diff --git a/src/RadioManagementModule.cpp b/src/RadioManagementModule.cpp
index fe2abb1..0375c7c 100644
--- a/src/RadioManagementModule.cpp
+++ b/src/RadioManagementModule.cpp
@@ -337,6 +337,30 @@ void RadioManagementModule::phy_SwChnlAndSetBwMode8812() {
     for (uint32_t a : rf_canary)
       _logger->info("RF[B] 0x{:02x} = 0x{:05X}", a,
                     phy_query_rf_reg(RfPath::RF_PATH_B, a, 0xfffffu));
+
+    /* 8814AU extension: dump path-C/D BB-AGC + IGI + BB-swing. Paths C/D
+     * exist at BB-register-table level (0x18xx for path C, 0x1Axx for
+     * path D, see hal/Hal8814PhyReg.h). NB: the corresponding RF
+     * registers for paths C/D are write-only by HW design on 8814AU
+     * (see kaeru cite "RTL8814AU RF read mechanism — paths C/D
+     * write-only by HW design") — read attempts return undefined
+     * data, so we skip RF[C]/RF[D]. The BB-table state IS readable
+     * and is the canary surface for path-C/D init drift. */
+    if (_eepromManager->version_id.ICType == CHIP_8814A) {
+      static const uint16_t bb_canary_8814_pathCD[] = {
+          /* Path-C TX-AGC table */
+          0x1820, 0x1824, 0x1828, 0x182c, 0x1830, 0x1834, 0x1838, 0x183c,
+          0x1840,
+          /* Path-C BB-swing + IGI */
+          0x181c, 0x1850,
+          /* Path-D TX-AGC table */
+          0x1a20, 0x1a24, 0x1a28, 0x1a2c, 0x1a30, 0x1a34, 0x1a38, 0x1a3c,
+          0x1a40,
+          /* Path-D BB-swing + IGI */
+          0x1a1c, 0x1a50};
+      for (uint16_t a : bb_canary_8814_pathCD)
+        _logger->info("BB 0x{:04x} = 0x{:08X}", a, _device.rtw_read32(a));
+    }
     _logger->info("=== END DEVOURER_DUMP_CANARY ===");
   }
 
diff --git a/tools/canary_kernel_dump.sh b/tools/canary_kernel_dump.sh
index 339620d..0927e78 100755
--- a/tools/canary_kernel_dump.sh
+++ b/tools/canary_kernel_dump.sh
@@ -38,12 +38,14 @@
 set -euo pipefail
 
 if [[ $# -lt 2 ]]; then
-  echo "Usage: $0 <iface> <channel>" >&2
+  echo "Usage: $0 <iface> <channel> [chip]" >&2
+  echo "  chip: 8812 (default) | 8814" >&2
   exit 1
 fi
 
 IFACE="$1"
 CHANNEL="$2"
+CHIP="${3:-8812}"
 
 if ! ip -o link show "$IFACE" >/dev/null 2>&1; then
   echo "iface '$IFACE' not found — did you modprobe 88XXau?" >&2
@@ -93,4 +95,16 @@ for PATH_IDX in 0 1; do
   done
 done
 
+# 8814AU extension: path-C/D BB-AGC + IGI + BB-swing. RF[C]/RF[D]
+# are write-only by HW design on 8814AU (read attempts return undefined
+# data), so we only dump BB-table state for paths C/D.
+if [[ "$CHIP" = "8814" ]]; then
+  for ADDR in 0x1820 0x1824 0x1828 0x182c 0x1830 0x1834 0x1838 0x183c \
+              0x1840 0x181c 0x1850 \
+              0x1a20 0x1a24 0x1a28 0x1a2c 0x1a30 0x1a34 0x1a38 0x1a3c \
+              0x1a40 0x1a1c 0x1a50; do
+    printf "BB %s = %s\n" "$ADDR" "$(readreg $ADDR)"
+  done
+fi
+
 echo "=== END DEVOURER_DUMP_CANARY ==="