rdmpw3265m: UI hang + Tailscale down traced to Wi-Fi chip trap storm; Wi-Fi disabled

Summary: The Broadcom Wi-Fi/BT chip on rdmpw3265m trapped 125× in one minute (23:16 EDT), which crashed bluetoothd and the Tailscale network extension at 23:18:06. I turned Wi-Fi off on this wired-only host, and Tailscale now connects directly in 1 ms.

• Window: 2026-09-25 23:37 → 23:50 EDT. Work done from rdmsm4x over ssh to rdmpw3265m.
• Ticket: ISSUE-20260925-25 (INCIDENT, resolved)
• Trigger: Rich hard-rebooted rdmpw3265m at about 23:35 (mouse moved, UI hung, Tailscale down). It was the second forced reboot that evening; the first was at 22:26.

Evidence

• corecaptured logged watchdog@BCMWLAN Chip Trap 125× at 23:16, and 108× during the 04:00 hour.
• At 23:18:06, bluetoothd aborted (Application Triggered Fault) and io.tailscale.ipn.macsys.network-extension 1.102.4 hit SIGABRT in the same second.
• Wi-Fi en2 was on and associated as 10.0.4.39, in parallel with en0 10GBase-T 192.168.1.53, which carries the default route.
• cloudd and corespotlightd each wrote 8.6 GB within 5–8 minutes during the hang window.
• No panic and no .hang report. Previous shutdown cause was 1 (normal).

Change

• On rdmpw3265m: sudo networksetup -setairportpower en2 off
• Undo: sudo networksetup -setairportpower en2 on

Verification (23:47 EDT)

• Wi-Fi power is Off, en2 is inactive, and the default route is on en0.
• tailscale ping rdmpw3265m goes direct via 192.168.1.53:41641 in 1 ms (it was going through the NYC relay before).
• The syslog UDP:514 listener (OrbStack) is up. The fleet heartbeat is fresh as of 23:42.

Watch

If the hang recurs, suspect the cloudd/Spotlight IO storms next (corespotlightd and mds_stores each ran at about 80% CPU after boot) or the Bluetooth half of the combo card.