comes
+ * up naturally), or -1 on a fatal init error.
+ *
+ * The caller must already have configured the RCC (ETHMAC/ETHMACTX/ETHMACRX
+ * clocks), SYSCFG_PMC.MII_RMII_SEL, and the RMII GPIO pinmux before calling.
+ */
+int stm32f4_eth_init(struct wolfIP_ll_dev *ll, const uint8_t *mac);
+
+void stm32f4_eth_get_stats(uint32_t *polls, uint32_t *pkts, uint32_t *tx_pkts,
+                           uint32_t *tx_errs);
+uint32_t stm32f4_eth_get_dma_status(void);
+void stm32f4_eth_get_mac_diag(uint32_t *mac_cfg, uint32_t *mac_dbg);
+
+#endif /* WOLFIP_STM32F4_ETH_H */
diff --git a/src/port/stm32f439/Makefile b/src/port/stm32f439/Makefile
new file mode 100644
index 00000000..4c884feb
--- /dev/null
+++ b/src/port/stm32f439/Makefile
@@ -0,0 +1,111 @@
+CC      ?= arm-none-eabi-gcc
+OBJCOPY ?= arm-none-eabi-objcopy
+SIZE    ?= arm-none-eabi-size
+
+ROOT := ../../..
+
+# Cortex-M4F with FPU (hardware float, single-precision).  Both NUCLEO-F439ZI
+# and STM32439I-EVAL ship STM32F437/F439 silicon with the same FPU.
+CFLAGS := -mcpu=cortex-m4 -mthumb -mfpu=fpv4-sp-d16 -mfloat-abi=hard
+CFLAGS += -Os -ffreestanding -fdata-sections -ffunction-sections
+CFLAGS += -g -ggdb -Wall -Wextra -Werror
+
+# Include paths
+CFLAGS += -I. -I$(ROOT) -I$(ROOT)/src -I$(ROOT)/src/port/stm32f4
+
+# Board selection.  Both supported boards use STM32F437/F439 silicon (same
+# DWC GMAC + same register layout) but differ in PHY addr, UART pinmux,
+# HSE source, and RMII TXD1 pin.  Set BOARD on the make command line:
+#   BOARD=nucleo_f439zi    NUCLEO-F439ZI dev board (LAN8742A, USART3, HSE 8MHz bypass)
+#   BOARD=stm32439i_eval   STM32439I-EVAL eval board (DP83848, UART4, HSE 25MHz crystal)
+BOARD ?= nucleo_f439zi
+
+ifeq ($(BOARD),nucleo_f439zi)
+  CFLAGS += -DBOARD_NUCLEO_F439ZI -DSTM32F4_ETH_PHY_ADDR=0
+else ifeq ($(BOARD),stm32439i_eval)
+  CFLAGS += -DBOARD_STM32439I_EVAL -DSTM32F4_ETH_PHY_ADDR=1
+else
+  $(error Unknown BOARD '$(BOARD)' - use nucleo_f439zi or stm32439i_eval)
+endif
+
+EXTRA_CFLAGS ?=
+CFLAGS += $(EXTRA_CFLAGS)
+
+# Relaxed warnings for wolfIP core (some unused-param noise on small builds)
+CFLAGS_EXT := $(filter-out -Werror,$(CFLAGS))
+CFLAGS_EXT += -Wno-unused-variable -Wno-unused-function -Wno-unused-parameter
+
+LDFLAGS := -nostdlib -T target.ld -Wl,-gc-sections
+
+# Application sources (strict warnings)
+APP_SRCS := startup.c ivt.c syscalls.c main.c \
+            $(ROOT)/src/port/stm32f4/stm32f4_eth.c
+APP_OBJS := startup.o ivt.o syscalls.o main.o stm32f4_eth.o
+
+# wolfIP core (relaxed warnings)
+WOLFIP_OBJ := wolfip.o
+
+ALL_OBJS := $(APP_OBJS) $(WOLFIP_OBJ)
+
+all: app.bin
+	@echo "Built STM32F439 wolfIP port (BOARD=$(BOARD))"
+	@$(SIZE) app.elf
+
+app.elf: $(ALL_OBJS) target.ld
+	$(CC) $(CFLAGS) $(ALL_OBJS) $(LDFLAGS) \
+	    -Wl,--start-group -lc -lm -lgcc -lnosys -Wl,--end-group -o $@
+
+app.bin: app.elf
+	$(OBJCOPY) -O binary $< $@
+
+# Local sources -- strict warnings
+startup.o: startup.c
+	$(CC) $(CFLAGS) -c $< -o $@
+ivt.o: ivt.c
+	$(CC) $(CFLAGS) -c $< -o $@
+syscalls.o: syscalls.c
+	$(CC) $(CFLAGS) -c $< -o $@
+main.o: main.c
+	$(CC) $(CFLAGS) -c $< -o $@
+
+# Shared F4 ETH driver (strict warnings)
+stm32f4_eth.o: $(ROOT)/src/port/stm32f4/stm32f4_eth.c
+	$(CC) $(CFLAGS) -c $< -o $@
+
+# wolfIP core (relaxed warnings)
+$(WOLFIP_OBJ): $(ROOT)/src/wolfip.c
+	$(CC) $(CFLAGS_EXT) -c $< -o $@
+
+clean:
+	rm -f *.o app.elf app.bin
+
+# Show memory usage
+size: app.elf
+	@echo "=== Memory Usage ==="
+	@$(SIZE) app.elf
+	@echo ""
+	@echo "Flash usage: $$($(SIZE) app.elf | awk 'NR==2{printf "%.2f%% (%d / %d bytes)", ($$1+$$2)*100/2097152, $$1+$$2, 2097152}')"
+	@echo "RAM usage (static): $$($(SIZE) app.elf | awk 'NR==2{printf "%.2f%% (%d / %d bytes)", ($$2+$$3)*100/196608, $$2+$$3, 196608}')"
+
+.PHONY: all clean size help
+
+help:
+	@echo "STM32F439 wolfIP Build System (supports F437/F439 silicon)"
+	@echo ""
+	@echo "Usage: make [target] [options]"
+	@echo ""
+	@echo "Targets:"
+	@echo "  all      Build app.bin (default)"
+	@echo "  clean    Remove build artifacts"
+	@echo "  size     Show memory usage statistics"
+	@echo "  help     Show this help"
+	@echo ""
+	@echo "Options:"
+	@echo "  BOARD=nucleo_f439zi        NUCLEO-F439ZI (default; LAN8742A, USART3, HSE 8MHz bypass)"
+	@echo "  BOARD=stm32439i_eval       STM32439I-EVAL (DP83848, UART4, HSE 25MHz crystal)"
+	@echo "  EXTRA_CFLAGS=-DDEBUG_ETH   Verbose ETH driver diagnostics"
+	@echo "  CC=                        C compiler (default: arm-none-eabi-gcc)"
+	@echo ""
+	@echo "Testing:"
+	@echo "  ping <ip>                  # ICMP ping"
+	@echo "  echo 'hello' | nc <ip> 7   # TCP echo"
diff --git a/src/port/stm32f439/README.md b/src/port/stm32f439/README.md
new file mode 100644
index 00000000..43773753
--- /dev/null
+++ b/src/port/stm32f439/README.md
@@ -0,0 +1,130 @@
+# wolfIP on STM32F437/F439
+
+Bare-metal wolfIP port for STMicro STM32F437/F439 silicon.  Supports two
+boards from one source tree, selected at compile time via `BOARD=`:
+
+| Board            | MCU          | PHY       | VCP UART               | HSE                        | RMII TXD1 |
+|------------------|--------------|-----------|------------------------|----------------------------|-----------|
+| `nucleo_f439zi`  | STM32F439ZIT | LAN8742A  | USART3 (PD8/PD9, AF7)  | 8 MHz BYPASS (ST-LINK MCO) | PB13      |
+| `stm32439i_eval` | STM32F437IIH | DP83848   | UART4 (PC10/PC11, AF8) | 25 MHz crystal             | PG14      |
+
+Brings up Ethernet (RMII), runs DHCP, and exposes a TCP echo server on
+port 7 plus ICMP ping.
+
+**Status:** `nucleo_f439zi` has been booted end-to-end on hardware (no
+cable -- clocks/UART/MAC/MDIO/PHY-ID verified; link-up + DHCP path not
+yet exercised).  `stm32439i_eval` is compile-tested only; the build
+artifact has not yet been validated on the STM32439I-EVAL hardware.
+
+## Hardware
+
+- MCU: Cortex-M4F @ 168 MHz, 2 MB flash, 256 KB RAM (192 KB main SRAM +
+  64 KB CCM; this port keeps everything in main SRAM since the GMAC DMA
+  cannot reach CCM).
+- Clock: HSE -> PLL -> SYSCLK 168 MHz, HCLK 168 MHz, PCLK1 42 MHz,
+  PCLK2 84 MHz.  PLL pre-divider differs per board (PLLM=8 for NUCLEO
+  HSE_BYPASS 8 MHz, PLLM=25 for EVAL 25 MHz crystal); the post-divider
+  chain and SYSCLK target are identical.
+- Ethernet: Synopsys DWC GMAC (legacy 16-byte descriptors, ATDS=0) in
+  RMII mode.  Driver in `src/port/stm32f4/`.
+
+## RMII pin map (shared, with the per-board TXD1 noted)
+
+| Signal           | Pin                            | AF  |
+|------------------|--------------------------------|-----|
+| ETH_RMII_REF_CLK | PA1                            | 11  |
+| ETH_MDIO         | PA2                            | 11  |
+| ETH_RMII_CRS_DV  | PA7                            | 11  |
+| ETH_MDC          | PC1                            | 11  |
+| ETH_RMII_RXD0    | PC4                            | 11  |
+| ETH_RMII_RXD1    | PC5                            | 11  |
+| ETH_RMII_TX_EN   | PG11                           | 11  |
+| ETH_RMII_TXD0    | PG13                           | 11  |
+| ETH_RMII_TXD1    | PB13 (NUCLEO) / PG14 (EVAL)    | 11  |
+
+## Build
+
+```
+make clean
+make                          # default: BOARD=nucleo_f439zi
+make BOARD=stm32439i_eval     # for the STM32439I-EVAL
+```
+
+Outputs `app.bin` (raw binary for ST-LINK) and `app.elf` (with debug
+info for GDB / addr2line).
+
+Verbose ETH bring-up diagnostics:
+
+```
+make clean
+make EXTRA_CFLAGS=-DDEBUG_ETH
+```
+
+Memory usage report:
+
+```
+make size
+```
+
+## Flash
+
+Via ST-LINK CLI:
+
+```
+st-flash write app.bin 0x08000000
+```
+
+If multiple ST-LINKs are connected, target a specific probe by serial:
+
+```
+st-flash --serial <ST-LINK-serial> --reset write app.bin 0x08000000
+```
+
+Or via STM32CubeProgrammer with the onboard ST-LINK/V2-1.
+
+## Expected UART output
+
+```
+=== wolfIP STM32F437/F439 (NUCLEO-F439ZI) ===
+Build: <date> <time>
+SYSCLK = 168000000 Hz, HCLK = 168000000 Hz, ...
+Initializing Ethernet (RMII + LAN8742A)...
+  PHY ID at addr 0: 0x0007 / 0xC131
+  PHY link: UP, AN: complete
+Starting DHCP...
+DHCP bound:
+  IP:   <ip>
+  Mask: <mask>
+  GW:   <gw>
+TCP echo server on port 7
+Ready! Test with:
+  ping <ip>
+  echo 'hello' | nc <ip> 7
+```
+
+Every 10 s the main loop prints a diagnostic line with packet counters
+and MAC/DMA register snapshots (useful when the link isn't coming up):
+
+```
+[30] rx=0 tx=3/343030 maccr=0x0000848C macdbg=0x01120000 dmasr=0x00260400
+```
+
+For the EVAL build, the banner shows `STM32439I-EVAL` and `DP83848` /
+PHY addr 1 instead.
+
+## Test
+
+From a host on the same subnet as the device:
+
+```
+ping <ip>
+echo 'hello' | nc <ip> 7
+```
+
+## Out of scope (milestone 1)
+
+- TLS / HTTPS / SSH / MQTT (the H563 port shows the wolfSSL hook-in
+  pattern; can be ported here once basic eth works).
+- wolfBoot / TFTP partition update.
+- FreeRTOS.
+- IRQ-driven RX (this port uses poll mode like the VA416xx milestone-1).
diff --git a/src/port/stm32f439/config.h b/src/port/stm32f439/config.h
new file mode 100644
index 00000000..5efc4929
--- /dev/null
+++ b/src/port/stm32f439/config.h
@@ -0,0 +1,71 @@
+/* config.h
+ *
+ * wolfIP build-time configuration for the STM32F437 port (STM32439I-EVAL).
+ *
+ * Copyright (C) 2026 wolfSSL Inc.
+ *
+ * This file is part of wolfIP TCP/IP stack.
+ *
+ * wolfIP is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * wolfIP is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+ */
+#ifndef WOLF_CONFIG_H
+#define WOLF_CONFIG_H
+
+#ifndef CONFIG_IPFILTER
+#define CONFIG_IPFILTER         0
+#endif
+
+#define ETHERNET
+#define LINK_MTU                1536
+
+/* STM32F437IIHx has 256KB RAM (192KB main SRAM + 64KB CCM).  We have
+ * plenty of room compared to the VA416xx port.  Keep the socket count
+ * modest for milestone-1 bring-up. */
+#define MAX_TCPSOCKETS          2    /* listen + 1 client */
+#define MAX_UDPSOCKETS          1    /* DHCP */
+#define MAX_ICMPSOCKETS         1
+#define RXBUF_SIZE              LINK_MTU
+#define TXBUF_SIZE              LINK_MTU
+
+#define MAX_NEIGHBORS           4
+#define WOLFIP_ARP_PENDING_MAX  2
+
+#ifndef WOLFIP_MAX_INTERFACES
+#define WOLFIP_MAX_INTERFACES   1
+#endif
+
+#ifndef WOLFIP_ENABLE_FORWARDING
+#define WOLFIP_ENABLE_FORWARDING 0
+#endif
+
+#ifndef WOLFIP_ENABLE_LOOPBACK
+#define WOLFIP_ENABLE_LOOPBACK  0
+#endif
+
+#ifndef WOLFIP_ENABLE_DHCP
+#define WOLFIP_ENABLE_DHCP      1
+#endif
+
+/* Static IP fallback (used when DHCP is disabled or times out) */
+#define WOLFIP_IP               "192.168.12.37"
+#define WOLFIP_NETMASK          "255.255.255.0"
+#define WOLFIP_GW               "192.168.12.1"
+#define WOLFIP_STATIC_DNS_IP    "8.8.8.8"
+
+#if WOLFIP_ENABLE_DHCP
+#define DHCP
+#endif
+
+#endif /* WOLF_CONFIG_H */
diff --git a/src/port/stm32f439/ivt.c b/src/port/stm32f439/ivt.c
new file mode 100644
index 00000000..8ac7b434
--- /dev/null
+++ b/src/port/stm32f439/ivt.c
@@ -0,0 +1,65 @@
+/* ivt.c
+ *
+ * STM32F437 Cortex-M4 interrupt vector table.  STM32F437 has 91 external
+ * IRQs (0..90); we round the slot count up to 91 here.  Unused vectors
+ * point at a weak default_handler that loops on hardware fault, which is
+ * sufficient for the wolfIP polling demo (no peripheral IRQs are enabled).
+ *
+ * Copyright (C) 2026 wolfSSL Inc.
+ *
+ * This file is part of wolfIP TCP/IP stack.
+ *
+ * wolfIP is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * wolfIP is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+ */
+#include <stdint.h>
+
+extern void Reset_Handler(void);
+extern unsigned long _estack;
+
+static void default_handler(void)
+{
+    while (1) { }
+}
+
+void NMI_Handler(void)        __attribute__((weak, alias("default_handler")));
+void HardFault_Handler(void)  __attribute__((weak, alias("default_handler")));
+void MemManage_Handler(void)  __attribute__((weak, alias("default_handler")));
+void BusFault_Handler(void)   __attribute__((weak, alias("default_handler")));
+void UsageFault_Handler(void) __attribute__((weak, alias("default_handler")));
+void SVC_Handler(void)        __attribute__((weak, alias("default_handler")));
+void DebugMon_Handler(void)   __attribute__((weak, alias("default_handler")));
+void PendSV_Handler(void)     __attribute__((weak, alias("default_handler")));
+void SysTick_Handler(void)    __attribute__((weak, alias("default_handler")));
+
+__attribute__((section(".isr_vector")))
+const uint32_t vector_table[16 + 91] = {
+    [0]  = (uint32_t)&_estack,
+    [1]  = (uint32_t)&Reset_Handler,
+    [2]  = (uint32_t)&NMI_Handler,
+    [3]  = (uint32_t)&HardFault_Handler,
+    [4]  = (uint32_t)&MemManage_Handler,
+    [5]  = (uint32_t)&BusFault_Handler,
+    [6]  = (uint32_t)&UsageFault_Handler,
+    [7]  = 0,
+    [8]  = 0,
+    [9]  = 0,
+    [10] = 0,
+    [11] = (uint32_t)&SVC_Handler,
+    [12] = (uint32_t)&DebugMon_Handler,
+    [13] = 0,
+    [14] = (uint32_t)&PendSV_Handler,
+    [15] = (uint32_t)&SysTick_Handler,
+    [16 ... 16 + 90] = (uint32_t)&default_handler,
+};
diff --git a/src/port/stm32f439/main.c b/src/port/stm32f439/main.c
new file mode 100644
index 00000000..34f875eb
--- /dev/null
+++ b/src/port/stm32f439/main.c
@@ -0,0 +1,759 @@
+/* main.c
+ *
+ * wolfIP demo on STM32F437/F439.  Same chip family, two boards supported
+ * via the BOARD make variable -- both end up at SYSCLK 168 MHz, PCLK1 42,
+ * PCLK2 84, with the shared DWC GMAC driver in src/port/stm32f4/:
+ *
+ *   BOARD=nucleo_f439zi  (NUCLEO-F439ZI, default)
+ *     - HSE: 8 MHz BYPASS from onboard ST-LINK MCO (no crystal)
+ *     - VCP: USART3 on PD8 (TX) / PD9 (RX), AF7
+ *     - PHY: LAN8742A at MDIO addr 0
+ *     - RMII TXD1 on PB13
+ *
+ *   BOARD=stm32439i_eval  (STM32439I-EVAL)
+ *     - HSE: 25 MHz crystal
+ *     - VCP: UART4 on PC10 (TX) / PC11 (RX), AF8
+ *     - PHY: DP83848 at MDIO addr 1
+ *     - RMII TXD1 on PG14
+ *
+ * Brings up clocks, UART (ST-LINK VCP), SysTick, Ethernet, runs DHCP,
+ * and answers TCP echo on port 7.  Pure register-level init -- no STM32
+ * HAL dependency.
+ *
+ * Copyright (C) 2026 wolfSSL Inc.
+ *
+ * This file is part of wolfIP TCP/IP stack.
+ *
+ * wolfIP is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * wolfIP is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+ */
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+#include "config.h"
+#include "wolfip.h"
+#include "stm32f4_eth.h"
+
+#if !defined(BOARD_NUCLEO_F439ZI) && !defined(BOARD_STM32439I_EVAL)
+#error "Define BOARD_NUCLEO_F439ZI or BOARD_STM32439I_EVAL (set BOARD= in make)"
+#endif
+
+#if defined(BOARD_NUCLEO_F439ZI)
+#define BOARD_NAME "NUCLEO-F439ZI"
+#define PHY_NAME   "LAN8742A"
+#else
+#define BOARD_NAME "STM32439I-EVAL"
+#define PHY_NAME   "DP83848"
+#endif
+
+/* ===================================================================== */
+/* Register definitions                                                  */
+/* ===================================================================== */
+
+#define RCC_BASE        0x40023800UL
+#define RCC_CR          (*(volatile uint32_t *)(RCC_BASE + 0x00U))
+#define RCC_PLLCFGR     (*(volatile uint32_t *)(RCC_BASE + 0x04U))
+#define RCC_CFGR        (*(volatile uint32_t *)(RCC_BASE + 0x08U))
+#define RCC_AHB1ENR     (*(volatile uint32_t *)(RCC_BASE + 0x30U))
+#define RCC_AHB2ENR     (*(volatile uint32_t *)(RCC_BASE + 0x34U))
+#define RCC_APB1ENR     (*(volatile uint32_t *)(RCC_BASE + 0x40U))
+#define RCC_APB2ENR     (*(volatile uint32_t *)(RCC_BASE + 0x44U))
+#define RCC_AHB1RSTR    (*(volatile uint32_t *)(RCC_BASE + 0x10U))
+
+#define RCC_AHB2ENR_RNGEN (1U << 6)
+
+/* Hardware RNG (RM0090 sec 24).  Clocked from PLL48CLK = 48 MHz (PLLQ=7). */
+#define RNG_BASE        0x50060800UL
+#define RNG_CR          (*(volatile uint32_t *)(RNG_BASE + 0x00U))
+#define RNG_SR          (*(volatile uint32_t *)(RNG_BASE + 0x04U))
+#define RNG_DR          (*(volatile uint32_t *)(RNG_BASE + 0x08U))
+#define RNG_CR_RNGEN    (1U << 2)
+#define RNG_SR_DRDY     (1U << 0)
+#define RNG_SR_CECS     (1U << 1)
+#define RNG_SR_SECS     (1U << 2)
+#define RNG_SR_CEIS     (1U << 5)
+#define RNG_SR_SEIS     (1U << 6)
+
+#define RCC_CR_HSEON    (1U << 16)
+#define RCC_CR_HSERDY   (1U << 17)
+#define RCC_CR_HSEBYP   (1U << 18)
+#define RCC_CR_PLLON    (1U << 24)
+#define RCC_CR_PLLRDY   (1U << 25)
+
+#define RCC_PLLCFGR_PLLSRC_HSE (1U << 22)
+
+#define RCC_CFGR_SW_PLL  (2U << 0)
+#define RCC_CFGR_SWS_PLL (2U << 2)
+#define RCC_CFGR_HPRE_DIV1  (0U << 4)
+#define RCC_CFGR_PPRE1_DIV4 (5U << 10)
+#define RCC_CFGR_PPRE2_DIV2 (4U << 13)
+#define RCC_CFGR_SW_MASK    (3U << 0)
+#define RCC_CFGR_SWS_MASK   (3U << 2)
+#define RCC_CFGR_HPRE_MASK  (0xFU << 4)
+#define RCC_CFGR_PPRE1_MASK (7U << 10)
+#define RCC_CFGR_PPRE2_MASK (7U << 13)
+
+#define RCC_AHB1ENR_GPIOA   (1U << 0)
+#define RCC_AHB1ENR_GPIOB   (1U << 1)
+#define RCC_AHB1ENR_GPIOC   (1U << 2)
+#define RCC_AHB1ENR_GPIOG   (1U << 6)
+#define RCC_AHB1ENR_ETHMAC    (1U << 25)
+#define RCC_AHB1ENR_ETHMACTX  (1U << 26)
+#define RCC_AHB1ENR_ETHMACRX  (1U << 27)
+
+#define RCC_APB1ENR_PWREN    (1U << 28)
+#define RCC_APB1ENR_UART4EN  (1U << 19)
+#define RCC_APB1ENR_USART3EN (1U << 18)
+#define RCC_APB2ENR_SYSCFGEN (1U << 14)
+
+#define RCC_AHB1RSTR_ETHMACRST (1U << 25)
+
+#define FLASH_BASE      0x40023C00UL
+#define FLASH_ACR       (*(volatile uint32_t *)(FLASH_BASE + 0x00U))
+#define FLASH_ACR_LATENCY_5WS (5U << 0)
+#define FLASH_ACR_PRFTEN     (1U << 8)
+#define FLASH_ACR_ICEN       (1U << 9)
+#define FLASH_ACR_DCEN       (1U << 10)
+
+#define PWR_BASE        0x40007000UL
+#define PWR_CR          (*(volatile uint32_t *)(PWR_BASE + 0x00U))
+#define PWR_CR_VOS_SCALE1 (3U << 14)
+
+#define SYSCFG_BASE     0x40013800UL
+#define SYSCFG_PMC      (*(volatile uint32_t *)(SYSCFG_BASE + 0x04U))
+#define SYSCFG_PMC_MII_RMII_SEL (1U << 23)
+
+#define GPIOA_BASE      0x40020000UL
+#define GPIOB_BASE      0x40020400UL
+#define GPIOC_BASE      0x40020800UL
+#define GPIOD_BASE      0x40020C00UL
+#define GPIOG_BASE      0x40021800UL
+
+#define RCC_AHB1ENR_GPIOD (1U << 3)
+
+#define GPIO_MODER(b)   (*(volatile uint32_t *)((b) + 0x00U))
+#define GPIO_OSPEEDR(b) (*(volatile uint32_t *)((b) + 0x08U))
+#define GPIO_PUPDR(b)   (*(volatile uint32_t *)((b) + 0x0CU))
+#define GPIO_AFRL(b)    (*(volatile uint32_t *)((b) + 0x20U))
+#define GPIO_AFRH(b)    (*(volatile uint32_t *)((b) + 0x24U))
+
+/* Per-board UART selection (both APB1). */
+#if defined(BOARD_NUCLEO_F439ZI)
+  #define UART_BASE         0x40004800UL  /* USART3 */
+  #define UART_CLK_BIT      RCC_APB1ENR_USART3EN
+  #define UART_PORT         GPIOD_BASE
+  #define UART_RCC_GPIO_BIT RCC_AHB1ENR_GPIOD
+  #define UART_TX_PIN       8U
+  #define UART_RX_PIN       9U
+  #define UART_AF           7U
+#elif defined(BOARD_STM32439I_EVAL)
+  #define UART_BASE         0x40004C00UL  /* UART4 */
+  #define UART_CLK_BIT      RCC_APB1ENR_UART4EN
+  #define UART_PORT         GPIOC_BASE
+  #define UART_RCC_GPIO_BIT RCC_AHB1ENR_GPIOC
+  #define UART_TX_PIN       10U
+  #define UART_RX_PIN       11U
+  #define UART_AF           8U
+#endif
+
+#define UART_SR         (*(volatile uint32_t *)(UART_BASE + 0x00U))
+#define UART_DR         (*(volatile uint32_t *)(UART_BASE + 0x04U))
+#define UART_BRR        (*(volatile uint32_t *)(UART_BASE + 0x08U))
+#define UART_CR1        (*(volatile uint32_t *)(UART_BASE + 0x0CU))
+#define USART_SR_TXE    (1U << 7)
+#define USART_CR1_RE    (1U << 2)
+#define USART_CR1_TE    (1U << 3)
+#define USART_CR1_UE    (1U << 13)
+
+/* SysTick (Cortex-M4 SCS) */
+#define STK_CTRL        (*(volatile uint32_t *)0xE000E010UL)
+#define STK_LOAD        (*(volatile uint32_t *)0xE000E014UL)
+#define STK_VAL         (*(volatile uint32_t *)0xE000E018UL)
+#define STK_CTRL_ENABLE   (1U << 0)
+#define STK_CTRL_TICKINT  (1U << 1)
+#define STK_CTRL_CLKSRC   (1U << 2)
+
+/* FPU coprocessor access (CP10/CP11) */
+#define SCB_CPACR       (*(volatile uint32_t *)0xE000ED88UL)
+
+/* SCB fault registers (used by hard-fault dump) */
+#define SCB_HFSR        (*(volatile uint32_t *)0xE000ED2CUL)
+#define SCB_CFSR        (*(volatile uint32_t *)0xE000ED28UL)
+#define SCB_BFAR        (*(volatile uint32_t *)0xE000ED38UL)
+#define SCB_MMFAR       (*(volatile uint32_t *)0xE000ED34UL)
+
+/* ===================================================================== */
+/* Globals                                                               */
+/* ===================================================================== */
+
+#define SYSCLK_HZ       168000000U
+#define HCLK_HZ         168000000U
+#define PCLK1_HZ        42000000U
+#define PCLK2_HZ        84000000U
+
+volatile uint64_t HAL_time_ms;
+
+uint32_t stm32f4_eth_hclk_hz(void)
+{
+    return HCLK_HZ;
+}
+
+static struct wolfIP *IPStack;
+
+#define ECHO_PORT       7
+#define RX_BUF_SIZE     1024
+static uint8_t rx_buf[RX_BUF_SIZE];
+static int listen_fd = -1;
+static int client_fd = -1;
+
+#define DHCP_TIMEOUT_MS 30000U
+#define DHCP_REINIT_MS  10000U
+
+/* ===================================================================== */
+/* UART output -- peripheral selection is in the BOARD #if block above   */
+/* ===================================================================== */
+
+static void uart_putc(char c)
+{
+    while ((UART_SR & USART_SR_TXE) == 0U) { }
+    UART_DR = (uint32_t)(uint8_t)c;
+}
+
+static void uart_puts(const char *s)
+{
+    while (*s) {
+        if (*s == '\n')
+            uart_putc('\r');
+        uart_putc(*s++);
+    }
+}
+
+static void uart_puthex(uint32_t val)
+{
+    const char hex[] = "0123456789ABCDEF";
+    int i;
+    uart_puts("0x");
+    for (i = 28; i >= 0; i -= 4)
+        uart_putc(hex[(val >> i) & 0xFU]);
+}
+
+int _write(int file, const char *ptr, int len)
+{
+    int i;
+    (void)file;
+    for (i = 0; i < len; i++) {
+        if (ptr[i] == '\n')
+            uart_putc('\r');
+        uart_putc(ptr[i]);
+    }
+    return len;
+}
+
+/* ===================================================================== */
+/* Hard fault handler -- dump frame via the board's UART                  */
+/* ===================================================================== */
+
+void hard_fault_handler_c(uint32_t *frame)
+{
+    uart_puts("\n\n*** HARD FAULT ***\n");
+    uart_puts("  PC:   "); uart_puthex(frame[6]); uart_puts("\n");
+    uart_puts("  LR:   "); uart_puthex(frame[5]); uart_puts("\n");
+    uart_puts("  R0:   "); uart_puthex(frame[0]); uart_puts("\n");
+    uart_puts("  R1:   "); uart_puthex(frame[1]); uart_puts("\n");
+    uart_puts("  R2:   "); uart_puthex(frame[2]); uart_puts("\n");
+    uart_puts("  R3:   "); uart_puthex(frame[3]); uart_puts("\n");
+    uart_puts("  R12:  "); uart_puthex(frame[4]); uart_puts("\n");
+    uart_puts("  xPSR: "); uart_puthex(frame[7]); uart_puts("\n");
+    uart_puts("  HFSR: "); uart_puthex(SCB_HFSR); uart_puts("\n");
+    uart_puts("  CFSR: "); uart_puthex(SCB_CFSR); uart_puts("\n");
+    if (SCB_CFSR & 0x00008200U) {
+        uart_puts("  BFAR: "); uart_puthex(SCB_BFAR); uart_puts("\n");
+    }
+    if (SCB_CFSR & 0x00000082U) {
+        uart_puts("  MMFAR:"); uart_puthex(SCB_MMFAR); uart_puts("\n");
+    }
+    while (1) { }
+}
+
+void HardFault_Handler(void) __attribute__((naked));
+void HardFault_Handler(void)
+{
+    __asm volatile (
+        "tst lr, #4              \n"
+        "ite eq                  \n"
+        "mrseq r0, msp           \n"
+        "mrsne r0, psp           \n"
+        "b hard_fault_handler_c  \n"
+    );
+}
+
+/* ===================================================================== */
+/* SysTick - 1 ms tick                                                    */
+/* ===================================================================== */
+
+void SysTick_Handler(void)
+{
+    HAL_time_ms++;
+}
+
+static void systick_init(void)
+{
+    STK_LOAD  = (SYSCLK_HZ / 1000U) - 1U;
+    STK_VAL   = 0U;
+    STK_CTRL  = STK_CTRL_CLKSRC | STK_CTRL_TICKINT | STK_CTRL_ENABLE;
+}
+
+/* ===================================================================== */
+/* Clock init: HSE -> PLL -> SYSCLK 168 MHz, HCLK=168, PCLK1=42, PCLK2=84 */
+/* ===================================================================== */
+
+/* PLLM is picked so VCO_in = HSE / PLLM = 1 MHz (within the spec 1..2
+ * MHz range).  NUCLEO HSE = 8 MHz (ST-LINK MCO bypass), EVAL HSE = 25
+ * MHz crystal.  All other PLL params (PLLN=336, PLLP=2, PLLQ=7) and
+ * downstream prescalers are identical, so SYSCLK lands at 168 MHz on
+ * both boards. */
+#if defined(BOARD_NUCLEO_F439ZI)
+#define PLLM_VAL  8U
+#elif defined(BOARD_STM32439I_EVAL)
+#define PLLM_VAL  25U
+#endif
+
+static int clock_init(void)
+{
+    uint32_t timeout;
+
+    /* Enable PWR and select VOS scale 1 (required for SYSCLK > 144 MHz). */
+    RCC_APB1ENR |= RCC_APB1ENR_PWREN;
+    (void)RCC_APB1ENR;
+    PWR_CR = (PWR_CR & ~(3U << 14)) | PWR_CR_VOS_SCALE1;
+
+    /* HSE source.  NUCLEO uses HSE_BYPASS (8 MHz from ST-LINK MCO);
+     * STM32439I-EVAL has a real 25 MHz crystal. */
+#if defined(BOARD_NUCLEO_F439ZI)
+    RCC_CR |= RCC_CR_HSEBYP;
+#endif
+    RCC_CR |= RCC_CR_HSEON;
+    timeout = 1000000U;
+    while (!(RCC_CR & RCC_CR_HSERDY) && (timeout > 0U)) {
+        timeout--;
+    }
+    if (timeout == 0U)
+        return -1;
+
+    /* Flash latency 5 WS (3.3 V, 150-168 MHz HCLK), enable caches +
+     * prefetch.  Must be set BEFORE switching SYSCLK to PLL. */
+    FLASH_ACR = FLASH_ACR_LATENCY_5WS | FLASH_ACR_PRFTEN |
+                FLASH_ACR_ICEN | FLASH_ACR_DCEN;
+
+    /* PLL configuration -- see PLLM_VAL comment above for board math.
+     * PLLP=2 is encoded as 0 in bits 17:16.  PLLQ=7 yields 48 MHz PLL48
+     * (for OTG_FS / RNG / SDIO when added later). */
+    RCC_CR &= ~RCC_CR_PLLON;
+    timeout = 100000U;
+    while ((RCC_CR & RCC_CR_PLLRDY) && (timeout > 0U)) {
+        timeout--;
+    }
+    RCC_PLLCFGR = RCC_PLLCFGR_PLLSRC_HSE |
+                  (PLLM_VAL << 0) |
+                  (336U << 6)     |   /* PLLN = 336 */
+                  (0U << 16)      |   /* PLLP = /2 */
+                  (7U << 24);         /* PLLQ = /7 */
+    RCC_CR |= RCC_CR_PLLON;
+    timeout = 1000000U;
+    while (!(RCC_CR & RCC_CR_PLLRDY) && (timeout > 0U)) {
+        timeout--;
+    }
+    if (timeout == 0U)
+        return -2;
+
+    /* AHB/1, APB1/4 (=42 MHz), APB2/2 (=84 MHz). */
+    RCC_CFGR = (RCC_CFGR & ~(RCC_CFGR_HPRE_MASK | RCC_CFGR_PPRE1_MASK |
+                              RCC_CFGR_PPRE2_MASK)) |
+               RCC_CFGR_HPRE_DIV1 | RCC_CFGR_PPRE1_DIV4 |
+               RCC_CFGR_PPRE2_DIV2;
+
+    /* Switch SYSCLK to PLL. */
+    RCC_CFGR = (RCC_CFGR & ~RCC_CFGR_SW_MASK) | RCC_CFGR_SW_PLL;
+    timeout = 100000U;
+    while (((RCC_CFGR & RCC_CFGR_SWS_MASK) != RCC_CFGR_SWS_PLL) &&
+           (timeout > 0U)) {
+        timeout--;
+    }
+    return (timeout > 0U) ? 0 : -3;
+}
+
+/* ===================================================================== */
+/* UART init -- pins/AF/peripheral chosen at compile time by BOARD       */
+/* ===================================================================== */
+
+static void uart_init(void)
+{
+    /* GPIO clock for the chosen TX/RX port. */
+    RCC_AHB1ENR |= UART_RCC_GPIO_BIT;
+    (void)RCC_AHB1ENR;
+
+    /* MODER = AF (10b) for TX and RX pins. */
+    GPIO_MODER(UART_PORT) &= ~((3U << (UART_TX_PIN * 2)) |
+                                (3U << (UART_RX_PIN * 2)));
+    GPIO_MODER(UART_PORT) |=  ((2U << (UART_TX_PIN * 2)) |
+                                (2U << (UART_RX_PIN * 2)));
+
+    /* High speed. */
+    GPIO_OSPEEDR(UART_PORT) |= (3U << (UART_TX_PIN * 2)) |
+                                (3U << (UART_RX_PIN * 2));
+
+    /* AF mux.  Both TX and RX pins are >= 8 on both boards (PD8/PD9 or
+     * PC10/PC11), so AFRH is the right register. */
+    GPIO_AFRH(UART_PORT) &= ~((0xFU << ((UART_TX_PIN - 8U) * 4)) |
+                              (0xFU << ((UART_RX_PIN - 8U) * 4)));
+    GPIO_AFRH(UART_PORT) |=  ((UART_AF << ((UART_TX_PIN - 8U) * 4)) |
+                              (UART_AF << ((UART_RX_PIN - 8U) * 4)));
+
+    /* UART peripheral clock. */
+    RCC_APB1ENR |= UART_CLK_BIT;
+    (void)RCC_APB1ENR;
+
+    /* 115200 8N1 @ PCLK1 = 42 MHz.  BRR = PCLK / baud (mantissa+fraction
+     * is encoded together when oversampling 16). */
+    UART_CR1 = 0U;
+    UART_BRR = (PCLK1_HZ + (115200U / 2U)) / 115200U;
+    UART_CR1 = USART_CR1_TE | USART_CR1_RE | USART_CR1_UE;
+}
+
+/* ===================================================================== */
+/* Ethernet RCC + GPIO + SYSCFG                                          */
+/*                                                                       */
+/* Shared RMII pins (both boards):                                       */
+/*   PA1  ETH_RMII_REF_CLK    AF11                                       */
+/*   PA2  ETH_MDIO            AF11                                       */
+/*   PA7  ETH_RMII_CRS_DV     AF11                                       */
+/*   PC1  ETH_MDC             AF11                                       */
+/*   PC4  ETH_RMII_RXD0       AF11                                       */
+/*   PC5  ETH_RMII_RXD1       AF11                                       */
+/*   PG11 ETH_RMII_TX_EN      AF11                                       */
+/*   PG13 ETH_RMII_TXD0       AF11                                       */
+/*                                                                       */
+/* Board-specific:                                                       */
+/*   NUCLEO-F439ZI (per UM1974):  RMII_TXD1 = PB13 AF11                  */
+/*   STM32439I-EVAL (per UM1670): RMII_TXD1 = PG14 AF11                  */
+/* ===================================================================== */
+
+static void gpio_set_af(uint32_t base, uint32_t pin, uint32_t af)
+{
+    /* MODER = AF (10b) */
+    GPIO_MODER(base) &= ~(3U << (pin * 2));
+    GPIO_MODER(base) |=  (2U << (pin * 2));
+    /* Push-pull (OTYPER=0 default) */
+    /* Very high speed */
+    GPIO_OSPEEDR(base) |= (3U << (pin * 2));
+    /* No pull */
+    GPIO_PUPDR(base)   &= ~(3U << (pin * 2));
+    /* AF select */
+    if (pin < 8U) {
+        GPIO_AFRL(base) &= ~(0xFU << (pin * 4));
+        GPIO_AFRL(base) |=  (af   << (pin * 4));
+    } else {
+        GPIO_AFRH(base) &= ~(0xFU << ((pin - 8U) * 4));
+        GPIO_AFRH(base) |=  (af   << ((pin - 8U) * 4));
+    }
+}
+
+static void eth_pins_init(void)
+{
+    /* Need GPIOA, GPIOC, GPIOG always; GPIOB only for NUCLEO TXD1. */
+    RCC_AHB1ENR |= RCC_AHB1ENR_GPIOA | RCC_AHB1ENR_GPIOC | RCC_AHB1ENR_GPIOG;
+#if defined(BOARD_NUCLEO_F439ZI)
+    RCC_AHB1ENR |= RCC_AHB1ENR_GPIOB;
+#endif
+    (void)RCC_AHB1ENR;
+
+    /* Port A */
+    gpio_set_af(GPIOA_BASE, 1U, 11U); /* RMII_REF_CLK */
+    gpio_set_af(GPIOA_BASE, 2U, 11U); /* MDIO */
+    gpio_set_af(GPIOA_BASE, 7U, 11U); /* RMII_CRS_DV */
+
+    /* Port C */
+    gpio_set_af(GPIOC_BASE, 1U, 11U); /* MDC */
+    gpio_set_af(GPIOC_BASE, 4U, 11U); /* RMII_RXD0 */
+    gpio_set_af(GPIOC_BASE, 5U, 11U); /* RMII_RXD1 */
+
+    /* Port G shared TX_EN + TXD0; TXD1 differs per board. */
+    gpio_set_af(GPIOG_BASE, 11U, 11U); /* RMII_TX_EN */
+    gpio_set_af(GPIOG_BASE, 13U, 11U); /* RMII_TXD0 */
+#if defined(BOARD_NUCLEO_F439ZI)
+    gpio_set_af(GPIOB_BASE, 13U, 11U); /* RMII_TXD1 (NUCLEO) */
+#else
+    gpio_set_af(GPIOG_BASE, 14U, 11U); /* RMII_TXD1 (EVAL)  */
+#endif
+}
+
+static void eth_clk_init(void)
+{
+    /* SYSCFG clock so PMC.MII_RMII_SEL can be written. */
+    RCC_APB2ENR |= RCC_APB2ENR_SYSCFGEN;
+    (void)RCC_APB2ENR;
+
+    /* Select RMII before enabling MAC clocks. */
+    SYSCFG_PMC |= SYSCFG_PMC_MII_RMII_SEL;
+
+    /* Enable MAC + TX + RX clocks. */
+    RCC_AHB1ENR |= RCC_AHB1ENR_ETHMAC | RCC_AHB1ENR_ETHMACTX |
+                   RCC_AHB1ENR_ETHMACRX;
+    (void)RCC_AHB1ENR;
+
+    /* Pulse MAC peripheral reset.  Hold ~1ms then release. */
+    RCC_AHB1RSTR |= RCC_AHB1RSTR_ETHMACRST;
+    { volatile uint32_t d; for (d = 0; d < 200000U; d++) { } }
+    RCC_AHB1RSTR &= ~RCC_AHB1RSTR_ETHMACRST;
+    { volatile uint32_t d; for (d = 0; d < 200000U; d++) { } }
+}
+
+/* ===================================================================== */
+/* wolfIP random number source - STM32F4 hardware RNG                     */
+/* ===================================================================== */
+
+static void rng_init(void)
+{
+    RCC_AHB2ENR |= RCC_AHB2ENR_RNGEN;
+    (void)RCC_AHB2ENR;
+    RNG_CR = RNG_CR_RNGEN;
+}
+
+uint32_t wolfIP_getrandom(void)
+{
+    uint32_t sr;
+    uint32_t retries = 100U;
+
+    while (retries-- > 0U) {
+        sr = RNG_SR;
+        if (sr & (RNG_SR_CEIS | RNG_SR_SEIS)) {
+            /* Clear error flags and restart the RNG.  CEIS indicates
+             * PLL48CLK trouble; SEIS indicates a seed-quality failure.
+             * Both are recoverable per RM0090. */
+            RNG_SR = sr & ~(RNG_SR_CEIS | RNG_SR_SEIS);
+            RNG_CR = 0U;
+            RNG_CR = RNG_CR_RNGEN;
+            continue;
+        }
+        if (sr & RNG_SR_DRDY)
+            return RNG_DR;
+    }
+    /* RNG never produced data - fall back to a fixed value rather than
+     * hanging the stack.  This should not happen on a healthy board. */
+    return 0xDEADBEEFU;
+}
+
+/* ===================================================================== */
+/* Echo server callback                                                  */
+/* ===================================================================== */
+
+static void uart_putip4(ip4 ip)
+{
+    printf("%u.%u.%u.%u",
+        (unsigned)((ip >> 24) & 0xFFU),
+        (unsigned)((ip >> 16) & 0xFFU),
+        (unsigned)((ip >> 8)  & 0xFFU),
+        (unsigned)( ip        & 0xFFU));
+}
+
+static void echo_cb(int fd, uint16_t event, void *arg)
+{
+    struct wolfIP *s = (struct wolfIP *)arg;
+    int ret;
+
+    if ((fd == listen_fd) && (event & CB_EVENT_READABLE) &&
+        (client_fd == -1)) {
+        client_fd = wolfIP_sock_accept(s, listen_fd, NULL, NULL);
+        if (client_fd > 0) {
+            printf("Echo: client connected (fd=%d)\n", client_fd);
+            wolfIP_register_callback(s, client_fd, echo_cb, s);
+        }
+        return;
+    }
+
+    if ((fd == client_fd) && (event & CB_EVENT_READABLE)) {
+        ret = wolfIP_sock_recvfrom(s, client_fd, rx_buf, sizeof(rx_buf),
+                                   0, NULL, NULL);
+        if (ret > 0) {
+            (void)wolfIP_sock_sendto(s, client_fd, rx_buf, (uint32_t)ret,
+                                     0, NULL, 0);
+        } else if (ret == 0) {
+            printf("Echo: client disconnected\n");
+            wolfIP_sock_close(s, client_fd);
+            client_fd = -1;
+        }
+    }
+
+    if ((fd == client_fd) && (event & CB_EVENT_CLOSED)) {
+        printf("Echo: connection closed\n");
+        wolfIP_sock_close(s, client_fd);
+        client_fd = -1;
+    }
+}
+
+/* ===================================================================== */
+/* main                                                                  */
+/* ===================================================================== */
+
+int main(void)
+{
+    struct wolfIP_ll_dev *ll;
+    struct wolfIP_sockaddr_in addr;
+    int ret;
+
+    /* Enable FPU (CP10 + CP11 full access). */
+    SCB_CPACR |= (0xFU << 20);
+    __asm volatile ("dsb sy" ::: "memory");
+    __asm volatile ("isb sy" ::: "memory");
+
+    /* clock_init() can only fail if HSE/PLL never come ready.  If it
+     * does, UART output won't make it out at the expected baud anyway,
+     * so there is nothing useful to print -- just continue and let the
+     * watchdog (or the user) catch the dead board. */
+    (void)clock_init();
+
+    systick_init();
+    uart_init();
+    rng_init();
+
+    printf("\n\n=== wolfIP STM32F437/F439 (" BOARD_NAME ") ===\n");
+    printf("Build: " __DATE__ " " __TIME__ "\n");
+    printf("SYSCLK = %u Hz, HCLK = %u Hz, PCLK1 = %u Hz, PCLK2 = %u Hz\n",
+           (unsigned)SYSCLK_HZ, (unsigned)HCLK_HZ,
+           (unsigned)PCLK1_HZ, (unsigned)PCLK2_HZ);
+
+    /* Bring up Ethernet RCC/GPIO/SYSCFG before wolfIP init. */
+    eth_pins_init();
+    eth_clk_init();
+
+    wolfIP_init_static(&IPStack);
+
+    printf("Initializing Ethernet (RMII + " PHY_NAME ")...\n");
+    ll = wolfIP_getdev(IPStack);
+    ret = stm32f4_eth_init(ll, NULL);
+    if (ret == -2) {
+        printf("  NOTE: PHY link down at startup -- continuing\n");
+    } else if (ret < 0) {
+        printf("  ERROR: stm32f4_eth_init failed (%d)\n", ret);
+    }
+
+#ifdef DHCP
+    printf("Starting DHCP...\n");
+    (void)wolfIP_poll(IPStack, stm32f4_hal_time_ms());
+    (void)dhcp_client_init(IPStack);
+#else
+    {
+        ip4 ip = atoip4(WOLFIP_IP);
+        ip4 nm = atoip4(WOLFIP_NETMASK);
+        ip4 gw = atoip4(WOLFIP_GW);
+        printf("Static IP:\n");
+        printf("  IP:   "); uart_putip4(ip); printf("\n");
+        printf("  Mask: "); uart_putip4(nm); printf("\n");
+        printf("  GW:   "); uart_putip4(gw); printf("\n");
+        wolfIP_ipconfig_set(IPStack, ip, nm, gw);
+    }
+#endif
+
+    memset(&addr, 0, sizeof(addr));
+    addr.sin_family = AF_INET;
+    addr.sin_addr.s_addr = 0;
+    addr.sin_port = ee16(ECHO_PORT);
+
+    printf("TCP echo server on port %d\n", ECHO_PORT);
+    listen_fd = wolfIP_sock_socket(IPStack, AF_INET, IPSTACK_SOCK_STREAM, 0);
+    if (listen_fd < 0) {
+        printf("  ERROR: wolfIP_sock_socket failed (%d)\n", listen_fd);
+        for (;;) { __asm volatile ("wfi"); }
+    }
+    wolfIP_register_callback(IPStack, listen_fd, echo_cb, IPStack);
+    ret = wolfIP_sock_bind(IPStack, listen_fd,
+                           (struct wolfIP_sockaddr *)&addr, sizeof(addr));
+    if (ret < 0) {
+        printf("  ERROR: wolfIP_sock_bind failed (%d)\n", ret);
+        for (;;) { __asm volatile ("wfi"); }
+    }
+    ret = wolfIP_sock_listen(IPStack, listen_fd, 1);
+    if (ret < 0) {
+        printf("  ERROR: wolfIP_sock_listen failed (%d)\n", ret);
+        for (;;) { __asm volatile ("wfi"); }
+    }
+
+    printf("Ready! Test with:\n");
+    printf("  ping <ip>\n");
+    printf("  echo 'hello' | nc <ip> 7\n\n");
+
+    {
+        uint64_t last_diag_ms = 0;
+#ifdef DHCP
+        uint64_t dhcp_start_ms = stm32f4_hal_time_ms();
+        uint64_t dhcp_reinit_ms = dhcp_start_ms;
+        int dhcp_done = 0;
+#endif
+
+        for (;;) {
+            uint64_t now = stm32f4_hal_time_ms();
+            (void)wolfIP_poll(IPStack, now);
+
+#ifdef DHCP
+            if (!dhcp_done) {
+                if (dhcp_bound(IPStack)) {
+                    ip4 ip = 0, nm = 0, gw = 0;
+                    wolfIP_ipconfig_get(IPStack, &ip, &nm, &gw);
+                    printf("DHCP bound:\n");
+                    printf("  IP:   "); uart_putip4(ip); printf("\n");
+                    printf("  Mask: "); uart_putip4(nm); printf("\n");
+                    printf("  GW:   "); uart_putip4(gw); printf("\n");
+                    dhcp_done = 1;
+                } else if ((now - dhcp_start_ms) > DHCP_TIMEOUT_MS) {
+                    ip4 ip = 0, nm = 0, gw = 0;
+                    wolfIP_ipconfig_get(IPStack, &ip, &nm, &gw);
+                    if (ip == 0U) {
+                        ip = atoip4(WOLFIP_IP);
+                        nm = atoip4(WOLFIP_NETMASK);
+                        gw = atoip4(WOLFIP_GW);
+                        printf("DHCP timeout, using static fallback:\n");
+                        wolfIP_ipconfig_set(IPStack, ip, nm, gw);
+                    } else {
+                        printf("DHCP assigned IP:\n");
+                    }
+                    printf("  IP:   "); uart_putip4(ip); printf("\n");
+                    printf("  Mask: "); uart_putip4(nm); printf("\n");
+                    printf("  GW:   "); uart_putip4(gw); printf("\n");
+                    dhcp_done = 1;
+                } else if ((now - dhcp_reinit_ms) > DHCP_REINIT_MS) {
+                    (void)dhcp_client_init(IPStack);
+                    dhcp_reinit_ms = now;
+                }
+            }
+#endif
+
+            if ((now - last_diag_ms) >= 10000U) {
+                uint32_t pkts, tx_pkts, tx_errs;
+                uint32_t mac_cfg, mac_dbg;
+                stm32f4_eth_get_stats(NULL, &pkts, &tx_pkts, &tx_errs);
+                stm32f4_eth_get_mac_diag(&mac_cfg, &mac_dbg);
+                printf("[%lu] rx=%lu tx=%lu/%lu maccr=0x%08lX "
+                       "macdbg=0x%08lX dmasr=0x%08lX\n",
+                       (unsigned long)(now / 1000U),
+                       (unsigned long)pkts,
+                       (unsigned long)tx_pkts,
+                       (unsigned long)tx_errs,
+                       (unsigned long)mac_cfg,
+                       (unsigned long)mac_dbg,
+                       (unsigned long)stm32f4_eth_get_dma_status());
+                last_diag_ms = now;
+            }
+        }
+    }
+}
diff --git a/src/port/stm32f439/startup.c b/src/port/stm32f439/startup.c
new file mode 100644
index 00000000..91e8f61f
--- /dev/null
+++ b/src/port/stm32f439/startup.c
@@ -0,0 +1,51 @@
+/* startup.c
+ *
+ * Reset handler for STM32F437.  Copies .data from flash to RAM, zeroes
+ * .bss, runs C++ static constructors (via libc init array), then enters
+ * main().
+ *
+ * Copyright (C) 2026 wolfSSL Inc.
+ *
+ * This file is part of wolfIP TCP/IP stack.
+ *
+ * wolfIP is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * wolfIP is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+ */
+#include <stdint.h>
+
+extern uint32_t _sidata;
+extern uint32_t _sdata;
+extern uint32_t _edata;
+extern uint32_t _sbss;
+extern uint32_t _ebss;
+extern void __libc_init_array(void);
+
+int main(void);
+
+void Reset_Handler(void)
+{
+    uint32_t *src;
+    uint32_t *dst;
+
+    src = &_sidata;
+    for (dst = &_sdata; dst < &_edata; ) {
+        *dst++ = *src++;
+    }
+    for (dst = &_sbss; dst < &_ebss; ) {
+        *dst++ = 0u;
+    }
+    __libc_init_array();
+    (void)main();
+    while (1) { }
+}
diff --git a/src/port/stm32f439/syscalls.c b/src/port/stm32f439/syscalls.c
new file mode 100644
index 00000000..ab4de96b
--- /dev/null
+++ b/src/port/stm32f439/syscalls.c
@@ -0,0 +1,137 @@
+/* syscalls.c
+ *
+ * Minimal newlib stubs for STM32F437.  _write is provided by main.c so
+ * printf is routed to UART4 (ST-LINK VCP on STM32439I-EVAL).
+ *
+ * Copyright (C) 2026 wolfSSL Inc.
+ *
+ * This file is part of wolfIP TCP/IP stack.
+ *
+ * wolfIP is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * wolfIP is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+ */
+#include <sys/stat.h>
+#include <sys/time.h>
+#include <errno.h>
+#include <stdint.h>
+#include <stddef.h>
+#include <time.h>
+
+extern uint32_t _ebss;
+extern uint32_t _heap_limit;
+
+static char *heap_end;
+
+int _close(int file)
+{
+    (void)file;
+    return -1;
+}
+
+int _fstat(int file, struct stat *st)
+{
+    (void)file;
+    if (st == 0) {
+        errno = EINVAL;
+        return -1;
+    }
+    st->st_mode = S_IFCHR;
+    return 0;
+}
+
+int _isatty(int file)
+{
+    (void)file;
+    return 1;
+}
+
+int _lseek(int file, int ptr, int dir)
+{
+    (void)file;
+    (void)ptr;
+    (void)dir;
+    return 0;
+}
+
+int _read(int file, char *ptr, int len)
+{
+    (void)file;
+    (void)ptr;
+    (void)len;
+    return 0;
+}
+
+void *_sbrk(ptrdiff_t incr)
+{
+    char *prev;
+    if (heap_end == 0) {
+        heap_end = (char *)&_ebss;
+    }
+    prev = heap_end;
+    if ((heap_end + incr) >= (char *)&_heap_limit) {
+        errno = ENOMEM;
+        return (void *)-1;
+    }
+    heap_end += incr;
+    return prev;
+}
+
+int _gettimeofday(struct timeval *tv, void *tzvp)
+{
+    (void)tzvp;
+    if (tv == 0) {
+        errno = EINVAL;
+        return -1;
+    }
+    tv->tv_sec = 0;
+    tv->tv_usec = 0;
+    return 0;
+}
+
+time_t time(time_t *t)
+{
+    if (t != 0) {
+        *t = 0;
+    }
+    return 0;
+}
+
+void _exit(int status)
+{
+    (void)status;
+    while (1) {
+        __asm volatile("wfi");
+    }
+}
+
+int _kill(int pid, int sig)
+{
+    (void)pid;
+    (void)sig;
+    errno = EINVAL;
+    return -1;
+}
+
+int _getpid(void)
+{
+    return 1;
+}
+
+void _init(void)
+{
+}
+
+void _fini(void)
+{
+}
diff --git a/src/port/stm32f439/target.ld b/src/port/stm32f439/target.ld
new file mode 100644
index 00000000..d9cdf090
--- /dev/null
+++ b/src/port/stm32f439/target.ld
@@ -0,0 +1,97 @@
+/* STM32F437IIHx Linker Script
+ *
+ * Memory map:
+ *   FLASH:    2 MB  @ 0x08000000
+ *   SRAM:   192 KB  @ 0x20000000 (SRAM1 112K + SRAM2 16K + SRAM3 64K
+ *                                 - mapped contiguously from 0x20000000)
+ *   CCM:     64 KB  @ 0x10000000 (Cortex-M4 D-bus only -- NOT used here;
+ *                                 the Ethernet DMA cannot reach CCM, so
+ *                                 keeping everything in main SRAM avoids
+ *                                 the "DMA buffer in unreachable RAM" trap.)
+ */
+
+MEMORY
+{
+    FLASH (rx)  : ORIGIN = 0x08000000, LENGTH = 2048K
+    RAM   (rwx) : ORIGIN = 0x20000000, LENGTH = 192K
+}
+
+_estack = ORIGIN(RAM) + LENGTH(RAM);
+_sidata = LOADADDR(.data);
+
+_Min_Heap_Size  = 0x4000;   /* 16 KB heap */
+_Min_Stack_Size = 0x4000;   /* 16 KB stack */
+_heap_limit = _estack - _Min_Stack_Size;
+
+SECTIONS
+{
+    .isr_vector :
+    {
+        . = ALIGN(4);
+        KEEP(*(.isr_vector))
+        . = ALIGN(4);
+    } > FLASH
+
+    .text :
+    {
+        . = ALIGN(4);
+        *(.text*)
+        *(.rodata*)
+        *(.ARM.extab* .gnu.linkonce.armextab.*)
+        *(.ARM.exidx* .gnu.linkonce.armexidx.*)
+        *(.glue_7)
+        *(.glue_7t)
+        *(.eh_frame)
+        . = ALIGN(4);
+    } > FLASH
+
+    .preinit_array :
+    {
+        __preinit_array_start = .;
+        KEEP(*(.preinit_array*))
+        __preinit_array_end = .;
+    } > FLASH
+
+    .init_array :
+    {
+        __init_array_start = .;
+        KEEP(*(.init_array*))
+        __init_array_end = .;
+    } > FLASH
+
+    .fini_array :
+    {
+        __fini_array_start = .;
+        KEEP(*(.fini_array*))
+        __fini_array_end = .;
+    } > FLASH
+
+    .data :
+    {
+        . = ALIGN(4);
+        _sdata = .;
+        *(.data*)
+        . = ALIGN(4);
+        _edata = .;
+    } > RAM AT > FLASH
+
+    .bss (NOLOAD) :
+    {
+        . = ALIGN(4);
+        _sbss = .;
+        *(.bss*)
+        *(COMMON)
+        . = ALIGN(4);
+        _ebss = .;
+    } > RAM
+
+    ._user_heap_stack (NOLOAD) :
+    {
+        . = ALIGN(8);
+        PROVIDE ( end = . );
+        PROVIDE ( _end = . );
+        . = . + _Min_Heap_Size;
+        . = . + _Min_Stack_Size;
+        . = ALIGN(8);
+    } > RAM
+}