diff --git a/.github/workflows/base-image.yaml b/.github/workflows/base-image.yaml
index 039e6f01..83ca6040 100644
--- a/.github/workflows/base-image.yaml
+++ b/.github/workflows/base-image.yaml
@@ -16,6 +16,7 @@ jobs:
           - name: 202311
           - name: 202411
           - name: 202505
+          - name: 202511-vpp
 
     steps:
     - name: Log in to the container registry
diff --git a/.github/workflows/integration.yaml b/.github/workflows/integration.yaml
index 448a52da..45fae115 100644
--- a/.github/workflows/integration.yaml
+++ b/.github/workflows/integration.yaml
@@ -53,8 +53,8 @@ jobs:
         cache-from: type=registry,ref=${{ env.MINI_LAB_VM_IMAGE }}
         cache-to: type=inline
 
-  build-mini-lab-sonic-image:
-    name: Build mini-lab-sonic image
+  build-mini-lab-sonic-vs-image:
+    name: Build mini-lab-sonic-vs image
     runs-on: ubuntu-latest
 
     steps:
@@ -73,8 +73,8 @@ jobs:
         IMAGE_TAG=$([ "${GITHUB_EVENT_NAME}" == 'pull_request' ] && echo ${GITHUB_HEAD_REF##*/} || echo "latest")
         SHA_TAG=${COMMIT_SHA::8}
 
-        echo "MINI_LAB_SONIC_IMAGE=ghcr.io/metal-stack/mini-lab-sonic:${IMAGE_TAG}" >> $GITHUB_ENV
-        echo "MINI_LAB_SONIC_IMAGE_SHA=ghcr.io/metal-stack/mini-lab-sonic:${SHA_TAG}" >> $GITHUB_ENV
+        echo "MINI_LAB_SONIC_IMAGE=ghcr.io/metal-stack/mini-lab-sonic-vs:${IMAGE_TAG}" >> $GITHUB_ENV
+        echo "MINI_LAB_SONIC_IMAGE_SHA=ghcr.io/metal-stack/mini-lab-sonic-vs:${SHA_TAG}" >> $GITHUB_ENV
       env:
         COMMIT_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
 
@@ -88,24 +88,68 @@ jobs:
         pull: true
         push: true
         sbom: true
+        file: images/sonic/Dockerfile.vs
         tags: |
           ${{ env.MINI_LAB_SONIC_IMAGE }}
           ${{ env.MINI_LAB_SONIC_IMAGE_SHA }}
         cache-from: type=registry,ref=${{ env.MINI_LAB_SONIC_IMAGE }}
         cache-to: type=inline
 
+  build-mini-lab-sonic-vpp-image:
+    name: Build mini-lab-sonic-vpp image
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Log in to the container registry
+      uses: docker/login-action@v3
+      with:
+        registry: ${{ env.REGISTRY }}
+        username: ${{ secrets.DOCKER_REGISTRY_USER }}
+        password: ${{ secrets.DOCKER_REGISTRY_TOKEN }}
+
+    - name: Checkout
+      uses: actions/checkout@v4
+
+    - name: Make tag
+      run: |
+        IMAGE_TAG=$([ "${GITHUB_EVENT_NAME}" == 'pull_request' ] && echo ${GITHUB_HEAD_REF##*/} || echo "latest")
+        SHA_TAG=${COMMIT_SHA::8}
+
+        echo "MINI_LAB_SONIC_IMAGE=ghcr.io/metal-stack/mini-lab-sonic-vpp:${IMAGE_TAG}" >> $GITHUB_ENV
+        echo "MINI_LAB_SONIC_IMAGE_SHA=ghcr.io/metal-stack/mini-lab-sonic-vpp:${SHA_TAG}" >> $GITHUB_ENV
+      env:
+        COMMIT_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+
+    - name: Build and push mini-lab-sonic container
+      uses: docker/build-push-action@v6
+      with:
+        context: ./images/sonic
+        pull: true
+        push: true
+        sbom: true
+        file: images/sonic/Dockerfile.vpp
+        tags: |
+          ${{ env.MINI_LAB_SONIC_IMAGE }}
+          ${{ env.MINI_LAB_SONIC_IMAGE_SHA }}
+        cache-from: type=registry,ref=${{ env.MINI_LAB_SONIC_IMAGE }}
+        cache-to: type=inline
   test:
     name: Run tests
     runs-on: self-hosted
     needs:
       - build-mini-lab-vms-image
-      - build-mini-lab-sonic-image
+      - build-mini-lab-sonic-vs-image
+      - build-mini-lab-sonic-vpp-image
 
     continue-on-error: true
     strategy:
       matrix:
         flavors:
-          - name: sonic
+          - name: sonic_vs
+          - name: sonic_vpp
           - name: gardener
           - name: dell_sonic
 
@@ -140,7 +184,7 @@ jobs:
         IMAGE_TAG=$([ "${GITHUB_EVENT_NAME}" == 'pull_request' ] && echo ${GITHUB_HEAD_REF##*/} || echo "latest")
 
         echo "MINI_LAB_VM_IMAGE=ghcr.io/metal-stack/mini-lab-vms:${IMAGE_TAG}" >> $GITHUB_ENV
-        echo "MINI_LAB_SONIC_IMAGE=ghcr.io/metal-stack/mini-lab-sonic:${IMAGE_TAG}" >> $GITHUB_ENV
+        echo "MINI_LAB_SONIC_IMAGE_TAG=${IMAGE_TAG}" >> $GITHUB_ENV
 
     - name: Run integration tests
       shell: bash
diff --git a/Makefile b/Makefile
index bd059e06..6bc39614 100644
--- a/Makefile
+++ b/Makefile
@@ -26,10 +26,10 @@ ANSIBLE_EXTRA_VARS_FILE := $(or $(ANSIBLE_EXTRA_VARS_FILE),)
 # do not show skipped ansible tasks
 ANSIBLE_DISPLAY_SKIPPED_HOSTS=false
 
-MINI_LAB_FLAVOR := $(or $(MINI_LAB_FLAVOR),sonic)
+MINI_LAB_FLAVOR := $(or $(MINI_LAB_FLAVOR),sonic_vs)
 MINI_LAB_VM_IMAGE := $(or $(MINI_LAB_VM_IMAGE),ghcr.io/metal-stack/mini-lab-vms:latest)
-MINI_LAB_SONIC_IMAGE := $(or $(MINI_LAB_SONIC_IMAGE),ghcr.io/metal-stack/mini-lab-sonic:latest)
 MINI_LAB_DELL_SONIC_VERSION := $(or $(MINI_LAB_DELL_SONIC_VERSION),4.5.1)
+MINI_LAB_SONIC_IMAGE_TAG := $(or $(MINI_LAB_SONIC_IMAGE_TAG),latest)
 
 MINI_LAB_INTERNAL_NETWORK=mini_lab_internal
 # define this here as well so that kind picks up the network on a clean checkout,
@@ -40,9 +40,14 @@ MACHINE_OS=debian-13.0
 MAX_RETRIES := 30
 
 # Machine flavors
-ifeq ($(MINI_LAB_FLAVOR),sonic)
+ifeq ($(MINI_LAB_FLAVOR),sonic_vs)
 LAB_TOPOLOGY=mini-lab.sonic.yaml
 MONITORING_ENABLED := $(or $(MONITORING_ENABLED),true)
+MINI_LAB_SONIC_IMAGE := $(or $(MINI_LAB_SONIC_IMAGE),ghcr.io/metal-stack/mini-lab-sonic-vs:$(MINI_LAB_SONIC_IMAGE_TAG))
+else ifeq ($(MINI_LAB_FLAVOR),sonic_vpp)
+LAB_TOPOLOGY=mini-lab.sonic.yaml
+MONITORING_ENABLED := $(or $(MONITORING_ENABLED),true)
+MINI_LAB_SONIC_IMAGE := $(or $(MINI_LAB_SONIC_IMAGE),ghcr.io/metal-stack/mini-lab-sonic-vpp:$(MINI_LAB_SONIC_IMAGE_TAG))
 else ifeq ($(MINI_LAB_FLAVOR),dell_sonic)
 LAB_TOPOLOGY=mini-lab.dell_sonic.yaml
 MINI_LAB_SONIC_IMAGE=r.metal-stack.io/vrnetlab/dell_sonic:$(MINI_LAB_DELL_SONIC_VERSION)
@@ -52,11 +57,13 @@ MINI_LAB_SONIC_IMAGE=r.metal-stack.io/vrnetlab/dell_sonic:$(MINI_LAB_DELL_SONIC_
 else ifeq ($(MINI_LAB_FLAVOR),kamaji)
 LAB_TOPOLOGY=mini-lab.kamaji.yaml
 KAMAJI_ENABLED=true
+MINI_LAB_SONIC_IMAGE := $(or $(MINI_LAB_SONIC_IMAGE),ghcr.io/metal-stack/mini-lab-sonic-vs:$(MINI_LAB_SONIC_IMAGE_TAG))
 else ifeq ($(MINI_LAB_FLAVOR),gardener)
 GARDENER_ENABLED=true
 # usually gardener restricts the maximum version for k8s:
 K8S_VERSION=1.35.5
 LAB_TOPOLOGY=mini-lab.sonic.yaml
+MINI_LAB_SONIC_IMAGE := $(or $(MINI_LAB_SONIC_IMAGE),ghcr.io/metal-stack/mini-lab-sonic-vs:$(MINI_LAB_SONIC_IMAGE_TAG))
 else
 $(error Unknown flavor $(MINI_LAB_FLAVOR))
 endif
@@ -141,8 +148,7 @@ ifneq ($(filter $(MINI_LAB_FLAVOR),dell_sonic capms_dell_sonic),$(MINI_LAB_FLAVO
 	docker pull $(MINI_LAB_SONIC_IMAGE)
 endif
 	@if ! sudo $(CONTAINERLAB) --topo $(LAB_TOPOLOGY) inspect | grep -i leaf01 > /dev/null; then \
-		sudo --preserve-env=MINI_LAB_SONIC_IMAGE --preserve-env=MINI_LAB_DELL_SONIC_VERSION --preserve-env=MINI_LAB_VM_IMAGE $(CONTAINERLAB) deploy --topo $(LAB_TOPOLOGY) --reconfigure && \
-		./scripts/deactivate_offloading.sh; fi
+		sudo --preserve-env=MINI_LAB_SONIC_IMAGE --preserve-env=MINI_LAB_DELL_SONIC_VERSION --preserve-env=MINI_LAB_VM_IMAGE $(CONTAINERLAB) deploy --topo $(LAB_TOPOLOGY) --reconfigure; fi
 
 .PHONY: verify-deployment-image
 verify-deployment-image:
diff --git a/README.md b/README.md
index c376a0db..3d273f3f 100644
--- a/README.md
+++ b/README.md
@@ -238,16 +238,17 @@ make up
 
 All available mini-lab flavors are listed below:
 
-- `sonic`: runs two Community SONiC switches
+- `sonic_vs`: runs two Community SONiC switches with the kernel based virtual switch dataplane
+- `sonic_vpp`: runs two Community SONiC switches with the [VPP](https://fd.io) dataplane
 - `dell_sonic`: runs two Enterprise SONiC switches with a [locally built vrnetlab image](https://github.com/srl-labs/vrnetlab/tree/master/dell/dell_sonic)
 - `capms_dell_sonic`: runs the `dell_sonic` flavor but with four instead of two machines (this is used for [cluster-provider-metal-stack](https://github.com/metal-stack/cluster-api-provider-metal-stack) in order to have dedicated hosts for control plane / worker / firewall)
-- `kamaji`: runs a variation of the `sonic` flavor. The working example is available at the [cluster-provider-metal-stack](https://github.com/metal-stack/cluster-api-provider-metal-stack)'s `capi-lab`.
-- `gardener`: runs the `sonic` flavor and installs the [Gardener](https://gardener.cloud) in the mini-lab
+- `kamaji`: runs a variation of the `sonic_vs` flavor. The working example is available at the [cluster-provider-metal-stack](https://github.com/metal-stack/cluster-api-provider-metal-stack)'s `capi-lab`.
+- `gardener`: runs the `sonic_vs` flavor and installs the [Gardener](https://gardener.cloud) in the mini-lab
 
 In order to start specific flavor, you can define the flavor as follows:
 
 ```bash
-export MINI_LAB_FLAVOR=sonic
+export MINI_LAB_FLAVOR=sonic_vs
 make
 ```
 
diff --git a/deploy_partition.yaml b/deploy_partition.yaml
index 2ad4de4d..de635061 100644
--- a/deploy_partition.yaml
+++ b/deploy_partition.yaml
@@ -7,7 +7,7 @@
     - name: Wait for system to become reachable
       ansible.builtin.wait_for_connection:
         delay: 10
-        timeout: 50
+        timeout: 120
   roles:
     - name: ansible-common
       tags: always
@@ -161,10 +161,6 @@
   hosts: dell_sonic
   any_errors_fatal: true
   become: true
-  pre_tasks:
-    - name: Wait some time
-      pause:
-        seconds: 120
   roles:
     - name: ansible-common
       tags: always
@@ -203,6 +199,54 @@
     - name: Wait until no route entries have "queued"
       include_tasks: tasks/check_queued.yaml
 
+- name: Work around isc-dhcp/Vlan4000 startup race (Community SONiC)
+  hosts: leaves:!dell_sonic
+  any_errors_fatal: true
+  gather_facts: false
+  tasks:
+    # dhcpd binds Vlan4000 at boot, before the SVI has carrier. Its LPF receive socket then dies
+    # ("receive_packet failed on Vlan4000: Network is down") while dhcpd stays up holding
+    # 0.0.0.0:67 -- so it answers nothing and PXE clients loop DISCOVER forever, never getting a
+    # lease. Restarting it once the underlay is up rebinds the socket, hence the placement after
+    # the underlay wait above.
+    #
+    # The probe solicits a real broadcast DISCOVER rather than poking 10.0.1.1:67, because the UDP
+    # socket stays healthy even when the LPF path is dead -- a unicast check would report a false
+    # pass. Restart and probe are deliberately one task: a retry must re-do the restart, not just
+    # re-probe, and `until` only retries a single task.
+    - name: Restart isc-dhcp-server until it serves an offer on Vlan4000
+      # passed as `cmd` and not as a free-form string, because Ansible runs free-form module
+      # arguments through its own quote-aware splitter before the shell ever sees them, and
+      # that splitter has no concept of comments -- a lone apostrophe in one aborts the play
+      ansible.builtin.shell:
+        executable: /bin/bash
+        cmd: |
+          systemctl restart isc-dhcp-server
+          sleep 2
+
+          # dhcp-server-detector is a pyroute2 >= 0.9.3 console script, and SONiC 202505 pins
+          # pyroute2 0.7.12, so fall back to dhclient there. dhclient has no timeout flag and
+          # ignores `timeout` from a config file -- it always waits ~60s -- hence timeout(1).
+          # -sf /bin/true keeps it from configuring the SVI, and on success it forks a renewing
+          # daemon with an empty pid file, so the leftover is killed by its exact command line.
+          # `pkill -x -f` matches the whole cmdline, so it cannot match the shell running this
+          # script the way a plain `pkill -f` would.
+          if command -v dhcp-server-detector >/dev/null; then
+            dhcp-server-detector Vlan4000 --exit-on-first-offer --duration 10
+          else
+            probe="dhclient -4 -1 -sf /bin/true -lf /run/dhcp-probe.leases -pf /run/dhcp-probe.pid Vlan4000"
+            timeout 15 $probe
+            rc=$?
+            pkill -x -f "$probe" || true
+            exit $rc
+          fi
+      when: dhcp_subnets is defined
+      register: dhcp_offer_check
+      until: dhcp_offer_check.rc == 0
+      retries: 10
+      delay: 5
+      changed_when: true
+
 - name: Configure IPv6 and LLDP ports (Enterprise SONiC)
   hosts: dell_sonic
   any_errors_fatal: true
diff --git a/files/exit/frr.conf b/files/exit/frr.conf
index 5a94dc6b..bf16e1dd 100644
--- a/files/exit/frr.conf
+++ b/files/exit/frr.conf
@@ -35,6 +35,11 @@ router bgp 4200000021
  !
  address-family ipv4 unicast
   redistribute connected route-map LOOPBACKS
+  ! PXE egress: hand the leaves a default so machine traffic routes over the fabric to us, and we
+  ! NAT it out eth0 (mgmt). NB this default is also installed into each leaf's KERNEL, which
+  ! redirects the leaf's OWN egress (pixiecore -> github/DNS) through us sourced from its loopback
+  ! -- that only works because network.sh MASQUERADEs everything leaving eth0. Don't drop that NAT.
+  neighbor FABRIC default-originate
  exit-address-family
  !
  address-family ipv6 unicast
diff --git a/files/exit/network.sh b/files/exit/network.sh
index 6ad64477..ca5800db 100644
--- a/files/exit/network.sh
+++ b/files/exit/network.sh
@@ -27,3 +27,19 @@ bridge vlan add vid 1000 untagged pvid dev vniInternet
 ip link set up dev vniInternet
 
 sysctl -w net.ipv6.conf.all.forwarding=1
+
+# PXE egress return-path NAT. Traffic reaching us over the fabric keeps its original source --
+# machines are 10.0.1.0/24, and the leaves' own traffic is sourced from their 10.0.0.0/24
+# loopbacks. The mgmt docker bridge only NATs 172.42.0.0/16, so anything we forward out eth0 must
+# be SNAT'd or the replies have no path back. Masquerade the whole interface rather than a single
+# prefix, so both the machine and leaf-originated ranges are covered.
+# The frr image ships no iptables; bounded + non-fatal on purpose, since this script runs under
+# `set -o errexit` and must never block exit bring-up if the package mirror is unreachable.
+for _ in 1 2 3 4 5; do
+	if apk add --no-cache iptables; then
+		iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
+		break
+	fi
+	echo "apk could not reach the mirror (iptables); retrying ..."
+	sleep 2
+done || true
diff --git a/files/sonic_frr_with_fpm.tpl b/files/sonic_frr_with_fpm.tpl
index 7019b34d..cab4f8a6 100644
--- a/files/sonic_frr_with_fpm.tpl
+++ b/files/sonic_frr_with_fpm.tpl
@@ -3,6 +3,12 @@ frr defaults datacenter
 # This is the only line changed from upstream: https://github.com/metal-stack/metal-core/blob/master/cmd/internal/switcher/templates/tpl/sonic_frr.tpl
 # Follow-up issue: https://github.com/metal-stack/metal-core/issues/199
 fpm address 127.0.0.1
+# SONiC default (upstream ships this in its zebra config; the metal-core template dropped it).
+# With next-hop-groups enabled (FRR's default under FPM), zebra hands fpmsyncd an NHG id instead
+# of inline nexthops, and the EVPN encap attrs (vni_label/router_mac, carried as RTA_ENCAP) are
+# lost -> ROUTE_TABLE loses vni_label/router_mac -> RouteOrch builds a plain IP nexthop instead of
+# TUNNEL_ENCAP.
+no fpm use-next-hop-groups
 hostname {{ .Name }}
 password zebra
 enable password zebra
diff --git a/images/sonic/Dockerfile.vpp b/images/sonic/Dockerfile.vpp
new file mode 100644
index 00000000..b0659514
--- /dev/null
+++ b/images/sonic/Dockerfile.vpp
@@ -0,0 +1,30 @@
+FROM docker.io/library/debian:bookworm-backports
+
+ENV LIBGUESTFS_BACKEND=direct
+
+RUN apt-get update && \
+    apt-get --no-install-recommends install --yes \
+        curl \
+        libpcap0.8 \
+        iproute2 \
+        linux-image-cloud-amd64 \
+        python3 \
+        python3-pip \
+        python3-guestfs \
+        python3-scapy \
+        qemu-system-x86 \
+        telnet
+
+COPY requirements.txt /
+RUN pip install --break-system-packages -r requirements.txt
+
+COPY --from=docker.io/l0wl3vel/mini-lab-sonic-base:vpp-integration /sonic-vs.img /sonic-vs.img
+COPY --from=docker.io/l0wl3vel/mini-lab-sonic-base:vpp-integration /frr-pythontools.deb /frr-pythontools.deb
+
+ENTRYPOINT ["/launch.py"]
+
+COPY mirror_tap_to_eth.sh mirror_tap_to_front_panel.sh port_config.ini launch.py /
+
+# Readiness now waits for the dataplane (front-panel LLDP), which converges later than the
+# mgmt plane, so allow more time before the container is considered unhealthy.
+HEALTHCHECK --start-period=30s --interval=5s --retries=40 CMD test -f /healthy
diff --git a/images/sonic/Dockerfile b/images/sonic/Dockerfile.vs
similarity index 89%
rename from images/sonic/Dockerfile
rename to images/sonic/Dockerfile.vs
index 9565c738..0831bc40 100644
--- a/images/sonic/Dockerfile
+++ b/images/sonic/Dockerfile.vs
@@ -9,11 +9,15 @@ RUN apt-get update && \
         iproute2 \
         linux-image-cloud-amd64 \
         python3 \
+        python3-pip \
         python3-guestfs \
         python3-scapy \
         qemu-system-x86 \
         telnet
 
+COPY requirements.txt /
+RUN pip install --break-system-packages -r requirements.txt
+
 COPY --from=ghcr.io/metal-stack/mini-lab-sonic-base:202505 /sonic-vs.img /sonic-vs.img
 COPY --from=ghcr.io/metal-stack/mini-lab-sonic-base:202505 /frr-pythontools.deb /frr-pythontools.deb
 
diff --git a/images/sonic/README.md b/images/sonic/README.md
new file mode 100644
index 00000000..ecc5d770
--- /dev/null
+++ b/images/sonic/README.md
@@ -0,0 +1,12 @@
+# Virtual Sonic Images
+
+We use sonic-vpp to emulate SONiC switches. It is running in kvm inside a containerlab container. To provide better emulation accuracy we use sonic-vpp, which used the Vector Package Processor to emulate somthing like a switch ASIC, like the Broadcom Tomahawk 3 used in our Edgecore Accton AS7726-X32 workhorse we use in production. We migrated to sonic-vpp because the sonic-vs image used mostly netlink primitives, which behaved differently than an ASIC driven through SONiCs SAI layer.  It's slower but still sane.
+
+
+# Configuration knobs
+
+You can edit the port_config.ini to add more ports.
+
+
+# Boot process
+The switch will boot with a default first-boot configuration. This is required since first boot will generate some required configuration for VPP. After a short while the configuration that is generated in launch.py is injected and the sonic is reloaded. After the new configuration is loaded the container will be marked ready. Check the docker logs for errors if bootup takes more than a minute. 
\ No newline at end of file
diff --git a/images/sonic/base-vpp/Dockerfile b/images/sonic/base-vpp/Dockerfile
new file mode 100644
index 00000000..fd0de804
--- /dev/null
+++ b/images/sonic/base-vpp/Dockerfile
@@ -0,0 +1,32 @@
+# Check: https://sonic-build.azurewebsites.net/ui/sonic/pipelines
+ARG SONIC_BRANCH=master
+ARG SONIC_BASE_URL=https://sonic-build.azurewebsites.net/api/sonic/artifacts?branchName=${SONIC_BRANCH}&definitionId=2818&artifactName=sonic-buildimage.vpp
+ARG SONIC_IMG_URL=${SONIC_BASE_URL}&target=target%2Fsonic-vpp.img.gz
+ARG FRR_RELOAD_URL=${SONIC_BASE_URL}&target=target%2Fdebs%2Fbookworm%2Ffrr-pythontools_10.5.4-sonic-0_all.deb
+
+FROM docker.io/library/busybox:stable AS download
+
+ARG SONIC_IMG_URL
+ARG FRR_RELOAD_URL
+
+# TODO: There is no pipeline for
+# https://github.com/l0wl3vel/sonic-buildimage/tree/vpp-integration. Build it. Place the
+# sonic-vpp.img.gz and frr-pythontools_10.5.4-sonic-0_all.deb artifacts here.
+# If you need sonic-vpp source code changes yell at @l0wl3vel to push a fresh image: 
+# docker build -t docker.io/l0wl3vel/mini-lab-sonic-base:vpp-integration images/sonic/base-vpp
+# docker push docker.io/l0wl3vel/mini-lab-sonic-base:vpp-integration
+ADD ./sonic-vpp.img.gz /sonic-vs.img.gz
+ADD ./frr-pythontools_10.5.4-sonic-0_all.deb /frr-pythontools.deb
+
+RUN gunzip /sonic-vs.img.gz
+
+FROM scratch
+
+ARG SONIC_IMG_URL
+ARG FRR_RELOAD_URL
+
+LABEL sonic-img-url=${SONIC_IMG_URL} \
+      frr-reload-url=${FRR_RELOAD_URL}
+
+COPY --from=download /frr-pythontools.deb /frr-pythontools.deb
+COPY --from=download /sonic-vs.img /sonic-vs.img
diff --git a/images/sonic/launch.py b/images/sonic/launch.py
index 41926f3c..b057b065 100755
--- a/images/sonic/launch.py
+++ b/images/sonic/launch.py
@@ -10,6 +10,7 @@
 import struct
 import subprocess
 import sys
+import telnetlib3
 import time
 from typing import Callable
 
@@ -48,7 +49,15 @@ def guestfs(self) -> GuestFS:
         g = guestfs.GuestFS(python_return_dict=True)
         g.add_drive_opts(filename=self._disk, format="qcow2", readonly=False)
         g.launch()
-        g.mount('/dev/sda3', '/')
+        # SONiC stores its rootfs as a read-only squashfs at /image-*/fs.squashfs;
+        # the sibling rw/ tree only holds overlay overrides. Use mkmountpoint so
+        # we can expose both: the writable partition under /disk and the base
+        # rootfs (loop-mounted from fs.squashfs) under /rootfs.
+        g.mkmountpoint('/disk')
+        g.mkmountpoint('/rootfs')
+        g.mount('/dev/sda3', '/disk')
+        image = g.glob_expand('/disk/image-*')[0]
+        g.mount_loop(image + 'fs.squashfs', '/rootfs')
         return g
 
     def start(self) -> None:
@@ -64,6 +73,7 @@ def start(self) -> None:
             '-m', self._memory,
             '-drive', f'if=virtio,format=qcow2,file={self._disk}',
             '-serial', 'telnet:127.0.0.1:5000,server,nowait',
+            '-device', 'virtio-balloon,free-page-reporting=on',
         ]
 
         with open(f'/sys/class/net/eth0/address', 'r') as f:
@@ -89,73 +99,35 @@ def wait(self) -> None:
 
 
 def initial_configuration(g: GuestFS, hwsku: str) -> None:
-    image = g.glob_expand('/image-*')[0]
-
-    g.rm(image + 'platform/firsttime')
-
-    systemd_system = image + 'rw/etc/systemd/system/'
-    sonic_target_wants = systemd_system + 'sonic.target.wants/'
-    g.mkdir_p(sonic_target_wants)
-
+    image = g.glob_expand('/disk/image-*')[0]
     # Copy frr-pythontools into the image
+    g.mkdir_p(image + 'rw/')
     g.copy_in(localpath='/frr-pythontools.deb', remotedir=image + 'rw/')
 
-    # Workaround: Speed up lldp startup by remove hardcoded wait of 90 seconds
-    g.ln_s(linkname=systemd_system + 'aaastatsd.timer', target='/dev/null') # Radius
-    # NOTE: featured.timer and hostcfgd.timer are intentionally NOT masked. They run
-    # SONiC's feature-manager and host-config reconciliation and provide the startup
-    # ordering that EVPN/FRR bring-up relies on. Masking them raced the remote L3VNI
-    # VTEP RMAC programming on the leaves, which then required a manual
-    # `systemctl restart bgp` to recover. lldp/pmon are still hand-wired below so they
-    # start immediately instead of waiting for featured's delayed timer.
-    g.ln_s(linkname=systemd_system + 'rasdaemon.timer', target='/dev/null') # After boot Host configuration
-    g.ln_s(linkname=systemd_system + 'tacacs-config.timer', target='/dev/null') # After boot Host configuration
-    # Started by featured
-    g.ln_s(linkname=sonic_target_wants + 'lldp.service', target='/lib/systemd/system/lldp.service')
-    g.ln_s(linkname=systemd_system + 'pmon.service', target='/lib/systemd/system/pmon.service')
-    g.ln_s(linkname=sonic_target_wants + 'pmon.service', target='/lib/systemd/system/pmon.service')
-
-    # Workaround: Only useful for BackEndToRRouter
-    g.ln_s(linkname=systemd_system + 'backend-acl.service', target='/dev/null')
-
-    # Workaround: We don't need LACP
-    g.ln_s(linkname=systemd_system + 'teamd.service', target='/dev/null')
-
     # Workaround: Python module sonic_platform not present on vs images
+    systemd_system = image + 'rw/etc/systemd/system/'
+    g.mkdir_p(systemd_system)
     g.ln_s(linkname=systemd_system + 'system-health.service', target='/dev/null')
     g.ln_s(linkname=systemd_system + 'watchdog-control.service', target='/dev/null')
 
     sonic_share = image + 'rw/usr/share/sonic/'
-    hwsku_dir = image + 'rw' + VS_DEVICES_PATH + hwsku
-    g.mkdir_p(hwsku_dir)
-
-    g.write(path=image + 'rw' + VS_DEVICES_PATH + 'default_sku', content=f'{hwsku} empty'.encode('utf-8'))
-    g.ln_s(linkname=sonic_share + 'hwsku', target=VS_DEVICES_PATH + hwsku)
-    g.ln_s(linkname=sonic_share + 'platform', target=VS_DEVICES_PATH)
+    platform_dir = image + 'rw' + VS_DEVICES_PATH
+    g.mkdir_p(platform_dir)
+    g.write(path=platform_dir + '/default_sku', content=f'{hwsku} empty'.encode('utf-8'))
 
-    ifaces = get_ethernet_interfaces()
-    # The port_config.ini file contains the assignment of front panels to lanes.
-    port_config = parse_port_config()
     # The lanemap.ini file is used by the virtual switch image to assign front panels to the Linux interfaces ethX.
     # This assignment will later also be used by the script mirror_tap_to_front_panel.sh.
+    # Dynamic breakouts are not implemented in sonic-vs/sonic-vpp
+    ifaces = get_ethernet_interfaces()
+    port_config = parse_port_config()
     lanemap = create_lanemap(port_config, ifaces)
     with open('/lanemap.ini', 'w') as f:
         f.write('\n'.join(lanemap))
 
-    g.copy_in(localpath='/lanemap.ini', remotedir=hwsku_dir)
-    g.copy_in(localpath='/port_config.ini', remotedir=hwsku_dir)
-
-    etc_sonic = image + 'rw/etc/sonic/'
-    g.mkdir_p(etc_sonic)
-    sonic_version = image.removeprefix('/image-').removesuffix('/')
-    sonic_environment = f'''
-        SONIC_VERSION=${sonic_version}
-        PLATFORM=x86_64-kvm_x86_64-r0
-        HWSKU={hwsku}
-        DEVICE_TYPE=LeafRouter
-        ASIC_TYPE=vs
-        '''.encode('utf-8')
-    g.write(path=etc_sonic + 'sonic-environment', content=sonic_environment)
+    hwsku_dir_rw = image + 'rw' + VS_DEVICES_PATH + hwsku
+    g.mkdir_p(hwsku_dir_rw)
+    g.copy_in(localpath='/lanemap.ini', remotedir=hwsku_dir_rw)
+    g.copy_in(localpath='/port_config.ini', remotedir=hwsku_dir_rw)
 
     config_db = create_config_db(hwsku)
     ports = {}
@@ -168,7 +140,7 @@ def initial_configuration(g: GuestFS, hwsku: str) -> None:
     config_db['PORT'] = ports
     config_db_json = json.dumps(config_db, indent=4, sort_keys=True)
 
-    g.write(path=etc_sonic + 'config_db.json', content=config_db_json.encode('utf-8'))
+    g.write(path=image + 'rw/init_config_db.json', content=config_db_json.encode('utf-8'))
 
     if os.path.exists('/authorized_keys'):
         g.mkdir_p(image + 'rw/root/.ssh')
@@ -185,8 +157,8 @@ def main():
     logger = logging.getLogger()
 
     name = os.getenv('CLAB_LABEL_CLAB_NODE_NAME', default='switch')
-    smp = os.getenv('QEMU_SMP', default='2')
-    memory = os.getenv('QEMU_MEMORY', default='2048')
+    smp = os.getenv('QEMU_SMP', default='4')
+    memory = os.getenv('QEMU_MEMORY', default='4096')
     interfaces = int(os.getenv('CLAB_INTFS', 0)) + 1
     hwsku = os.getenv('HWSKU', default='Accton-AS7726-32X')
 
@@ -207,6 +179,8 @@ def main():
     logger.info('Start QEMU')
     vm.start()
 
+    apply_init_config_via_serial(logger)
+
     # Readiness: wait until SONiC forwards its own LLDP out a *front-panel* port, not just
     # mgmt eth0. LLDP egress on a front-panel port requires PortConfigDone AND the port to
     # be programmed/oper-up in the (v)ASIC dataplane, so this signals dataplane readiness
@@ -229,6 +203,54 @@ def handle_exit(signal, frame):
     sys.exit(0)
 
 
+def apply_init_config_via_serial(logger) -> None:
+    logger.info('Connecting to SONiC serial console on 127.0.0.1:5000')
+    while True:
+        try:
+            tn = telnetlib3.Telnet('127.0.0.1', 5000, timeout=600)
+            break
+        except ConnectionRefusedError:
+            time.sleep(1)
+
+    def send(data: bytes, *, redact: bool = False) -> None:
+        display = '***' if redact else data.rstrip(b'\n').decode('utf-8', errors='replace')
+        logger.info(f'serial> {display}')
+        tn.write(data)
+
+    def read_until(marker: bytes, timeout: int) -> str:
+        text = tn.read_until(marker, timeout=timeout).decode('utf-8', errors='replace')
+        for line in text.splitlines():
+            stripped = line.rstrip()
+            if stripped:
+                logger.info(f'serial< {stripped}')
+        return text
+
+    logger.info('Waiting for login prompt')
+    read_until(b'login: ', timeout=600)
+    send(b'admin\n')
+
+    read_until(b'Password: ', timeout=60)
+    send(b'YourPaSsWoRd\n', redact=True)
+
+    read_until(b'$ ', timeout=60)
+
+    # hacked together system readiness check since show system-health does not work in virtual sonic
+    # stolen from https://github.com/sonic-net/sonic-utilities/blob/master/config/main.py
+    logger.info('Waiting for systemctl is-system-running to return running')
+    while True:
+        send(b'sudo systemctl is-system-running\n')
+        text = read_until(b'$ ', timeout=30)
+        if any(line.strip() == 'running' for line in text.splitlines()):
+            break
+        time.sleep(5)
+
+    logger.info('Installing intial config_db.json')
+    send(b'sudo config reload -f -y /init_config_db.json \n')
+    read_until(b'$ ', timeout=60)
+
+    tn.close()
+
+
 def wait_until_all_interfaces_are_connected(interfaces: int) -> None:
     while True:
         i = 0
@@ -343,18 +365,20 @@ def create_config_db(hwsku: str) -> dict:
             }
         },
         'FEATURE': {
-            'gnmi': {
-                'state': 'disabled'
-            },
             'mgmt-framework': {
                 'state': 'disabled'
             },
             'snmp': {
                 'state': 'disabled'
-            },
-            'teamd': {
-                'state': 'disabled'
             }
+            # teamd must stay enabled: hostcfgd masks the unit of a disabled
+            # feature, but swss.sh still picks teamd up as a dependency because
+            # check_service_exists finds masked units as well. docker-wait-any
+            # then returns immediately since the teamd container never runs,
+            # which makes systemd restart swss every ~110s. Each restart
+            # recreates Vlan4000, and isc-dhcp-server dies deaf on it
+            # ("receive_packet failed on Vlan4000: Network is down"), so
+            # machines never get a PXE lease.
         },
         'MGMT_INTERFACE': {
             f'eth0|{mgmt_interface_cidr}': {
@@ -367,11 +391,13 @@ def create_config_db(hwsku: str) -> dict:
                 'admin_status': 'up'
             }
         },
-        'VERSIONS': {
-            'DATABASE': {
-                'VERSION': 'version_202311_03'
+        'LLDP': {
+            'GLOBAL': {
+                'enabled': 'true',
+                'hello_time': '10'
             }
         }
+
     }
 
 
diff --git a/images/sonic/mirror_tap_to_front_panel.sh b/images/sonic/mirror_tap_to_front_panel.sh
index 4f8c6aa9..4b4a2f02 100755
--- a/images/sonic/mirror_tap_to_front_panel.sh
+++ b/images/sonic/mirror_tap_to_front_panel.sh
@@ -4,23 +4,27 @@
 # Read it for better understanding
 
 TAP_IF=$1
-# get interface index number up to 3 digits (everything after first three chars)
-# tap0 -> 0
-# tap123 -> 123
+# tap0 -> 0 ... tap123 -> 123 ; tap$INDEX is guest interface eth$INDEX
 INDEX=${TAP_IF:3:3}
 
-# tap$INDEX corresponds to eth$INDEX in the virtual machine
-# The virtual switch assigns lanes to the Linux interface ethX. The assignment is specified in the lanemap.ini file in the following format: ethX:<lanes>.
-LANES=$(grep ^eth$INDEX: /lanemap.ini | cut -d':' -f2)
-# Identify the front panel using the lanes.
-FRONT_PANEL=$(grep -E "^Ethernet[0-9]+\s+$LANES\s+Eth" /port_config.ini | cut -d' ' -f1)
+# sonic-vpp assigns guest NICs to front panels strictly by their order in
+# port_config.ini: guest eth$INDEX is the $INDEX-th front panel. Mirror this tap
+# to the clab link (named after that front panel) using the SAME order. This is
+# independent of how interface names happen to sort (Ethernet4 vs Ethernet12/16,
+# breakout sub-ports, ...), which is what the lanemap-based lookup got wrong.
+FRONT_PANEL=$(awk '$1 ~ /^Ethernet/ {print $1}' /port_config.ini | sed -n "${INDEX}p")
 
-ip link set $TAP_IF up
-ip link set $TAP_IF mtu 65000
+if [ -z "$FRONT_PANEL" ]; then
+    echo "mirror_tap_to_front_panel: no port_config.ini entry #${INDEX} for ${TAP_IF}" >&2
+    exit 1
+fi
+
+ip link set "$TAP_IF" up
+ip link set "$TAP_IF" mtu 65000
 
 # create tc Ethernet<->tap redirect rules
-tc qdisc add dev $FRONT_PANEL ingress
-tc filter add dev $FRONT_PANEL parent ffff: protocol all u32 match u8 0 0 action mirred egress redirect dev $TAP_IF
+tc qdisc add dev "$FRONT_PANEL" ingress
+tc filter add dev "$FRONT_PANEL" parent ffff: protocol all u32 match u8 0 0 action mirred egress redirect dev "$TAP_IF"
 
-tc qdisc add dev $TAP_IF ingress
-tc filter add dev $TAP_IF parent ffff: protocol all u32 match u8 0 0 action mirred egress redirect dev $FRONT_PANEL
+tc qdisc add dev "$TAP_IF" ingress
+tc filter add dev "$TAP_IF" parent ffff: protocol all u32 match u8 0 0 action mirred egress redirect dev "$FRONT_PANEL"
diff --git a/images/sonic/port_config.ini b/images/sonic/port_config.ini
index acc1f3d2..0aeca974 100644
--- a/images/sonic/port_config.ini
+++ b/images/sonic/port_config.ini
@@ -1,123 +1,7 @@
+# sonic-vpp uses a simple script to generate vpp interfaces from the port_config.init on first boot
+# No breakouts are supported and it always expects Ethernet$(4*n) as port names
+# Just continue the pattern if you want vpp to not crash
 # name          lanes                 alias        index  speed
-Ethernet0       1                     Eth1/1       1      25000
-Ethernet1       2                     Eth1/2       1      25000
-Ethernet2       3                     Eth1/3       1      25000
-Ethernet3       4                     Eth1/4       1      25000
-Ethernet4       5                     Eth2/1       2      25000
-Ethernet5       6                     Eth2/2       2      25000
-Ethernet6       7                     Eth2/3       2      25000
-Ethernet7       8                     Eth2/4       2      25000
-Ethernet8       9                     Eth3/1       3      25000
-Ethernet9       10                    Eth3/2       3      25000
-Ethernet10      11                    Eth3/3       3      25000
-Ethernet11      12                    Eth3/4       3      25000
-Ethernet12      13                    Eth4/1       4      25000
-Ethernet13      14                    Eth4/2       4      25000
-Ethernet14      15                    Eth4/3       4      25000
-Ethernet15      16                    Eth4/4       4      25000
-Ethernet16      17                    Eth5/1       5      25000
-Ethernet17      18                    Eth5/2       5      25000
-Ethernet18      19                    Eth5/3       5      25000
-Ethernet19      20                    Eth5/4       5      25000
-Ethernet20      21                    Eth6/1       6      25000
-Ethernet21      22                    Eth6/2       6      25000
-Ethernet22      23                    Eth6/3       6      25000
-Ethernet23      24                    Eth6/4       6      25000
-Ethernet24      25                    Eth7/1       7      25000
-Ethernet25      26                    Eth7/2       7      25000
-Ethernet26      27                    Eth7/3       7      25000
-Ethernet27      28                    Eth7/4       7      25000
-Ethernet28      29                    Eth8/1       8      25000
-Ethernet29      30                    Eth8/2       8      25000
-Ethernet30      31                    Eth8/3       8      25000
-Ethernet31      32                    Eth8/4       8      25000
-Ethernet32      33                    Eth9/1       9      25000
-Ethernet33      34                    Eth9/2       9      25000
-Ethernet34      35                    Eth9/3       9      25000
-Ethernet35      36                    Eth9/4       9      25000
-Ethernet36      37                    Eth10/1      10     25000
-Ethernet37      38                    Eth10/2      10     25000
-Ethernet38      39                    Eth10/3      10     25000
-Ethernet39      40                    Eth10/4      10     25000
-Ethernet40      41                    Eth11/1      11     25000
-Ethernet41      42                    Eth11/2      11     25000
-Ethernet42      43                    Eth11/3      11     25000
-Ethernet43      44                    Eth11/4      11     25000
-Ethernet44      45                    Eth12/1      12     25000
-Ethernet45      46                    Eth12/2      12     25000
-Ethernet46      47                    Eth12/3      12     25000
-Ethernet47      48                    Eth12/4      12     25000
-Ethernet48      49                    Eth13/1      13     25000
-Ethernet49      50                    Eth13/2      13     25000
-Ethernet50      51                    Eth13/3      13     25000
-Ethernet51      52                    Eth13/4      13     25000
-Ethernet52      53                    Eth14/1      14     25000
-Ethernet53      54                    Eth14/2      14     25000
-Ethernet54      55                    Eth14/3      14     25000
-Ethernet55      56                    Eth14/4      14     25000
-Ethernet56      57                    Eth15/1      15     25000
-Ethernet57      58                    Eth15/2      15     25000
-Ethernet58      59                    Eth15/3      15     25000
-Ethernet59      60                    Eth15/4      15     25000
-Ethernet60      61                    Eth16/1      16     25000
-Ethernet61      62                    Eth16/2      16     25000
-Ethernet62      63                    Eth16/3      16     25000
-Ethernet63      64                    Eth16/4      16     25000
-Ethernet64      65                    Eth17/1      17     25000
-Ethernet65      66                    Eth17/2      17     25000
-Ethernet66      67                    Eth17/3      17     25000
-Ethernet67      68                    Eth17/4      17     25000
-Ethernet68      69                    Eth18/1      18     25000
-Ethernet69      70                    Eth18/2      18     25000
-Ethernet70      71                    Eth18/3      18     25000
-Ethernet71      72                    Eth18/4      18     25000
-Ethernet72      73                    Eth19/1      19     25000
-Ethernet73      74                    Eth19/2      19     25000
-Ethernet74      75                    Eth19/3      19     25000
-Ethernet75      76                    Eth19/4      19     25000
-Ethernet76      77                    Eth20/1      20     25000
-Ethernet77      78                    Eth20/2      20     25000
-Ethernet78      79                    Eth20/3      20     25000
-Ethernet79      80                    Eth20/4      20     25000
-Ethernet80      81                    Eth21/1      21     25000
-Ethernet81      82                    Eth21/2      21     25000
-Ethernet82      83                    Eth21/3      21     25000
-Ethernet83      84                    Eth21/4      21     25000
-Ethernet84      85                    Eth22/1      22     25000
-Ethernet85      86                    Eth22/2      22     25000
-Ethernet86      87                    Eth22/3      22     25000
-Ethernet87      88                    Eth22/4      22     25000
-Ethernet88      89                    Eth23/1      23     25000
-Ethernet89      90                    Eth23/2      23     25000
-Ethernet90      91                    Eth23/3      23     25000
-Ethernet91      92                    Eth23/4      23     25000
-Ethernet92      93                    Eth24/1      24     25000
-Ethernet93      94                    Eth24/2      24     25000
-Ethernet94      95                    Eth24/3      24     25000
-Ethernet95      96                    Eth24/4      24     25000
-Ethernet96      97                    Eth25/1      25     25000
-Ethernet97      98                    Eth25/2      25     25000
-Ethernet98      99                    Eth25/3      25     25000
-Ethernet99      100                   Eth25/4      25     25000
-Ethernet100     101                   Eth26/1      26     25000
-Ethernet101     102                   Eth26/2      26     25000
-Ethernet102     103                   Eth26/3      26     25000
-Ethernet103     104                   Eth26/4      26     25000
-Ethernet104     105                   Eth27/1      27     25000
-Ethernet105     106                   Eth27/2      27     25000
-Ethernet106     107                   Eth27/3      27     25000
-Ethernet107     108                   Eth27/4      27     25000
-Ethernet108     109                   Eth28/1      28     25000
-Ethernet109     110                   Eth28/2      28     25000
-Ethernet110     111                   Eth28/3      28     25000
-Ethernet111     112                   Eth28/4      28     25000
-Ethernet112     113                   Eth29/1      29     25000
-Ethernet113     114                   Eth29/2      29     25000
-Ethernet114     115                   Eth29/3      29     25000
-Ethernet115     116                   Eth29/4      29     25000
-Ethernet116     117                   Eth30/1      30     25000
-Ethernet117     118                   Eth30/2      30     25000
-Ethernet118     119                   Eth30/3      30     25000
-Ethernet119     120                   Eth30/4      30     25000
-Ethernet120     121,122,123,124       Eth31        31     100000
-Ethernet124     125,126,127,128       Eth32        32     100000
+Ethernet0       1,2,3,4               Eth1         1      100000
+Ethernet4       5,6,7,8               Eth2         2      100000
+Ethernet8       9,10,11,12            Eth3         3      100000
\ No newline at end of file
diff --git a/images/sonic/requirements.txt b/images/sonic/requirements.txt
new file mode 100644
index 00000000..4973e51b
--- /dev/null
+++ b/images/sonic/requirements.txt
@@ -0,0 +1 @@
+telnetlib3~=4.0.4
\ No newline at end of file
diff --git a/inventories/group_vars/leaves/main.yaml b/inventories/group_vars/leaves/main.yaml
index e1d1e596..765c3bec 100644
--- a/inventories/group_vars/leaves/main.yaml
+++ b/inventories/group_vars/leaves/main.yaml
@@ -4,7 +4,7 @@ dhcp_listening_interfaces:
 
 metal_core_cidr_mask: 25
 metal_core_spine_uplinks:
-  - Ethernet120
+  - Ethernet8
 
 sonic_config_docker_routing_config_mode: split-unified
 sonic_config_frr_render: false
diff --git a/mini-lab.sonic.yaml b/mini-lab.sonic.yaml
index a14ad7e0..44d7e8fd 100644
--- a/mini-lab.sonic.yaml
+++ b/mini-lab.sonic.yaml
@@ -10,7 +10,6 @@ topology:
   nodes:
     exit:
       image: quay.io/frrouting/frr:10.3.0
-      network-mode: none
       binds:
         - files/exit/daemons:/etc/frr/daemons
         - files/exit/frr.conf:/etc/frr/frr.conf
@@ -58,7 +57,7 @@ topology:
       mtu: 9000
     - endpoints: ["leaf01:Ethernet0", "machine01:lan0"]
     - endpoints: ["leaf02:Ethernet0", "machine01:lan1"]
-    - endpoints: ["leaf01:Ethernet1", "machine02:lan0"]
-    - endpoints: ["leaf02:Ethernet1", "machine02:lan1"]
-    - endpoints: ["leaf01:Ethernet120", "exit:eth1"]
-    - endpoints: ["leaf02:Ethernet120", "exit:eth2"]
+    - endpoints: ["leaf01:Ethernet4", "machine02:lan0"]
+    - endpoints: ["leaf02:Ethernet4", "machine02:lan1"]
+    - endpoints: ["leaf01:Ethernet8", "exit:eth1"]
+    - endpoints: ["leaf02:Ethernet8", "exit:eth2"]
diff --git a/roles/sonic/tasks/fix-network-performance.yaml b/roles/sonic/tasks/fix-network-performance.yaml
index c1ccac0a..c8ec3cbc 100644
--- a/roles/sonic/tasks/fix-network-performance.yaml
+++ b/roles/sonic/tasks/fix-network-performance.yaml
@@ -1,4 +1,32 @@
 ---
+# GRO must stay off on the front panel NICs. This is not a cosmetic tuning knob,
+# it is load bearing: with GRO on, the underlay collapses to ~0.9 MB/s and a
+# machine can never finish downloading the metal-hammer initrd, so it never
+# leaves "PXE Booting".
+#
+# Why: sonic-vs forwards frames in userspace. syncd reads them from an AF_PACKET
+# socket on ethX and copies the raw bytes into the EthernetX tap. GRO merges
+# several TCP segments into one skb but does not rewrite the on-wire TCP
+# checksum, because validity is tracked in skb metadata that a raw byte copy
+# discards. The receiving kernel re-validates the merged frame, the checksum no
+# longer matches, and the segment is dropped silently - visible only as
+# TcpInCsumErrors. TCP sees real loss (no DSACK), cwnd collapses to 2 and stays
+# there.
+#
+# Measured on the leaf01 <-> leaf02 underlay:
+#   GRO on:  0.89 MB/s, cwnd 2, 26% of bytes retransmitted
+#   GRO off: 7.18 MB/s, cwnd 42, 0 retransmissions
+# Pulling the initrd through the fabric: 0.125 MB/s -> 11.4 MB/s.
+#
+# Note there is no tc-based alternative. containerlab/vrnetlab hit the same
+# class of bug on their management datapath and fixed it with
+# "tc ... action csum ... pipe action mirred" (srl-labs/vrnetlab#492), but that
+# only repairs a copy that tc itself performs. Our corruption happens later, in
+# syncd's userspace memcpy inside the guest, where there is no tc hook to attach
+# a csum action to. Disabling GRO is the only lever.
+#
+# Added in mini-lab#200, silently lost again in 4284272 - please do not comment
+# this out without re-reading the above.
 - name: Collect facts about interfaces
   ansible.builtin.setup:
     gather_subset:
diff --git a/roles/sonic/tasks/main.yaml b/roles/sonic/tasks/main.yaml
index c8ee8460..a5e52127 100644
--- a/roles/sonic/tasks/main.yaml
+++ b/roles/sonic/tasks/main.yaml
@@ -2,16 +2,12 @@
 - name: Install frr-pythontools
   ansible.builtin.import_tasks: frr-reload.yaml
 
+# Disables GRO on the front panel NICs. Required for the sonic-vs dataplane to
+# forward without corrupting TCP checksums - without it machines never finish
+# PXE booting. See the comment in the imported file before touching this.
 - name: Fix Network Performance
   ansible.builtin.import_tasks: fix-network-performance.yaml
 
-- name: Set lldp tx-interval to 10
-  ansible.builtin.command: lldpcli configure lldp tx-interval 10
-  retries: 10
-  delay: 3
-  register: result
-  until: result.rc == 0
-
 - name: Activate IP MASQUERADE on eth0
   ansible.builtin.iptables:
     chain: POSTROUTING
@@ -26,9 +22,9 @@
     sysctl_set: yes
     value: "1"
 
-# We need to fill some values for the sonic-exporter (uses the STATE_DB)
-- name: Mock sonic platform for kvm
-  ansible.builtin.import_tasks: mock-platform.yaml
+# # We need to fill some values for the sonic-exporter (uses the STATE_DB)
+# - name: Mock sonic platform for kvm
+#   ansible.builtin.import_tasks: mock-platform.yaml
 
 # ntp restarting for monitoring -> otherwise some NodeTimeOutOfSync error
 - name: restart chrony
diff --git a/scripts/deactivate_offloading.sh b/scripts/deactivate_offloading.sh
deleted file mode 100755
index 987a87df..00000000
--- a/scripts/deactivate_offloading.sh
+++ /dev/null
@@ -1,7 +0,0 @@
-#!/usr/bin/env bash
-
-for docker_container_id in $(docker ps | grep ignite | awk '{ print $1 }');
-do
-    echo "deactivate offloading at veth of leaf switch in docker container ${docker_container_id}"
-    docker exec "${docker_container_id}" ethtool --offload vm_eth0 tx off
-done;