Environment:

VyOS 2026.03, circinus, x86_64 VMware

Kernel: 6.6.128-vyos

ipt_NETFLOW: 2.6-67-g6135551-dirty

Module srcversion: 15226500E2285DB0FDB8065

Observed behavior:
A receiver-side NetFlow v9 capture contains 250 export datagrams and 4,969 decoded flow records. Every flow record has zero packets and positive bytes. Templates declare IE2/IN_PKTS as 4 bytes and IE1/IN_BYTES as 8 bytes.

A separate NetFlow v5 capture contains 3,510 records, all with positive packet counts. Collector throughput reporting matches expectations with v5 but substantially underreports with v9 and IPFIX. IPFIX packet contents have not yet been independently captured and checked.

The v9 capture contains no visible IPv4 fragmentation or export sequence gaps within the captured window.

Binary analysis:
The supplied ipt_NETFLOW.ko loads the internal 32-bit packet counter, performs a 64-bit byte swap, and stores 8 bytes into the 4-byte packet-count field. The following byte-count field overwrites the lower half, leaving the exported packet count zero.

Expected behavior:
Exported packet counts should reflect the packets accounted for in each flow. The encoded value must match the field width advertised in the template. A 4-byte counter is valid; the mismatch between the declared width and the write is the defect.

Validation:
A local binary patch changing the packet-counter swap/store to 32 bits passed 656 instruction-emulation cases. It has not been loaded or tested on the router because CONFIG_MODULE_SIG_FORCE=y requires a trusted signature.

The encoding defect is confirmed by the supplied binary and v9 capture. Whether correcting it fully resolves collector throughput reporting remains to be validated.

Workaround:
NetFlow v5 produces positive packet counts and expected IPv4 throughput reporting, but does not provide IPv6 flow export.

Request:
Please verify the source and downstream patches used for this build, correct the packet-counter field-width mismatch, and provide a signed replacement module or corrected image. Please identify any existing tracking issue or release containing the fix.