Technicolor Connected R&D CONFIDENTIAL & PROPRIETARY

TC7200 GENERIC RELEASE NOTE

STCF.01.23

Page 1 of 27
Technicolor Connected R&D CONFIDENTIAL & PROPRIETARY

Content
TC7200 GENERIC RELEASE NOTE............................................................................................................... 1
STCF.01.23 ..................................................................................................................................................... 1
1 Important Notes ...................................................................................................................................... 3
1.1 EXCENTIS CERTIFICATIONS ................................................................................................... 3
1.2 DIAGNOSTICS WEB PAGE ...................................................................................................... 3
1.3 FREQUENCY PLAN ................................................................................................................ 3
1.4 SCAN LIST ........................................................................................................................... 3
1.5 CONCATENATION FEATURE ................................................................................................... 3
1.6 SECURE SOFTWARE DOWNLOAD IMAGE COMPATIBILITY .......................................................... 3
2 Release history........................................................................................................................................ 5
3 Special Features supported ....................................................................................................................... 6
4 Release Summary ................................................................................................................................... 7
5 List of Resolve/Enhancement ................................................................................................................. 10
6 List of Feature/Requirement ................................................................................................................... 18
7 Waiver Issues ....................................................................................................................................... 25
8 Appendix ............................................................................................................................................. 26
8.1 SCAN LIST TABLE .............................................................................................................. 26

Page 2 of 27
Technicolor Connected R&D CONFIDENTIAL & PROPRIETARY

1 Important Notes
1.1 Excentis Certifications
The following is a list of versions which have been certified by Excentis for EuroDOCSIS 3.0 + EuroPacketCable 1.5
functionality, respectively:

Excentis EuroDOCSIS 3.0/EuroPacketCable 1.5 Certification

http://www.excentis.com/files/certified_qualifiedproducts_excentis.pdf

TC7200 (Certified at ECW46)

1.2 Diagnostics Web Page

The end-user and the technician Diagnostics web pages are best viewed using browsers that support HTML 4.0 or
newer, using thousands or more colors, with 800x600 resolution or better. When the web pages are viewed with 256
colors or less the text will remain readable but the graphics will have an unsatisfactory appearance.
1.3 Frequency Plan
The TC7200 uses a frequency plan optimized for North America per the DOCSIS RFI specifications based on 6 MHz
channel spacing, using Harmonic Related Carrier (HRC), Incremental Related Carrier (IRC) or Standard (STD) North
American frequency plans per EIA-S542. Euro or UK per the EuroDOCSIS RFI specifications based on 8 MHz
channel spacing. If the network uses channels with center frequencies that do not conform to 6 MHz/8 MHz channel
spacing, the cable modem will take longer to lock onto the channel. The cable modem will lock on 6 MHz / 8 MHz
channels conforming to ITU J.83 Annex B / Annex A.
1.4 Scan List
This software supports a 40 frequency scan list that can be provisioned during production. This scan list allows an
MSO to specify the digital channel frequencies most commonly used on its network so that the cable modem will take
less time to tune-range-register and become operational. After power-up and after reboot, the cable modem will scan
the Last Known Valid Frequency first (if known), the Scan List, and then enter its regular DOCSIS/EuroDOCSIS
scanning algorithm.
1.5 Concatenation Feature
This TC7200 software release supports EuroDOCSIS 3.0 and EuroPacketCable 1.5 concatenation. This feature is
negotiable in the capability communications between the CM, CMTS, MTA and CA during registration per
EuroDOCSIS and EuroPacketCable standards.
1.6 Secure Software Download Image Compatibility
Beginning with STCF.01.01, the header of a Secure Software Download file contains the Product ID (two bytes), a
Hardware Release Minimum value (two bytes), and a Hardware Release Maximum value (two bytes). Each Hardware
Release value is divided into individual bytes with an assumed period separating the values of the two bytes. For
example, if the Hardware Release Minimum value is 0x0101 then this value represents Hardware Release 1.1.
During Secure Software Download (SSD), the cable modem application will compare the Product ID in the SSD file
with the Product ID stored in the bootloader’s permanent non-volatile memory. The SSD file will be rejected if they
do not match. Next, Hardware Release Minimum and the Hardware Release Maximum will be compared with the
Hardware Release in the permanent non-volatile memory. The CM’s Hardware Release must be within the inclusive
range indicated by the Hardware Release Minimum and the Hardware Release Maximum values. For example, given
a CM Hardware Release of 1.5 and HW_Rel_Min=1.1 and HW_Rel_Max=1.5, then the SSD will be accepted.
Finally, the image size within the SSD file must be compatible with the size of the flash memory of the CM. If the
SSD image is too large then the SSD file will be rejected.

Page 3 of 27
Technicolor Connected R&D CONFIDENTIAL & PROPRIETARY
HW_Rel_Min must always be numerically less than HW_Rel_Max or the SSD file will be rejected. If
HW_Rel_Min=1.0 and HW_Rel_Max=255.255, then this SSD file is compatible with all Hardware Releases. If
HW_Rel_Min=255.255 and HW_Rel_Max=255.255, then the application will not perform the Hardware Release
compatibility test and will accept the SSD file if the image size is compatible with the flash size.

Page 4 of 27
Technicolor Connected R&D CONFIDENTIAL & PROPRIETARY

2 Release history
Model Version BFC CxC Release Date
TC7200 STCF.01.23 558mp5 392114mp5 2015/08/25
TC7200 STCF.01.20 558mp5 392114mp5 2015/01/27
TC7200 STCF.01.19 558mp5 392114mp5 2014/09/12
TC7200 STCF.01.18 558mp5 392114mp5 2014/06/13
TC7200 STCF.01.17 558mp5 392114mp5 2014/04/02
TC7200 STCF.01.16 558mp5 392114mp5 2013/12/02
TC7200 STCF.01.15 558mp5 392114mp5 2013/10/22
TC7200 STCF.01.14 558mp4 392114mp4 2013/09/24
TC7200 STCF.01.13 558mp4 392114mp4 2013/08/19
TC7200 STCF.01.12 558mp4 392114mp4 2013/06/25
TC7200 STCF.01.11 558mp4 392114mp4 2013/04/23

Page 5 of 27
Technicolor Connected R&D CONFIDENTIAL & PROPRIETARY

3 Special Features supported

Hot Spot (2.0 after BFC559)
Hot Spot WiFi4ALL
WiFi SoftGRE V
WiFi Radar V
WiFi Country code 2.4G/5G EU/0, EU/0
L2VPN
L2TP V
VPN
PPPoE
PPTP V
Spectrum Analyzer V
HTTPs
IPTV snoop V
eRouter
TR-69 V
IPv6 V
Ds-Lite V
Telnet V
Diagnostic
SSH
EPC1.5 NCS
PacketCable EPC1.5 SIP V
EPC2.0
G.711-ulaw/G.711-alaw V
G.723.1
G.726-16/24/32/40
G.728
G729a
VOIP
G729e
Codec iLBC V
BV16 V
T.38
BV32
G729B
TELEVENT V
G722

Page 6 of 27
Technicolor Connected R&D CONFIDENTIAL & PROPRIETARY

4 Release Summary
CSC: MSO Ticket Reference Number
TT: Internal Technicolor Ticket Reference Number
CSP: Broadcom Ticket Reference Number
TC7200 STCF.01.20
Issue No Tittle
TT7053 DynDNS new provider
TT7876 WDS does not work on STB6.01.73
TT7867 6x wifi tab in web ui
TT7896 problem with CLIP

TC7200 STCF.01.20
Issue No Tittle
TT7354 Administration Web Page Access issue
TT7343 *802.11N support required* option is not apply to the nonvol via apply button
Avoid Hotspot Radius error message
TT7353 Port Forwarding issue
TT7146 IPTV MAC Filtering issue
TT7311 WebGui add reset button
TT7332 softGRE - no DHCP traffic through the SoftGRE tunnel after clear cable modem from
CMTS
TT7382 softGRE - no DHCP traffic through the SoftGRE tunnel after clear cable modem from
CMTS
TT7554 Wifi perf impacted by Gre SSID
TT7487 sleep wifi not working correctly
TT7578 not possible to check wireless clients included in blacklist
TT7577 Access Control shows the wireless connected clients to hotspot.
TT7516 LED OFF when 2.4 GHz disable and 5 GHz enable
TT7195 / TT7216 possibility to set 2 DNS IP address on lan side via cabhCdpServerDnsAddress
TT7479 Parental Control problem
TT7236 device lockup WiFi only
TT7250 ifInOctets reading incorrect aginst RF MAC interface

TC7200 STCF.01.19
Issue No Tittle
TT7225 TC7200 CE ETSI v1.8.1 certification image
TT7035 TC7200.20: TC7200.20 multicast get stuck
TT6608 TC7200U / RIP modification regarding to the /32 static IP address and NAT feature
TT6871 TC7200U - Technicolor 6.02.08 atheros/Qualcomm issue
TT6640 TC7200U : Possible to download GatewaySettings.bin file without any authentcation
TT6888 TC7200 : security holes ( Item 1 )
TT6838 TC7200U. STD6.02.08 Cm reboot

TC7200 STCF.01.18
Issue No Tittle
TT6914 security error with GET/POST over 236b
TT6888 TC7200: security holes on STCF.01.15

Page 7 of 27
Technicolor Connected R&D CONFIDENTIAL & PROPRIETARY
TT6801 TC7200 - Guest network 5G webgui setting are applied to 2.4G guest network
TT6637 TC7200.20: XSS attack security issue
TT6354 TC7200 : wifiMbssUserControl doesn't works as described in mib description
TT4392 TWG870 - seed WIFI SSID
TT6707 TC7200 : Slow access to get 192.168.0.1 WebGui
TT6789 TC7210 : 192.168.0.1 Webgui Slow access and Disconnection
TT6758 TC7210 : mac-address deny/allow list per SSID
TT6759 TWG870 : mac-address deny/allow list per SSID
TT6890 HTTP - vulnerability Every POST or GET query longer than 236 bytes for TC7200 or 544
bytes for TWG870 is causing restart of the device
TT6565 how-to control admin accounts
TT6566 TC7200: telnet LAN side allowed instead of forbidden
TT6861 TC7200: option submenu display error by using WebUiControlConfigFileTlvMaker
TT6939 TC7200: incoming DTMF relay

TC7200 STCF.01.17
Issue No Tittle
TT4392 TWG870 - seed WIFI SSID
TT6465 TC7200: cg802dot11WpsButtonFeatureEnable mib works only for 2.4Ghz
TT6415 TC7200 - how to get via SNMP wifiApsScanResultsTable table for 5Ghz
TT6672 TWG870/TC7200 mac-address deny/allow list per SSID mac-address deny/allow list per
SSID
TT6719 TC7200.20 : DS Bonding channel issue
TT6632 TC7200: passthrough mode ARP blocked
TT6466 TC7200.U need protection against XSS attack
TT6585 mib or VSIF to bypass FQDN check during prov

TC7200 STCF.01.16
Issue No Tittle
TT6367 DMZ Host not working correctly
TT6310 TC7210: Auto Channel by default on both card 2.4G and 5G

TC7200 STCF.01.15
Issue No Tittle
TT5928 [TC7200 DBC] Wireless Webpage review
TT6107 [TC7200] NRE - Need specific software
TT6128 TC7200 : Multicast leaking on TC7200

TC7200 STCF.01.14
Issue No Tittle
TT5353 [TC7200K] KDG Gre - cg802dot11BssPassthrough mibs not available (modify)
TT5656/CSC_3647 TC7200.U - Parental control for IPV6 (modify)
TT5673 TC7200.20 : Observed Packet loss
TT5902/CSC_3776 TC7200K EUCP2.0 - Firewall settings to aggressive in DSLite mode
TT5918/CSC_3856 Need new Wireless factory reset mib
TT5978/CSC_3845 Prefix Delegation length should be 56 for generic SW
TT5987/CSC_3861 TC7200.U -incorrect upstream service flow
TT5988/CSC_3860 [TCW770] modem stuck in init(o) in bridge mode
TT6034 TC7200.U need protection against CSRF attack
TT6049/CSC_3925 TC7200.20: USB hard drive not recognized
TT6126/CSC_3986 TC7200 Crash with MAC MTA in modem config file

Page 8 of 27
Technicolor Connected R&D CONFIDENTIAL & PROPRIETARY
TT6153/ [TC7200] wireless LED behavior.

TC7200 STCF.01.13
Issue No Tittle
TT4392/ TWG870 - seed WIFI SSID
TT5353/ [TC7200K] KDG Gre - cg802dot11BssPassthrough mibs not available (modify)
TT5673 TC7200.20 : Observed Packet loss
TT5978/CSC_3861 Prefix Delegation length should be 56 for generic SW
TT5987/CSC_3861 TC7200.U -incorrect upstream service flow
TT6010 TC7200: WebUiControlConfigFileTlvMaker mask is not correctly displayed after apply
TT6034/ TC7200.U need protection against CSRF attack
TT6049/CSC_3925 TC7200.20: USB hard drive not recognized

TC7200 STCF.01.12
Issue No Tittle
TT4392 TT4392 TWG870 - seed WIFI SSID
TT5676 TC7200.20 : Ping statistic through TC7200.20 in Wired mode
TT5686 [TC7200K] KDG EUPC20 - IPv6 prefix size via snmp
TT5702 DWG875 - Mac Passthrough - Claro Guatemala - TT5716
TT5704 TC7300.B: SIP based image request for ANATEL homologation tests
TT5705 TC7200: secret password doesn't work on LAN side (Modify)
TT5709 Disabled ip flood detection on all EMEA SW
TT5810 [TC7200K] KDG EUPC2.0 - Interface Prefixes only for subscriber controled enabled
SSIDs
TT5815 TC7200U - TWG870 U query Ackcel feature by SNMP
TT5830 DCW725/DGW855/DCW775 - Claro Chile eRouter oper mode private MIB - TT5814 -
TT5830
TT5858 CHILE VTR ACKCELL issue found on DCW775 STB5.01.51

TC7200 STCF.01.11
Issue No Tittle
TT5546 TC7200 - bad web page display in partial service
TT5603 TC7200 - cgWebPagesAccessMaskControl MIB doesn't work as expected
TT5604 TC7200 - bad modulation upstream display on WEB UI

Page 9 of 27
Technicolor Connected R&D CONFIDENTIAL & PROPRIETARY

5 List of Resolve/Enhancement
Bug fixed
TT7896 Issue Description The handset cannot display caller ID.
CSC_5460
Root Cause The eMTA will not encode “+” to FSK for call ID when incoming caller ID
include “+”. For example “+2233445566”.
Solution Fix to filter "+" characters from the calling number before encode FSK for
caller ID.
TT7876 Issue Description After switched to Bridge mode and deactivate all wifi, then switched RG mode
CSC_5505
and activated all wifi, at this time access the web pages, the wrong 6 wifi tabs
bookmarks are displayed.
Root Cause WebUI follows old TMM web designed and style but it is not good mechanism
to show out wrong tab on web
Solution Refine the webpage style
TT7876 Issue Description When Wireless Bridging feature is enabled, wifi stops working.
CSC_5539
Root Cause Brcm code issue
Solution Apply Brcm's patch on CSP
TT6939 Issue Description Reverse does not seem to work to convert incoming RFC2833 DTMF events
CSC_4634
again to tones on the phone line
Root Cause It doesn’t support MIMI type for DTMF relay
Solution Code modifies to support for MIME type "application/dtmf-relay".
TT6861 Issue Description Option submenus display error by using MIB
“WebUiControlConfigFileTlvMaker” to set it
Root Cause In code of the view because page’s menu visible is error
Solution Code modifies to fix page's menu visible.
TT6890 Issue Description When enter it from LAN side on TC7200.U :
CSC_4627
http://192.168.0.1/XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XX

Every POST or GET query longer than 236 bytes for TC7200 or 544 bytes for
TWG870 is causing restart of the device.
Root Cause Char buffer overflow.
Solution Code modify to prevent this issue
TT6789 Issue Description Login to LAN web page 192.168.0.1on TC7210 get slow access and
CSC_4527
disconnection
Root Cause Because Modem will show configure file information in Status GUI, and it
spend the time and modem resource

Page 10 of 27
Technicolor Connected R&D CONFIDENTIAL & PROPRIETARY
Solution Remove that show configure file information in Status GUI.
TT6707 Issue Description Login to LAN web page 192.168.0.1on TWG870 get slow access and
CSC_4527
disconnection
Root Cause Because Modem will show configure file information in Status GUI, and it
spend the time and modem resource
Solution Remove that show configure file information in Status GUI.
TT6354 Issue Description Only 3 guest network available on webgui, even if wifiMbssUserControl=8
CSC_4174
Root Cause Original design use WIFIEndUserControl to set this mechanism but
cgWifiMbssUserControl
Solution Modify the code to use wifiMbssUserControl
TT6637 Issue Description XSS attack on http://192.168.0.1/goform/status/diagnostics-route HTTP/1.1
CSC_4405 VmTracerouteHost=</textarea><script>alert(1);</script>&VmMaxTTL=30&V
mTrIsInProgress=0&VmTrUtilityCommand=1
Root Cause XSS attack prevent mechanism doesn’t include
Solution To add protection against XSS attack on "status/diagnostics-route.asp" pages.
TT6801 Issue Description When setting the Guest Network on 5G via Web GUI, the 2.4G Guest Network
CSC_4560 information also changed.
Root Cause Code did not implement well for 2.4G and 5G web page
Solution Fine tune the WEB GUI mechanism
TT6888 Issue Description Security hole issue :
CSC_4626
1) There is a possibility that any user can download the configuration file via
http://192.168.0.1/GatewaySettings.bin with no authentication.
Root Cause Security bug on Web GUI
Solution Check authentication status before access GatewaySettings.bin, if status is
unauthenticated, block it
TT6914 Issue Description When enter it from LAN side on TC7200 :
CSC_4640
http://192.168.0.1/XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XX

Every POST or GET query longer than 236 bytes for TC7200 or 544 bytes for
TWG870 is causing restart of the device.
Root Cause Char buffer overflow.
Solution Code modify to prevent this issue
TT6585 Issue Description Modem failed to complete MTA provision flow due to DNS failed for SNMP
CSC_4349
Prov Server IP, and repeat MTA provision always.
Root Cause TC7200 failed MTA provision in customer lab due to ran into MSO have
specific requirement and insist not set the MTA config filename in their DHCP
policy.
Solution Fix TT6585 MTA provision issue to meet MSO RCable specific requirement:
use "MTA's MAC address.bin" as MTA config filename if no config filename in
MTA DHCP ACK.

Page 11 of 27
Technicolor Connected R&D CONFIDENTIAL & PROPRIETARY
TT6466 Issue Description XSS attack on http://192.168.0.1/goform/status/diagnostics-route HTTP/1.1
VmTracerouteHost=</textarea><script>alert(1);</script>&VmMaxTTL=30&V
mTrIsInProgress=0&VmTrUtilityCommand=1
Root Cause XSS attack prevent mechanism doesn’t include
Solution To add protection against XSS attack on "status/diagnostics-route.asp" pages.
TT6632 Issue Description When connect STB on LAN port 4 in pass through mode, the CMTS looses
CSC_4413
connectivity to STB after some minute.
The ARP broadcast disappears.
Root Cause Broadcast package only with destination HalIf Eth-Switch Lan(0)
Solution Change the condition if any port running in pass-through mode, and the package
with destination Halif Eth-Switch Lan(0), pass it.
TT6719 Issue Description DS locked failed when more MD-DS-SG setting in CMTS
CSC_4485
Root Cause It is caused by Tech Dual mode.
We did not take this case in 3383 (Full Band Tuner) models
Solution Modify the code and migrated what we did in 3380/3383 for 3383 models.
TT6367 Issue Description DMZ Host not working correctly
Root Cause The MIB cgUiAdvancedDmzHostIpAddr doesn’t works well
Solution Enable the feature while the MIB is set
TT5353 Issue Description KDG REQ-KIP1201-NETWORKINGMODE-001 request to have bridge mode
and Router mode supported in Wireless interface and WAN interface.
And the mode for wireless should be configurable separately for each SSIDs. To
use cg802dot11BssPassthrough could comply with this requirement, but it
doesn’t exist in pervious release for TC7200K
Root Cause cg802dot11BssPassthrough does NOT supported in pervious TC7200K release.
Solution Implement the cg802dot11BssPassthrough mibs to support.
TT5546 Issue Description The Rgconect.asp displayed all frequency even in partial service.
Root Cause Page used a wrong source folder.
Solution Correct the page to use a right folder, resolved from 558mp3 migration
internally.
TT5603 Issue Description The WEB Page changed immediately after Change the MIB setting on
cgWebPagesAccessMaskver2. The cgWebPagesAccessMaskControl doesn't
work.
Root Cause From BFC558, we introduce the new http form handler to control the webpage
visible, to enhance the performance and code design than old mechanism. This
introduce also bring up the cgWebPagesAccessMaskver2 become on-the-fly
changed with checking the cgWebPagesAccessMaskControl status.
Solution To add three parameters in code design to correct the MIB behavior.
TT5604/ Issue Description Upstream modulation is NOT indicated correctly on webpage, GUI
CSC_3609 Indicated as QAM256 but should be QAM64.
Root Cause Page use a wrong source folder
Solution Correct the page to use a right folder.
TT5647 Issue Description IPTV stream stop after 260s

Root Cause Broadcom implement new switch driver code from BFC558mp4 and conflict
with previous design.

Page 12 of 27
Technicolor Connected R&D CONFIDENTIAL & PROPRIETARY
Solution Remove design switch driver code in BFC558mp4
TT5673 Issue Description Packet loss when using Mini probe discover the IPTV stream
Root Cause The code was not invalidating enough cache when we received a packet.
Because the DOCSIS DS EHDR was stored in the 16 bytes after the PDU, when
software read it, it was subject to reading a dirty cache line.
Solution Applied Broadcom patch to solve this issue.
TT5676 Issue Description The result of ping test became abnormal (spend more time) after 4 ~ 5 hours
when CPE ran BT through WIFI with natp_bypass = 0 (default value). And it
got worse if powering off the CPE.
Root Cause Broadcom Ackcel feature bug.
Solution This issue can related to CSP648268, and fix on SWCM-28824, implement this
patch also on BFC557.mp3
TT5705 Issue Description WEB GUI did not display advanced information (CM IP...) when user login
with advance account on LAN side.
Root Cause Default cmHttpAdvancedAccess value is incorrect.
Solution Change cmHttpAdvancedAccess default value from F8 to E0
TT5810 Issue Description The issue is TC7200K provision as DSlite or DualStack, and Wifi enabled by
cm config file, only (WiFi)(0)(0) Primary should be visible in the WebGUI
Gateway->Network->LAN.
It doesn’t match the following KDG requirement.
KDG requirement:
If WIFI is disabled, should NOT be any SSID instances displayed.
Root Cause interface/prefix information display mismatch with the interface enable status
Solution When show the interface/prefix information, just display which interface is
enabled only.
TT5902/ Issue Description Telnet and SSH failed when DUT provision as IPv6 with DSLite + IPV6
CSC_3776 firewall Protection enabled.
Root Cause Broadcom 3383 NATP implement works incorrect.
Solution Add port 22 and 23 to default session ignore list.
TT5978 Issue Description The default value of cgIPv6PreferredPDLength incorrect (62)
Root Cause The default of cgIPv6PreferredPDLength should be 56 for generic SW and 62
for MsoKdg.
Solution Using MSO_ID (VP52) to control the default.
The default value = 56 exclude the MSO = KDG (62)
TT5987 Issue Description TC7200.U -incorrect upstream service flow
Root Cause LLC classifier with vendor specification is not working in BFC558mp5.
Solution FAP did not support the vendor specification TLV.
We let software process such upstream classifier instead of FAP.
This is the same behavior of BFC557
TT5988/ Issue Description TCW770 modem stuck in init(o) in bridge mode
CSC_3860
Root Cause 1) BcmErouterIgmpThread is Null in bridge mode.
2) BcmErouterIgmpThread is stopped.
Solution 1) ERouter mode is bridge mode. We won't send IGMP query packet to CPE.
2) ERouter mode is Router mode. We will check eRouter IGMP thread status.
When IGMP thread status is starting and old HalIf Description and now HalIf

Page 13 of 27
Technicolor Connected R&D CONFIDENTIAL & PROPRIETARY
Description are Eth-Switch Lan,
We will send IGMP query packet to CPE.
Otherwise, we won't send IGMP query packet to CPE.
TT6010 Issue Description TC7200: WebUiControlConfigFileTlvMaker mask is not correctly displayed
after apply
Root Cause From BFC558, we introduce the new http form handler to control the webpage
visible, to enhance the performance and code design than old mechanism. The
main problem is cgWebPagesAccessMaskver2 and main webpage doesn’t
match.
Solution When we set "cgWebPagesAccessMaskver2/cgWebPagesAccessMask" MIB,
we will change menu status.
TT6049 Issue Description When the release eCos/Linux with TP1 feature, the USB hard drive cannot be
CSC_3925
recognized.
Linux interface IP stack cannot get IP address correctly.
Root Cause During the modem booting, if CM configure file set SW upgrade setting and
modem into SW upgrade session.
Normally, Modem will following the steps as below:
1. Stop Linux when upgrading image.
2. Reboot CM if upgrade success, or restart Linux if upgrade fail.

But eCos doesn't restart Linux when enabling TP1 feature, then we will see this
issue.
Solution eCos will restart Linux if upgrade fail when the release enabling TP1 feature.
TT6126/ Issue Description [TC7200] Crash with MAC MTA in modem config file
CSC_3986
Root Cause 1) BcmErouterIgmpThread is Null in bridge mode.
2) BcmErouterIgmpThread is stopped.
Solution 1) ERouter mode is bridge mode. We won't send IGMP query packet to CPE.
2) ERouter mode is Router mode. We will check eRouter IGMP thread status.
When IGMP thread status is starting and old HalIf Description and now HalIf
Description are Eth-Switch Lan,
We will send IGMP query packet to CPE.
Otherwise, we won't send IGMP query packet to CPE.
TT6128/ Issue Description Basic IPTV multicast quality looks ok but we see serious issues when zapping.
CSC_3985
Root Cause Speculate that was when CPE leave the IGMP group and CM remove the
relation switch control policy, but CMTS without reaction(may packet loss).
CMTS keeps send the streams which not be management by switch,
so switch just forwarding the stream to each port.
Solution When CM receives the IGMP leave group report, don't remove the switch
policy immediately.
Just change the switch policy forwards to no port to ensure there is no port
forwards the stream.
Finally, when each IGMP join report receive by CM from CPE,
checking switch policy which forwarding to no port are keeping more than 260
seconds, just remove it.
TT6153 Issue Description Our WIFI LED behavior sets one LED and one WIFI card, but now one LED
and two cards.
Root Cause Refine wireless 2.4G and 5G LED behavior

Page 14 of 27
Technicolor Connected R&D CONFIDENTIAL & PROPRIETARY
Solution 2.4G Enabled/5G Enabled ==> LED ON
2.4G Enabled/5G disabled ==> LED ON
2.4G disabled/5G disabled ==> LED OFF
2.4G disabled/5G Enabled ==> LED ON
TT7035 Issue Description TC7200.20: TC7200.20 multicast get stuck
Root Cause Multicast table number count doesn’t match
Solution Used the number of multicast DSIDs to do the condition of into
"kRejInsufficientDsidResources" mode
TT6640 Issue Description End user can get the GatewaySettings.bin via
http://192.168.0.1/goform/system/GatewaySettings.bin
Root Cause CM doesn’t check authentication status before access GatewaySettings.bin
Solution Add checking mechanism to check the if the user is authorized when user try to
get backup file
TT6888 Issue Description There is a possibility that any user can download the configuration file via
http://192.168.0.1/GatewaySettings.bin with no authentication.
Root Cause CM doesn’t check authentication status before access GatewaySettings.bin
Solution Add checking mechanism to check the if the user is authorized when user try to
get backup file
TT6838 Issue Description CM reboot sometimes
Root Cause ACSD allocate memory failed
Solution Apply the ACSD memory leak patch for 558mp5
TT7354 Issue Description Option Deny (Administration Web Page Access) doesn’t works well on card 2
CSC_4996 (5G)
Even set the Wireless-> WiFi 5G -> Access Control -> Administration Web
Page Access = Deny.
The user connect via 5G Primary still can login to CM Http server
(192.168.178.1)
Root Cause In previous design, we only judge the WiFi card 1.
Solution Add WiFI card 2 to the condition.
TT7343 Issue Description Issue is quite easy to be reproduced, the 802.11N support Required option
CSC_5009
configuration is not applied to the nonvol after push the apply button on the UI.
Change this value from console command is workable, but UI. This issue
happen on both 2.4/5Ghz, and the other options in wifi radio pages are fine.
Root Cause 802.11n setting without been set in nonvol.
Solution Add a flag to trigger when 802.11n on/off required, then the setting value will
be stroed in nonvol.
TT7353 Issue Description Cannot disabled the Rules of Port Forwarding.
CSC_4994
Root Cause Broadcom code implement bug
Solution Code modify to use correct code value/structure
TT7146 Issue Description Even Set the STB MAC address in MAC filter, the IPTV still can be play
CSC_4837
Root Cause The IGMP group memberships still add the multicast IP evn set the MAC filter
Solution When IgmpV3Snoop receives IGMP packets from CPE, CM will check MAC
Filter List.

Page 15 of 27
Technicolor Connected R&D CONFIDENTIAL & PROPRIETARY
If this CPE MAC address is in MAC Filter List, CM discards this packet.
TT7554 Issue Description When Gre client(MUST) and other interface client in the same time run Ookla
CSC_5247
test, one client maybe timeout without done. Meanwhile client has ping lost
situation.
This issue on TCW770 needs the following two solution to fix, (Solution-1 to
solve ping lost issue; Solution-2 to solve timeout issue) but on TC7200.d just
needs solution-1 to fix. Its cause might be relation with chip
Root Cause 1. L2oGre:WifiHotspot throughput is very low
Upstream performance degradation was due to ARP requests/responses were not
handled by correct stack
when originating interface is eRouter.
Downstream performance degradation was due use of WMM for homehotspot
network.
If downstream traffic is not tagged with DSCP or VLAN priority bit then all
homehotspot traffic will be tagged as background class.

2. In current SW design that CM allow only one MAC address mapping to one
IP address in ARP table, if there’s any one MAC address which had been
configured to have multiple IP addressed, that will cause the CM keep updating
the mapping in the ARP table, and which might leading the packet lost or low
performance.
Solution 1. Add Brcm's fix in 5510mp3 "SWCM-31543"

2. Code change to allow one single MAC address mapping to multiple IP

address in ARP table instead of overwrite the mapping.
TT7578 Issue Description When a client connects via Primary SSID that will be added to the blacklist, and
we can check the mac address with the table via MIB
"cg802dot11BssAccessEntry", but this Mib seems not to work.
Root Cause "cg802dot11BssAccessEntry" references to Brcm's Mib
"wifiBssAccessTable" , but Broadcom don't implemented real read-create in
MIB "dot11BssAccessTable".
Solution To refine the read-create mechanism in "cg802dot11BssAccessEntry"
TT7516 Issue Description The Wireless LED will off after disabled the 2.4G WiFi on WEB UI but 5G
WiFi.
Root Cause The LED status is not sync on 2.4G and 5G WiFi .
Solution Refine the code to fix it.
TT7479 Issue Description Blocking website and key words is working fine (after add it on web ui), but if
CSC_5164 force restart of modem, it does not work, but still is on list.
Root Cause
Solution Refine code in Parental Control
TT7382 Issue Description CPE cannot get IP address via L2oGRE after CM re-initialization (ex.
CSC_5048
goto_ds ...), while CM is in DS-lite mode and L2oGRE mode.
The resolved way is rebooted.

Page 16 of 27
Technicolor Connected R&D CONFIDENTIAL & PROPRIETARY
Root Cause While CM re-initialize, the wan-man IP stack 3 address will be set as GRE-
tunnel address.
But the address is wrong. It is IPv6 link-local address.
Solution To modify to use the wrong address as GRE-tunnel address aftre CM re-
initialization.
TT7487 Issue Description End time of wifi sleep setting doesn't work correctly.
CSC_5163 At end time, wifi doesn't wake up.
Root Cause The previous design keeps overwriting previous saved wifi settings during
sleeping period.
Solution Redesign sleep wifi state machine.
TT7250 Issue Description Number reported by ifInOctets.2 for RF MAC interface is a lot lower than what
it should be, when FAP/NATP are enabled.
Root Cause BCM IOPLib bug
Solution Applied update library that we got on CSP 557586
TT7236 Issue Description Found TT7250 fixed the same mib counter issue which SWCM-30367 and
SWCM-31638 are trying to fix. Since IoprocLib is involved, and the one
from SWCM-31368 is from mp8 which may not be good for mp5 based image,
so I decide to rollback my previous check-ins which are related to this
issue, ie. SWCM-30367 and SWCM-31638.
Root Cause Broadocm bug.
Solution Rollback the changes from SWCM-30367 and SWCM-31638.

Page 17 of 27
Technicolor Connected R&D CONFIDENTIAL & PROPRIETARY

6 List of Feature/Requirement
New feature/ Requirement
TT7053 [Feature] New DDNS provider address added on Web GUI
New DDNS www.noIP.com
provider address duckdns.org
added on Web www.dnsexit.com
GUI dnsdynamic.org
www.changeip.com
TT4392 [New feature] New cgWifiSSIDSeedEntry Group for 2.4G and 5G each index.
TWG870-seed
WIFI SSID In CM config file, It will accept cg802dot11SSIDSeedReplaceLevel and
cg802dot11SSIDNewSeed MIBs no matter the sequence of it.
For Example:
cg802dot11SSIDSeedReplaceLevel.0 (INTEGER) 1
cg802dot11SSIDNewSeed.0 (OCTET STRING) MSO
cg802dot11ApplySettings.0 (TruthValue) true(1)
Check result :
cg802dot11BssSsid.32 (OCTET STRING) MSO_D2290410

Here are MIBs definition:

cg802dot11SSIDSeed OBJECT IDENTIFIER ::= { cg802dot11MgmtGroup 9 }
cg802dot11SSIDSeedReplaceLevel OBJECT-TYPE
SYNTAX INTEGER
MAX-ACCESS read-write
STATUS current
DESCRIPTION
“0: This feature is disabled. (Default)
1: Replace current default SSID seed.”
DEFVAL { 0 }
::= { cg802dot11SSIDSeed 1 }
cg802dot11SSIDNewSeed OBJECT-TYPE
SYNTAX OCTET STRING (SIZE(0..32))
MAX-ACCESS read-write
STATUS current
DESCRIPTION
“- Replace the original SSID seed by this MIB value (new SSID seed).
- SSID Seed means the string which is in the front of ‘-‘ or ‘_’.”
::= { cg802dot11SSIDSeed 2 }

cg802dot11SSIDSeedStatus OBJECT-TYPE
SYNTAX INTEGER
MAX-ACCESS read-only
STATUS current

Page 18 of 27
Technicolor Connected R&D CONFIDENTIAL & PROPRIETARY
DESCRIPTION
“0: Default SSID. (Default)
1: User had modified the SSID through web.
2: SSID is modified through CM config.
MSO changed the SSID seed by CM config.”
DEFVAL { 0 }
::= { cg802dot11SSIDSeed 3 }
==============================================
TT5307/ [Feature] Web GUI implement logout options, it can logout the GUI manually via web
CSC_3366 Http Logout page.
Mechanism
implement
TT5656 [Requirement] Ipv6 support Parental control feature.
CSC_3647
TC7200.U – #1:
Parental control Trace the keyword if included in Ipv6 packets.
for IPV6 #2:
Trace the FQDN if included in Ipv6 packets.
TT5686 [New Feature] Add new feature to have the mib to control the prefix as
The eRouter “cgIPv6PreferredPDLength”
always requests a
/56 prefix for Provide the following MIB to control it:
dualstack or dslite cgIPv6PreferredPDLength OBJECT-TYPE
mode. SYNTAX INTEGER (56..64)
Need a MIB to MAX-ACCESS read-write
control this prefix STATUS current
length. DESCRIPTION
“The length of the prefix that the DHCPv6 client would like to be
delegated.”
DEFVAL { 62 }
::= { cableGatewayBase 41 }
TT5702 [Requirement] To Add the TT4746 implemented on DWG875.
DWG875 – Mac
The DWG874 already have pass-through per-Ethernet port.
Passthrough – We would like to implement following MIB to switch both two modes, then
Claro Guatemala customer will used only one mode for Pass-through opter.
– TT5716
cgUiNetworkPPassthroughOpterMode OBJECT-TYPE
SYNTAX INTEGER {
Portbase(1),
MACbase(2),
}
MAX-ACCESS read-write
STATUS current
DESCRIPTION
“The Passthrough WEB page will opter in
b. Ethernet Port base
2. Configure by MAC address “
DEFVAL { 1 }
::= { cgUserInterfaceNetworkPPassthrough 3 }

Page 19 of 27
Technicolor Connected R&D CONFIDENTIAL & PROPRIETARY
TT5704 [Requirement] The following mib default value is not correct.
tmmMtaEndPntH
ookFlashMinTim Set mib default value:
e= 90 tmmMtaEndPntHookFlashMinTime= 90
tmmMtaEndPntH tmmMtaEndPntHookFlashMaxTime= 600
ookFlashMaxTim
e= 600
TT5709 [Requirement] Disabled IP flood detection by default
Disabled IP flood
detection by
default
TT5815 [Requirement] To reuse the MIB, cmAckCelEnable which is used for D20 models (per
Let SNMP can TT1671).
query Ackcel This MIB could be modify by CM configure with TLV11.
feature. In D30 models, this MIB is read only when SNMP query/get.
TT5830 [New feature] To use tmmRouterIpProvMode MIB as a solution,
DCW725/DGW8 In eRouter models(DCW775 in this case)
55/DCW775 – Set to (0-3) -> eRouter configuration
Claro Chile Set to 4 -> legacy RG
eRouter oper
mode private MIB
– TT5814 –
TT5830
TT5858 [Requirement] As a workaround where we support TCH private MIB cmAckCelEnable which
CHILE VTR we suggest to set in the CM configuration file to disable AckCel feature.
ACKCELL issue Name: cmAckCelEnable
found on Type: OBJECT-TYPE
DCW775 OID: 1.3.6.1.4.1.2863.205.1.1.58
STB5.01.51 Full path:
iso(1).org(3).dod(6).internet(1).private(4).enterprises(1).thomson(2863
).broadband(205).cableModem(1).cableModemBase(1).cmAckCelEnable(58)
Module: THOMSON-CABLEMODEM-MIB
TT5918/ [New Feature] Add new mib cg802dot11RestoreToDefaults to restore wireless to defaults..
CSC_3856 Need new For Example:
Wireless factory cg802dot11RestoreToDefaults.0 (INTEGER) 1
reset mib cg802dot11ApplySettings.0 (TruthValue) true(1)

Here are MIBs definition:

cg802dot11RestoreToDefaults OBJECT-TYPE
SYNTAX INTEGER {
restoredAll(1)
restoredSsid1Only(2)
false(3)
}

Page 20 of 27
Technicolor Connected R&D CONFIDENTIAL & PROPRIETARY
MAX-ACCESS read-write
STATUS current
DESCRIPTION
“When set to restoredAll(1), restored All SSID to factory
defaults.
When set to restoredSsid1Only(2), restored SSID1 to factory defaults
only.
Always returns false(3) when read.Setting to false(3) has no effect.”
::= { cg802dot11MgmtGroup 11 }
============================================
TT5928 [Requirement] Webgui redesign same as UPC style regarding concurrent wireless models for
[TC7200 DBC] TC7200/TC7210/TC7230 generic models.
Wireless Webpage 1.Radio naming change to Wi-Fi 2.4G/ Wi-Fi 5G.
review 2. Modify the naming of this Restore Wireless Defaults button with:
For 2.4 G:
“Restore Wireless Defaults 2.4G”
For 5G:
“Restore Wireless Defaults 5G”
3. Modify the naming of this Restore Guest Network Defaults button with:
For 2.4 G:
“Restore Guest Network Defaults 2.4G”
For 5G:
“Restore Guest Network Defaults 5G”.
TT6107 [Requirement] The following settings for default Generic models
[TC7200] NRE – 1) Do not count MTA as CPE
Need specific 2) Wifi country code 5G=HU
software 3) Led wireless on for 2.4 and 5G
4) Move pool of Guest SSID to 192.168.81.x
5) tmmEmtaSipDeviceLineStateLedCheck MIB add.
tmmEmtaSipDeviceLineStateLedCheck OBJECT-TYPE
SYNTAX INTEGER {
disable(0),
enable(1)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
“0: Line LED Blinking, if SIP registration failure(default)
1: Line LED OFF, if SIP registration failure after 60 seconds.
[note]
For MSO True, default to true(1) and other MSOs to false (0).”
DEFVAL { 0 }
::= { tmmEmtaSipDevice 25 }

Page 21 of 27
Technicolor Connected R&D CONFIDENTIAL & PROPRIETARY
=============================
This MIB is read only. So we need to set MIB via MTA configuration file.

When MTA has the following items, after 1 min, VoIP LED will be OFF.
1. No registration response
2. Registration response failure
TT6034 [Requirement] Adding the token machismos we did for 850-4(TT4220) included in the
TC7200U
TC7200U need
protection against
CSRF attack
TT6566 [Requirement] Controls and reflects the IP stack interfaces on which a telnet server is active.
The default setting should be 0x80 to only allow telnet access from the IP stack
Tc7200 Telnet
of RF interface
LAN side status
change
TT6565 [Requirement] Use MIB cmHttpAdvancedAccess to control admin level account to login from
CSC_4344 WAN side.
A MIB to control
Ex:
admin level Set MIB cmHttpAdvancedAccess = 0xA0 can specific WAN level account only
account Login login from CM/WAN IP address
TT6758 [New Feature] MIB “cgWifiHotspotProtect” to control the Protection mechanism
CSC_4529 Enable/Disable/Disabled and clear Hotspot SSID ACL Table for the Hotspot Protection
Hotspot mechanism
protection Hotspot Protection mechanism :
mechanism for a) Prevent the Home user miss connect to Hotspot SSID, who connect to Primary SSID
before
TC7210 b) When Home user connect to Primary SSID, the protect mechanism will add the client
MAC address to Hotspot SSID ACL table and Set WIFI access mode to denyList(3).
Enabled : Enabled the protection mechanism
disabled : Disabled the protection mechanism
disableandclear : Disabled the protection mechanism and clear All Hotspot SSID
interface ACL Table.

MIB “cgWifiHotspotGUI” to control the Hotspot GUI status

Display the Hotspot page on the wireless page
1: disable GUI
2: only show Hotspot settings
3: show Hotspot settings and ACL table

MIB “cgWifiHotspotACLClear” to clear ACL table for each WIFI index

Choose the Hotspot interface Index first.
If set to true(1), Modem will clear corresponds Hotspot ACL table.
Always returns false(2) when read.
TT6759 [New Feature] MIB “cg802dot11HotspotProtect” to control the Protection mechanism
CSC_4528 Enable/Disable/Disabled and clear Hotspot SSID ACL Table for the Hotspot Protection
Hotspot mechanism
protection Hotspot Protection mechanism :
mechanism for a) Prevent the Home user miss connect to Hotspot SSID, who connect to Primary SSID
before
TWG870 b) When Home user connect to Primary SSID, the protect mechanism will add the client
MAC address to Hotspot SSID ACL table and Set WIFI access mode to denyList(3).
Enabled : Enabled the protection mechanism
disabled : Disabled the protection mechanism

Page 22 of 27
Technicolor Connected R&D CONFIDENTIAL & PROPRIETARY
disableandclear : Disabled the protection mechanism and clear All Hotspot SSID
interface ACL Table.

MIB “cg802dot11HotspotGUI” to control the Hotspot GUI status

Display the Hotspot page on the wireless page
1: disable GUI
2: only show Hotspot settings
3: show Hotspot settings and ACL table

MIB “cg802dot11ACLTableClear” to clear ACL table for each WIFI index

Choose the Hotspot interface Index first.
If set to true(1), Modem will clear corresponds Hotspot ACL table.
Always returns false(2) when read.
TT6672 [New Feature] MIB “cg802dot11HotspotProtect” to control the Protection mechanism
Enable/Disable/Disabled and clear Hotspot SSID ACL Table for the Hotspot Protection
Hotspot mechanism
protection Hotspot Protection mechanism :
mechanism for a) Prevent the Home user miss connect to Hotspot SSID, who connect to Primary SSID
before
TC7200/TWG870 b) When Home user connect to Primary SSID, the protect mechanism will add the client
MAC address to Hotspot SSID ACL table and Set WIFI access mode to denyList(3).
Enabled : Enabled the protection mechanism
disabled : Disabled the protection mechanism
disableandclear : Disabled the protection mechanism and clear All Hotspot SSID
interface ACL Table.

MIB “cg802dot11HotspotGUI” to control the Hotspot GUI status

Display the Hotspot page on the wireless page
1: disable GUI
2: only show Hotspot settings
3: show Hotspot settings and ACL table

MIB “cg802dot11ACLTableClear” to clear ACL table for each WIFI index

Choose the Hotspot interface Index first.
If set to true(1), Modem will clear corresponds Hotspot ACL table.
Always returns false(2) when read.
TT6415 [New Feature] New MIB implement for each WIFI index :
CSC_4153 cgWifiApsScan.32 (TruthValue) true(1) 2.4G
Get WIFI scan
cgWifiApsScan.112 (TruthValue) true(1)  5G
result table for cgWifiApplySettings.0 (TruthValue) true(1)
5GHz via MIB
TT6465 [New Feature] New MIB implement for each WIFI index :
CSC_4255 cgWifiWpsButtonFeatureEnable.32 (INTEGER) enabled(1) 2.4G
New MIB to
cgWifiWpsButtonFeatureEnable.112 (INTEGER) enabled(1)  5G
control WPS cgWifiApplySettings.0 (TruthValue) true(1)
Button advanced
Feature for 5GHz
TT6310 [Requirement] Wireless default channel set to Auto on 2.4G and 5G
Wireless default
channel change
TT7225 [Requirement] Apply the patch "lib80211_BFC558mp5.tar.bz2" of the CSP
CE certification

Page 23 of 27
Technicolor Connected R&D CONFIDENTIAL & PROPRIETARY
TT6608 [New Feature] Add two new mibs cgWanMode and cgWanDualIpAddr
New MIB to 1.3.6.1.4.1.2863.205.10.1.10.14
1: dhcp(1)
control
2: dualIp(2)
WanMode/Addres
s
TT6871 [New Feature] Add new mib to control STBC Tx
New MIB to 1.3.6.1.4.1.2863.205.10.1.30.1.24
1: auto(0)
control STBC Tx
2: on(1)
3: off(2)
TT7311 [Feature] SW change.
CSC_4728 Status -> Password -> reboot button
Add a reset button
on WebGui.
TT7332 [Requirement] Add cgUiNetworkWanIpv4MtuSize MIB to control MTU size by MIB.
cgUiNetworkWanIpv4MtuSize OBJECT-TYPE
Requesting the
SYNTAX INTEGER (0..1500)
MTU default to MAX-ACCESS read-write
1500. STATUS current
DESCRIPTION
"IPv4 MTU Size:
256 - 1500 octets, 0 = use default

OID :1.3.6.1.4.1.2863.205.10.1.33.1.1.14.0
TT7577 [Feature] Hid clients connected via hotspot or GRE in the list table of Access Control
CSC_5272 Hid Clients webpage.

TT7195 [Feature] New add a MIB group “cgUserInterfaceNetworkLanDns”

CSC_4935 (1.3.6.1.4.1.2863.205.10.1.33.1.6) to implement.
MSO want to set
CSC_4747
DNS servers more
than one.

Page 24 of 27
Technicolor Connected R&D CONFIDENTIAL & PROPRIETARY

7 Waiver Issues
 None

Page 25 of 27
Technicolor Connected R&D CONFIDENTIAL & PROPRIETARY

8 Appendix
8.1 Scan List Table

Downstream Scan List

Count Frequency
1 738000000
2 770000000
3 850000000
4 802000000
5 482000000
6 602000000
7 236000000
8 130750000
9 487250000
10 551250000
11 403000000
12 138000000
13 135000000
14 514750000
15 410750000
16 411000000
17 459000000
18 783000000
19 786000000
20 794000000
21 802000000
22 810000000
23 123125000
24 163125000
25 115125000
26 155125000
27 122500000
28 307750000
29 147125000
30 319750000
31 160000000
32 602375000

Page 26 of 27
Technicolor Connected R&D CONFIDENTIAL & PROPRIETARY

33 171125000
34 313750000
35 325750000
36 119000000
37 127000000
38 111000000
39 N/A
40 N/A

Page 27 of 27