diff --git a/sys-kernel/debian-sources/Manifest b/sys-kernel/debian-sources/Manifest
index 9023583..f3274db 100644
--- a/sys-kernel/debian-sources/Manifest
+++ b/sys-kernel/debian-sources/Manifest
@@ -5,6 +5,7 @@ DIST linux-6.1.162.tar.xz 135402204 BLAKE2B 896f671313ba243cbd11c96a474599c51c77
 DIST linux-6.1.164.tar.xz 135378304 BLAKE2B 2533f05c81486b563ec7959e3434eff699fb59be43bb5c2c5c2a831482238c29648b85f8204bb067248135025e81aefc515bc69b3ddb13955b3d1a42997c6adf SHA512 a91b3859a1b1019e86efde206eae8253683cf4ec2c8aa261c47c66180d719482d4777ba75b57530a187ae87641e2544894d1db0c1a0a276d063f3a2279c26baa
 DIST linux-6.1.170.tar.xz 135436044 BLAKE2B 70c62807f6d97c945f8cbe24058b5ab02ad5dc98ba865dec68ece96e4620f9c9fa7b624f4532451277d3cce0afe2a8d50fc1852ded2ef3066d20c5ab90316d05 SHA512 c49bca145a57d42fcf4b89b7500868f829910059195b07648de95afeb2d7ca5b080adcb4acc5eda4dc711ff2e914727cb010da87d266106ce006f4014adfdd3d
 DIST linux-6.12.101.tar.xz 148404228 BLAKE2B 716eafcc791311a3aaea6928bd954dbe712f6b342fc4f08d482f624f37942c67f9b5b122e740147227549e5cbfeb6eea339f2f100608d4d41b2c9b0c0fc0f0fc SHA512 083a86cc283486e8e214939637a2ed7cb44261a51c38a6c9ea579693dae79531fca18217e24811246f796185a638cb505ad01b2da8e56b052307b8b57f05ae23
+DIST linux-6.12.107.tar.xz 148412260 BLAKE2B 7ceed78b81cfa2298dd5f315047d30249e508b197aed3ede55cf5eddf079023c93eec96e29af79fc0c5f54a8b80fde386641d339ac07a07872aff86f31df07fc SHA512 7a0442bab12121ee3499d79067f4f84593814906bc22ba0e6fce0403b8640b4bd5a0f0af5ed947ef80e4e659e5abc0bdba54786bfe3be1042e6aff6bec8f0efc
 DIST linux-6.12.43.tar.xz 148204720 BLAKE2B 0606e0486cf7a426484ef6bbaa174d79d00ab2ceb9f6cdf7109a28e0841e8a907c4d78d7c549c82600362d747166c493cbec826138b163f3b62ea5b4561ed0b8 SHA512 39c8282ff2ad87cef9f2a7805fad1f628aa12413b71008cff6d10261273387491ff38cac35d42ae542a5db8cb41c6545426b31c03f9df203b58b120be299086f
 DIST linux-6.12.57.tar.xz 148232100 BLAKE2B 763749a1fee8dda500c77c7b5cc4787fe213c523dda66ddda6307195787bd3646cba868173cc8c0833c6bdc8e695e8283738f3c29cfdba5c35d4d2956742a791 SHA512 57ad723d2a8d9eb04b3ac7897f0b37cff3771e0be4420edb6bfd7fdf35f8317d4a9527ed7eac2b9e659a0e0ca899d8ec6b6be0ef80d2512d483152b4113ba2e0
 DIST linux-6.12.63.tar.xz 148158544 BLAKE2B 8f24d8efe88f1b5e6fde5fba6833798e5b3d5aa8bbdb7e031ac0f8333f7ffb5fa19a9b0d028641729971cb63e147c6cd6d79b5cd97fb9851471d3efe832119e5 SHA512 89a4aaa7f924b2c579d0bf384742c3ec2fc9b11c272b9d68ad645a99127043a4f55f8a07067a99ff6220ba9c3efb29dbf27baa298d2b5980d811771873afac1d
@@ -28,6 +29,7 @@ DIST linux-7.1.12.tar.xz 158461644 BLAKE2B c3a4508d329952c43de9c30eea19c981da7d4
 DIST linux-7.1.13.tar.xz 158441368 BLAKE2B 39db33eae1dcb52ecbbc5a0818ad388fe0cb263f7c8a06b04827b9354e6653f500873354c6c5fe220b332c020087716eef6f4d7915489e4748a6b5c076080e47 SHA512 9d28ed97468db6a163d21cc6929a96bf3bb8997311a0043f719b88dd65517bf4ee533408cf5a9e9db6bd345b03c5601507d6785927adbc7d83f8235059e7e41c
 DIST linux-7.1.8.tar.xz 158434924 BLAKE2B 84b59e5572d91f5ea1bb603aa7691851bd9549e1bf18a6bec8e27eb8a6e2de2e33da2ad3e3aad501c793e9756e70245a16545e76b65a44ee52b33ccf5c3dd8e7 SHA512 e17057478fd498fd4d83c4b6d3712fdfc3c6ae1d077114ea74ee41186cbd75add292f5e5f810fdf41242fd506a476d34447392b1c8194b5e8a6af1a59ac48a74
 DIST linux-7.1.9.tar.xz 158435316 BLAKE2B 873b4d4426295e291118481d911dc2bc67588bb9b1025c19faf7c2a3971cad439efce1c4f244a40a2983d9e7fe405adfb880c0df92ff2e616d0880178129a551 SHA512 b139d559aba45cebd69d9172372f11d9d30e95008f0d721f160352390c91b5e42955c66c0e725f9eab461165e51f6685d0402e5349624b9e4d48eb6f166413be
+DIST linux-7.2.6.tar.xz 160268240 BLAKE2B bbbb558b48b65cf544fe74652437f4aab6578fbb523f4bfef401cecfed8ea94fc939dbab73f2d30216b0729165b8f4a33e23993b082ca9285f259535e7441688 SHA512 2bdcc46f2fb4368aace87b8d063ee50ba93e763f31b1b2401abe2109371bd7ccc1432d0d07159f00f0fc5dbe2e1953ade1d9973bcf4fbc73aaaf056d99652e67
 DIST linux_6.1.137-1.debian.tar.xz 1750936 BLAKE2B 10256733413f1a413a02384d4eed613eb5c087ea3121bc723cdbb4dc36d77c8d3c6fb5ebd419ea11da8f43a1d59492c6645b34845032580b71bd559535a95a1d SHA512 93c04811c5f982776e1105e7770088a6998c9a0dd936bd22645c0aa4b47e64e07b3ad856854c22bc32ffaeaf40266770e65d4976eb249749747a290a1eb8b855
 DIST linux_6.1.148-1.debian.tar.xz 1772788 BLAKE2B 13a19354fb1318cf8620f678b8c0745f6fa06dffdb23f355030fc1bd0dea2f9e7955f8727f90b75dd482cc3d01da05fd142daeeab1217b9da422e9537972bd82 SHA512 7391d085152dce591286e4f8a7e97a8d1325f428aedaca33926853e80b80faf6bb0c8a4393b26fd693592585831772ca49fcacf1dde82acb08c854d8b3615083
 DIST linux_6.1.159-1.debian.tar.xz 1797540 BLAKE2B 5bef79fe5366a397cbf9284b254965aa420640bba6ba830d4721daee2797025acc597978a944c6f4f12fbe174ed328cf148c55a9b56a5543006f801bfeffbb7e SHA512 b9ced5238d7e8bd907691565cc0a6729c7b1508072cfeb9db9addf77dc0d0dff5042e65e4fd757af08e01060248988a75d1f6f491f99a265e1f851125108a57a
@@ -35,6 +37,7 @@ DIST linux_6.1.162-1.debian.tar.xz 1812632 BLAKE2B 680cfdd2f755260f52850835e237a
 DIST linux_6.1.164-1.debian.tar.xz 1830072 BLAKE2B 2c73b0ce6df6fef7fe82795840120bc98a36c0e8d6dedba1379acac79405f988faccfb07c1def789555733fcdae611332f8a308755de53a592c8e7b13ae88c66 SHA512 781ce2a6b00ea2180f5f450db37a0adecf71d2fc2d73059e22ccade37de2f895bedf008ffe2e5c002c01e76dc26b361446562bf386299be392c16252ca92e7c7
 DIST linux_6.1.170-1.debian.tar.xz 1837236 BLAKE2B 31941f98a0a1a16d3b728d488cbcd5402f8c089d1bf40746452f6e2f676c27727eb51ae4c9a2022583479f112e3357535a7a85049a96a750be5cbcf59da8683b SHA512 1dad04429ba2ceb1ddc9e64b45250ce46f4b9f9f4df28b0748ff74d1ec5015bf6831b9bae426b66b4344bafe2d3a42985864a6db15bf9dae1a4bd582254723af
 DIST linux_6.12.101-1.debian.tar.xz 1874152 BLAKE2B c1849e9f48321a9f0351719136546631e1403caea081f60eb60cc573db5250a432b714334267fbbcb43393f9c5122bd77262efb315a64e6d886a92620e9eccf3 SHA512 5302ab9dfc83ccb13c71c1baddf87dd1d2602f058bbb0ef16dc55df1ec7bde3e02e9d43ffd0838b15729dea17d1f3567a4be859b1580ce077eab5b1d4c9f4c8a
+DIST linux_6.12.107-1.debian.tar.xz 1886412 BLAKE2B c536f0f3d8dda8d03b8a8452b2b9c33a96bee825166ef768b599ded7263f8ece4fc67fb8e80b1ba570e3c5b38069aaee4544507eb68a7655d4c83c909f144b11 SHA512 ac4555c9d8c1a4cc2104bfbf645b8fcf28eeaabbfdff0d4fd2d7181b9519f1d0debbafff1c40f8680b1b53a5d9e352379846ad0c5d125a123a4553e52c242434
 DIST linux_6.12.43-1.debian.tar.xz 1687580 BLAKE2B bfbe1681e3259cbe51f514cd7e3c1a0a2777f6b683f42f9465f211dfc4137435d254ee8c7666640f3357ca968d14ff416a1f3120ba5a5f292f1c067c75ab271f SHA512 d554c599d87d5c0dd34c0040a064c8bd4a800719ec81eae78e15cf2c82c1cb8d28be97add9eabcefebb11d2929292fe7e4fd9ffa30058a75b81a02f635d402a2
 DIST linux_6.12.57-1.debian.tar.xz 1732820 BLAKE2B 964bc2d109c24becc8bfcade6f739291c096cf5389272f92137e9b9821f24769738c3d27aee64b7404e2dfb676bd23e2caede749e3aa6212632d808f6991e30f SHA512 35eb0c4107c63058c59417b612b5dc07d716ff46f701b4dae424587309f9ada15c85dc4e32f47528ab68b996d9bddfcf39075ea96a8d09714da5cf9f7e03b030
 DIST linux_6.12.63-1.debian.tar.xz 1751700 BLAKE2B 5899fd8a6bc62ac9daf8dd3b63c82c4dd3bc524631aa43bf459def88b91290069c4ac1e2347ffe978616273ec9843458c7bb03041e298e0bc147618e5297bf51 SHA512 e92f765c1068e300ce4cf678d4f5488bb16c1cf551b42ef7ad001b9f28cbeb74463d605bb1cd86ded1ebbfb0e15fb653884c28984e0232b07b1d8d2309e86465
@@ -59,3 +62,4 @@ DIST linux_7.1.12-1.debian.tar.xz 1540788 BLAKE2B a29db1a3f60a77b4d9cfafb6a9fc2d
 DIST linux_7.1.13-1.debian.tar.xz 1541736 BLAKE2B b66a64aa1e6841b1b7d6b6022469038657ca0da26ca85948b371b35e9fbaa453066cbe05d28faacb2b53327133e8f6843d6f16ecdfd143f61fd0f40ec1e52009 SHA512 5c70405b3d30e095484779eb7f8c155599e77074e4aeecdcc8a52fc9b85ed9556152e56106330f857dc13cac3f75f1acb463e75e93da6cd56416da9fe388191b
 DIST linux_7.1.8-2.debian.tar.xz 1531220 BLAKE2B 6e7e257578917011bd0a9beb8912d7ebfb5fef9fa12535b34cd1ecc43baa2a9b53c645989c2c88b9532e858da611f630e51122f1d9951817118b0233113bd49d SHA512 5046be76545cd7872691ed745cad36dd148a03fb95aaf553cfbb02e2aa314feeae33e356035a7b5d0c3209a6f97d25cf0134802c380660266b0b5a1d3572afd7
 DIST linux_7.1.9-1.debian.tar.xz 1535584 BLAKE2B b2eac859e93d10820c93a366e2a4df16479f0c98798bff801591132e485dec29476676f2cd2b252cda23d9305cd71837623830a10988bd10c79eadba0a2a1fc0 SHA512 2e25cd690d72dfef3309b2a9f4a2d63ea0714dc09346d951a90dc63a9b46b8ea0bce408200f08d3fc72ad6666c8ae9ab13712841dd9a6273022b81db83dfa9ab
+DIST linux_7.2.6-1.debian.tar.xz 1459024 BLAKE2B 25f7ce7a9f060d8c64f5ccf42c7804b10bbe5008b4a63f633df9d1bbb0a40a3a8e556974a7cdd67a78eb38e93b1b29c64893faf8badcd7a2ce81eb3d3db2c6f5 SHA512 f7c5c98188de82076a05f0ef745d50eaeb8709d2ed649cc3bec06601d2ef4c4e1813cc612085a00d83530a77912fea7e0f327c8b2de588996cebab6e9a3504a3
diff --git a/sys-kernel/debian-sources/debian-sources-7.1.13_p1-r400.ebuild b/sys-kernel/debian-sources/debian-sources-7.1.13_p1-r400.ebuild
new file mode 100644
index 0000000..bf1bfce
--- /dev/null
+++ b/sys-kernel/debian-sources/debian-sources-7.1.13_p1-r400.ebuild
@@ -0,0 +1,495 @@
+# Distributed under the terms of the GNU General Public License v2
+# Autogen by MARK Devkit
+
+EAPI=7
+KERNEL_TRIPLET="7.1.13"
+MACARONI_KTYPE="debian"
+MACARONI_KSUFFIX="debian1-mark"
+REVISION_SUFFIX="-forky"
+EXTRAVERSION="-forky-debian1-mark"
+LINUX_SRCDIR="linux-7.1.13-forky-debian1-mark"
+MOD_DIR_NAME="7.1.13-forky-debian1-mark"
+inherit check-reqs eutils ego savedconfig
+
+DESCRIPTION="Debian Sources (and optional binary kernel)"
+HOMEPAGE="https://packages.debian.org/unstable/kernel/"
+SRC_URI="
+https://deb.debian.org/debian/pool/main/l/linux/linux_7.1.13-1.debian.tar.xz -> linux_7.1.13-1.debian.tar.xz
+https://mirrors.edge.kernel.org/pub/linux/kernel/v7.x/linux-7.1.13.tar.xz -> linux-7.1.13.tar.xz"
+LICENSE="GPL-2"
+SLOT="forky/7.1.13_p1"
+KEYWORDS="*"
+IUSE="acpi-ec binary btrfs custom-cflags dracut ec2 +logo luks lvm mdadm savedconfig sshd sign-modules zfs"
+REQUIRED_USE="binary? (
+	^^ ( dracut )
+	btrfs? ( dracut )
+	mdadm? ( dracut )
+	luks? ( dracut )
+	lvm? ( dracut )
+	sshd? ( dracut )
+)
+dracut? ( binary )
+sshd? ( binary )
+"
+RESTRICT="binchecks strip"
+BDEPEND="# Build-time only. Available from src_prepare through
+	# pkg_postinst, then dep-cleanable. Not needed at runtime.
+	virtual/libelf
+	sys-apps/gawk
+	binary? (
+		app-admin/whip
+		sys-apps/whip-catalog
+		sys-kernel/dracut
+		virtual/dracut-mark
+	)
+	sign-modules? ( sys-apps/findutils )
+	
+"
+RDEPEND="btrfs? ( sys-fs/btrfs-progs )
+	zfs? ( sys-fs/zfs )
+	luks? ( sys-fs/cryptsetup )
+	lvm? ( sys-fs/lvm2 )
+	mdadm? ( sys-fs/mdadm )
+	
+"
+S="${WORKDIR}/linux-${KERNEL_TRIPLET}"
+# Helper functions
+get_patch_list() {
+	[[ -z "${1}" ]] && die "No patch series file specified"
+	local patch_series="${1}"
+	while read line ; do
+		if [[ "${line:0:1}" != "#" ]] ; then
+			echo "${line}"
+		fi
+	done < "${patch_series}"
+}
+
+tweak_config() {
+	einfo "Setting $2=$3 in kernel config."
+	case "$2" in
+		*\*)
+			# Wildcard: expand to sed pattern (e.g., CONFIG_DEBUG* → CONFIG_DEBUG.*)
+			local base="${2%\*}"
+			sed -i -e "s/^${base}\(.*\)=.*/${base}\1=${3}/g" "$1"
+			;;
+		*)
+			# Exact: remove old line, append new
+			sed -i -e "/^${2}=/d" "$1"
+			echo "${2}=${3}" >> "$1"
+			;;
+	esac
+}
+
+get_vendor() {
+	vendor_string=$(grep vendor /proc/cpuinfo | uniq | cut -d ':' -f 2)
+	vendor=$([[ ${vendor_string^^} =~ (INTEL)|(AMD) ]] && echo ${BASH_REMATCH[0]})
+	echo $vendor
+}
+
+pkg_pretend() {
+	# Ensure we have enough disk space to compile
+	if use binary ; then
+		CHECKREQS_DISK_BUILD="6G"
+		check-reqs_pkg_setup
+		echo "binary"
+	fi
+}
+
+get_certs_dir() {
+	# find a certificate dir in /etc/kernel/certs/ that contains signing cert for modules.
+	for subdir in $PF $P linux; do
+		certdir=/etc/kernel/certs/$subdir
+		if [ -d $certdir ]; then
+			if [ ! -e $certdir/signing_key.pem ]; then
+				eerror "$certdir exists but missing signing key; exiting."
+				exit 1
+			fi
+			echo $certdir
+			return
+		fi
+	done
+}
+
+pkg_setup() {
+	export REAL_ARCH="$ARCH"
+	unset ARCH; unset LDFLAGS #will interfere with Makefile if set
+	export FEATURESET="standard"
+}
+
+src_prepare() {
+	default
+	# Apply Debian patchset
+	for debpatch in $( get_patch_list "${WORKDIR}/debian/patches/series" ); do
+		eapply -p1 "${WORKDIR}/debian/patches/${debpatch}"
+	done
+
+	# do not include debian devs certificates
+	rm -rf "${WORKDIR}"/debian/certs
+
+	# remove references to debian uefi certs
+	sed -i -e 's|\${CURDIR}\/debian\/certs\/debian-uefi-certs\.pem||g' "${WORKDIR}"/debian/rules.gen
+
+	cd "${S}" || die
+	sed -i -e "s:^\(EXTRAVERSION =\).*:\1 ${EXTRAVERSION}:" Makefile || die
+	sed -i -e 's:#export\tINSTALL_PATH:export\tINSTALL_PATH:' Makefile || die
+	rm -f .config >/dev/null
+	cp -a "${WORKDIR}"/debian "${T}"
+	make -s mrproper || die "make mrproper failed"
+	cp -aR "${WORKDIR}"/debian "${S}"/debian
+
+# patches common to all kernel versions
+
+	# Apply USE-gated patches (applied before kernel config)
+	if use custom-cflags; then
+		eapply "${FILESDIR}/7.1+/more-ISA-levels-and-uarches-for-kernel-7.1.x+.patch" || die "use-patch 7.1+/more-ISA-levels-and-uarches-for-kernel-7.1.x+.patch failed"
+	fi
+
+	# patches for this particular branch (applied via PATCHES array, not here)
+
+	if use savedconfig; then
+		einfo Restoring saved .config ...
+		restore_config .config
+	else
+		cp "${FILESDIR}"/config-extract-6.6 ./config-extract || die
+		chmod +x config-extract || die
+	fi
+
+	# Set up arch-specific variables and this will fail if run in pkg_setup()
+	# since ARCH can be unset there:
+	if [ "${REAL_ARCH}" = x86 ]; then
+		export DEB_ARCH="i386"
+		export DEB_SUBARCH="686-pae"
+		export KERN_ARCH="i686"
+	elif [ "${REAL_ARCH}" = amd64 ]; then
+		export DEB_ARCH="amd64"
+		export DEB_SUBARCH="amd64"
+		export KERN_ARCH="x86_64"
+	elif [ "${REAL_ARCH}" = arm ]; then
+		export DEB_ARCH="arm"
+		export DEB_SUBARCH="arm"
+		export KERN_ARCH="arm"
+	elif [ "${REAL_ARCH}" = arm64 ]; then
+		export DEB_ARCH="arm64"
+		export DEB_SUBARCH="arm64"
+		export KERN_ARCH="aarch64"
+	else
+		die "Architecture '${REAL_ARCH}' not handled in ebuild"
+	fi
+	# like "debian-x86_64-6.12.38-trixie-debian1-mark"
+	# EXTRAVERSION/MOD_DIR_NAME/REVISION_SUFFIX provided by generator (use ${PR} from ebuild filename)
+	# MACARONI_KVER = KERNEL_TRIPLET + REVISION_SUFFIX (no duplicate ARCH)
+	MACARONI_KVER="${KERNEL_TRIPLET}${REVISION_SUFFIX}"
+	export KERN_SUFFIX="${MACARONI_KTYPE}-${KERN_ARCH}-${MACARONI_KVER}-${MACARONI_KSUFFIX}"
+
+	if ! use savedconfig; then
+		./config-extract ${DEB_ARCH} ${FEATURESET} ${DEB_SUBARCH} || die
+	fi
+
+	# Apply unconditional options (wildcards supported, applied in order)
+	tweak_config .config CONFIG_DEBUG* n
+	tweak_config .config CONFIG_MODULE_COMPRESS* n
+	tweak_config .config CONFIG_MODULE_COMPRESS_NONE y
+	tweak_config .config CONFIG_CRYPTO_CRC32C y
+
+	# Apply USE-gated kernel config options
+	if use acpi-ec; then
+		tweak_config .config CONFIG_ACPI_EC_DEBUGFS m
+		tweak_config .config CONFIG_DEBUG_FS y  # custom-cflags
+	fi  # if ne $name "unconditional"
+	if use custom-cflags; then
+		# Detect architecture and apply custom-cflags optimization (ISA patch applied via use_patches in src_prepare)
+		# Extract -march flag from CFLAGS using bash word splitting (handles tabs/spaces/quotes)
+		MARCH=""
+		for _flag in $(python3 -c 'import portage; print(portage.settings["CFLAGS"])'); do
+			[[ "$_flag" == -march=* ]] && MARCH="$_flag" && break
+		done
+
+		if [ -n "$MARCH" ]; then
+			CONFIG_MARCH=""
+			if [ "${KERN_ARCH}" = "x86_64" ] || [ "${KERN_ARCH}" = "i686" ]; then
+				# Build march-to-CONFIG mapping from arch/x86/Makefile (after ISA patch applied)
+				# Exclude "-march=native" entries: they map multiple configs (CONFIG_MNATIVE_INTEL,
+				# CONFIG_MNATIVE_AMD) to the same "native" key, causing last-write-wins collisions.
+				# Those are handled separately by the vendor-detection fallback below.
+				declare -A MARCH_MAP
+				while IFS= read -r line; do
+					cfg=$(echo "$line" | grep -oP 'CONFIG_M[A-Z0-9_]+')
+					mch=$(echo "$line" | sed 's/.*-march=//;s/[[:space:]].*//')
+					# Skip "native" — handled by vendor detection
+					[[ "$mch" == "native" ]] && continue
+					[ -n "$cfg" ] && [ -n "$mch" ] && MARCH_MAP[$mch]=$cfg
+				done < <(grep -E '^\s+cflags-\$\(CONFIG_M' arch/x86/Makefile | grep 'march=')
+
+				# Extract subarch from -march=subarch
+				SUBARCH=$(echo "$MARCH" | sed 's/.*-march=//')
+
+				# Try exact match first
+				if [ "${MARCH_MAP[$SUBARCH]}" ]; then
+					CONFIG_MARCH="${MARCH_MAP[$SUBARCH]}"
+					einfo "Optimizing kernel for ${CONFIG_MARCH} (matched -march=${SUBARCH})"
+				elif [[ "$MARCH" =~ (native) ]] && [ -n "$(get_vendor)" ]; then
+					VENDOR=$(get_vendor)
+					CONFIG_MARCH="CONFIG_MNATIVE_${VENDOR}"
+					einfo "Detected -march=native on ${VENDOR}, using ${CONFIG_MARCH}"
+				fi
+
+				# Fallback: vendor native if specific match failed
+				if [ -z "$CONFIG_MARCH" ] && [ -n "$(get_vendor)" ]; then
+					VENDOR=$(get_vendor)
+					CONFIG_MARCH="CONFIG_MNATIVE_${VENDOR}"
+					einfo "Subarch '${SUBARCH}' not mapped, using ${CONFIG_MARCH}"
+				fi
+			elif [ "${KERN_ARCH}" = "arm" ] || [ "${KERN_ARCH}" = "aarch64" ]; then
+				# ARM architecture - check for vendor-specific optimization
+				if [[ $MARCH =~ (native) ]]; then
+					ARM_VENDOR=""
+					if [ -f /proc/cpuinfo ]; then
+						ARM_VENDOR=$(grep "CPU implementer" /proc/cpuinfo | head -1 | awk '{print $3}')
+						case $ARM_VENDOR in
+							0x41) ARM_VENDOR="arm";;
+							0x43) ARM_VENDOR="cavium";;
+							0x46) ARM_VENDOR="freescale";;
+							0x49) ARM_VENDOR="intel";;
+							0x4d) ARM_VENDOR="motorola";;
+							0x50) ARM_VENDOR="primecell";;
+							0x51) ARM_VENDOR="arm";;
+							0x56) ARM_VENDOR="marvell";;
+							0x58) ARM_VENDOR="amd";;
+							0x69) ARM_VENDOR="intel";;
+							0x6b) ARM_VENDOR="broadcom";;
+							0x6c) ARM_VENDOR="nvidia";;
+							0x70) ARM_VENDOR="apm";;
+							0xc0) ARM_VENDOR="qualcomm";;
+							*) ;;
+						esac
+					fi
+					if [ -n "$ARM_VENDOR" ]; then
+						ARM_CONFIG="CONFIG_${ARM_VENDOR^^}_OPTIMIZED"
+						if grep -q "${ARM_CONFIG}" arch/arm/Makefile 2>/dev/null || grep -q "${ARM_CONFIG}" arch/arm64/Makefile 2>/dev/null; then
+							einfo "Detected -march=native on ARM ${ARM_VENDOR}, using ${ARM_CONFIG}"
+							CONFIG_MARCH="${ARM_CONFIG}"
+						else
+							ewarn "No ${ARM_VENDOR} optimized config found, compiling generic ARM kernel."
+						fi
+					else
+						ewarn "Could not detect ARM vendor for native optimization, compiling generic kernel."
+					fi
+				else
+					# ARM specific subarch - try to match to kernel config
+					ARM_SUBARCH="$(echo ${MARCH} | sed 's/march=//;s/-//g')"
+					ARM_CONFIG="CONFIG_CPU_${ARM_SUBARCH^^}"
+					if grep -q "${ARM_CONFIG}" arch/arm/Makefile 2>/dev/null || grep -q "${ARM_CONFIG}" arch/arm64/Makefile 2>/dev/null; then
+						einfo "Optimizing ${KERN_ARCH} kernel for ${ARM_CONFIG}"
+						CONFIG_MARCH="${ARM_CONFIG}"
+					else
+						ewarn "Could not find optimized settings for ${MARCH}, compiling generic ${KERN_ARCH} kernel."
+					fi
+				fi
+			else
+				ewarn "Custom-cflags not supported for architecture ${KERN_ARCH}, compiling generic kernel."
+			fi
+
+			# Apply if found
+			if [ -n "$CONFIG_MARCH" ]; then
+				tweak_config .config CONFIG_GENERIC_CPU n
+				tweak_config .config "$CONFIG_MARCH" y
+			elif [ -z "$MARCH_MAP[$SUBARCH]" ] && [ -z "$CONFIG_MARCH" ]; then
+				ewarn "No optimization found for ${MARCH}, compiling generic kernel."
+			fi
+		fi  # custom-cflags
+	fi  # if ne $name "unconditional"
+	if use ec2; then
+		tweak_config .config CONFIG_BLK_DEV_NVME y
+		tweak_config .config CONFIG_XEN_BLKDEV_FRONTEND y
+		tweak_config .config CONFIG_XEN_BLKDEV_BACKEND y
+		tweak_config .config CONFIG_IXGBEVF y  # custom-cflags
+	fi  # if ne $name "unconditional"
+	if use logo; then
+		tweak_config .config CONFIG_LOGO y
+		cp "${FILESDIR}"/latest/macaroni-os_logo_clut224.ppm "$S"/drivers/video/logo/logo_linux_clut224.ppm || die
+		ewarn "Linux kernel frame buffer boot logo is now enabled with a custom MacaroniOS pixmap."
+		ewarn "The new logo can be viewed at /usr/src/linux/drivers/video/logo/logo_linux_clut224.ppm"
+		ewarn "Remove the quiet kernel parameter (from params in /etc/boot.conf, and re-run boot-update)."
+		ewarn "This will ensure the custom kernel logo is displayed during boot over frame buffer."
+		ewarn ""  # custom-cflags
+	fi  # if ne $name "unconditional"
+	if use sign-modules; then
+		tweak_config .config CONFIG_MODULE_SIG y
+		tweak_config .config CONFIG_MODULE_SIG_FORCE n
+		tweak_config .config CONFIG_MODULE_SIG_ALL n
+		tweak_config .config CONFIG_MODULE_SIG_HASH "sha512"
+		tweak_config .config CONFIG_MODULE_SIG_KEY "${certs_dir}/signing_key.pem"
+		tweak_config .config CONFIG_SYSTEM_TRUSTED_KEYRING y
+		tweak_config .config CONFIG_SYSTEM_EXTRA_CERTIFICATE y
+		tweak_config .config CONFIG_SYSTEM_EXTRA_CERTIFICATE_SIZE 4096
+		tweak_config .config CONFIG_MODULE_SIG_SHA512 y
+		certs_dir=$(get_certs_dir)
+		echo
+		if [ -z "$certs_dir" ]; then
+			eerror "No certs dir found in /etc/kernel/certs; aborting."
+			die
+		else
+			einfo "Using certificate directory of $certs_dir for kernel module signing."
+		fi
+		echo
+		ewarn "This kernel will ALLOW non-signed modules to be loaded with a WARNING."
+		ewarn "To enable strict enforcement, YOU MUST add module.sig_enforce=1 as a kernel boot"
+		ewarn "parameter (to params in /etc/boot.conf, and re-run boot-update.)"
+		ewarn ""  # custom-cflags
+	fi  # if ne $name "unconditional"  # if ne $name "unconditional"  # range $name, $opts := .Values.kernel_config_options
+
+	# get config into good state:
+	yes "" | make oldconfig >/dev/null 2>&1 || die
+	cp .config "${T}"/config || die
+	make -s mrproper || die "make mrproper failed"
+}
+
+src_compile() {
+	! use binary && return
+	install -d "${WORKDIR}"/build
+	cp "${T}"/config "${WORKDIR}"/build/.config || die "couldn't copy kernel config"
+	make ${MAKEOPTS} O="${WORKDIR}"/build bzImage || die "kernel build failure"
+	make ${MAKEOPTS} O="${WORKDIR}"/build modules || die "modules build failure"
+}
+
+src_install() {
+	# copy sources into place:
+	dodir /usr/src
+	cp -a "${S}" "${D}"/usr/src/${LINUX_SRCDIR} || die
+	cd "${D}"/usr/src/${LINUX_SRCDIR}
+	# prepare for real-world use and 3rd-party module building:
+	make mrproper || die
+	cp "${T}"/config .config || die
+	cp -a "${T}"/debian debian || die
+
+	# if we didn't compile a kernel, we're done. The kernel source tree is left in
+	# an unconfigured state - you can't compile 3rd-party modules against it yet.
+	use binary || return
+	make ${MAKEOPTS} O="${WORKDIR}"/build INSTALL_MOD_PATH="${D}" modules_install || die "modules install failure"
+	insinto /boot
+	newins ${WORKDIR}/build/arch/x86/boot/bzImage "vmlinuz-${KERN_SUFFIX}.tmp"
+	newins ${WORKDIR}/build/System.map "System.map-${KERN_SUFFIX}.tmp"
+	newins ${WORKDIR}/build/.config "config-${KERN_SUFFIX}.tmp"
+	make prepare || die
+	make scripts || die
+	# FL-8004: In Linux 5.10, module.lds is generated by 'modules_prepare',
+	# so we need to run it as well to be able to compile modules
+	make modules_prepare || die
+
+	# module symlink fixup:
+	rm -f "${D}"/lib/modules/*/source || die
+	rm -f "${D}"/lib/modules/*/build || die
+	cd "${D}"/lib/modules
+	local moddir="$(make -s -C "${WORKDIR}"/build kernelrelease)"
+	ln -s /usr/src/${LINUX_SRCDIR} "${D}"/lib/modules/${moddir}/source || die
+	ln -s /usr/src/${LINUX_SRCDIR} "${D}"/lib/modules/${moddir}/build || die
+	# Move to .tmp so Portage tracks it; pkg_postinst renames to MOD_DIR_NAME
+	mv "${D}"/lib/modules/${moddir}{,.tmp} || die
+	# Fixes FL-14
+	cp "${WORKDIR}/build/System.map" "${D}/usr/src/${LINUX_SRCDIR}/" || die
+	cp "${WORKDIR}/build/Module.symvers" "${D}/usr/src/${LINUX_SRCDIR}/" || die
+	if use sign-modules; then
+		# FIXME: only signs uncompressed .ko modules; compressed .ko.xz are skipped.
+		# Requires kernel >= 6.12+ CONFIG_MODULE_COMPRESS_XZ support detection.
+		find "${D}"/lib/modules -iname *.ko ! -iname *.ko.xz \
+				-exec ${WORKDIR}/build/scripts/sign-file sha512 \
+				$certs_dir/signing_key.pem $certs_dir/signing_key.x509 {} \; || die
+		# install the sign-file executable for future use.
+		exeinto /usr/src/${LINUX_SRCDIR}/scripts
+		doexe ${WORKDIR}/build/scripts/sign-file
+	fi
+	# The following line associates the .tmp dir with this package, so that
+	# when the package is uninstalled, the modules are not removed.
+	# Otherwise, modules for the current running kernel might be erased!
+	mv "${D}"/lib/modules/${moddir}{,.tmp}
+}
+
+pkg_postinst() {
+	# Ensure that /boot is mounted in this phase
+	ego_pkg_preinst
+
+	# Back up existing initramfs as .old before generating a new one
+	# (matches kernel backup pattern: vmlinuz, System.map, config)
+	if use binary && use dracut; then
+		if [[ -f "/boot/initramfs-${KERN_SUFFIX}" ]]; then
+			rm -f "/boot/initramfs-${KERN_SUFFIX}.old"
+			einfo "Preserving: mv /boot/initramfs-${KERN_SUFFIX}{,.old}"
+			mv /boot/initramfs-${KERN_SUFFIX}{,.old} || die
+		fi
+	fi
+
+	# Pattern: install everything as .tmp in src_install, move to real names here.
+		# Portage tracks .tmp files; on uninstall it removes them, but the real
+	# files (moved into place by postinst) are not tracked by portage.
+	# If the destination already exists, erase stale .old first, then back up as .old.
+	if use binary; then
+		# Move boot files from .tmp to real names (back up existing as .old)
+		for i in vmlinuz System.map config; do
+			if [[ -f "/boot/${i}-${KERN_SUFFIX}.tmp" ]]; then
+				if [[ -f "/boot/${i}-${KERN_SUFFIX}" ]]; then
+					rm -f "/boot/${i}-${KERN_SUFFIX}.old"
+					einfo "Preserving: mv /boot/${i}-${KERN_SUFFIX}{,.old}"
+					mv "/boot/${i}-${KERN_SUFFIX}" "/boot/${i}-${KERN_SUFFIX}.old" || die
+				fi
+				mv "/boot/${i}-${KERN_SUFFIX}.tmp" "/boot/${i}-${KERN_SUFFIX}" || die
+			fi
+		done
+		# Move modules from .tmp to real name (back up existing as .old)
+		local tmp_moddir
+		tmp_moddir="$(ls -d /lib/modules/*.tmp 2>/dev/null | head -1)"
+		if [[ -n "$tmp_moddir" ]]; then
+			if [[ -d "/lib/modules/${MOD_DIR_NAME}" ]]; then
+				rm -rf "/lib/modules/${MOD_DIR_NAME}.old"
+				einfo "Preserving: mv /lib/modules/${MOD_DIR_NAME}{,.old}"
+				mv "/lib/modules/${MOD_DIR_NAME}" "/lib/modules/${MOD_DIR_NAME}.old" || die
+			fi
+			mv "$tmp_moddir" "/lib/modules/${MOD_DIR_NAME}" || die
+		fi
+	fi
+
+	# Finally, generate a new initramfs with dracut, via whip
+	# NOTE: For now, the initramfs is generic.
+	if use binary && use dracut; then
+		dracut_modules_pre="
+			$(use btrfs && echo btrfs)
+			$(use luks && echo crypt)
+			$(use lvm && echo lvm)
+			$(use mdadm && echo mdraid)
+			$(use sshd && echo sshd)
+		"
+		dracut_drivers_pre="
+			$(use luks && echo dm-crypt)
+		"
+		DRACUT_ADD_MODULES="$(echo ${dracut_modules_pre} | xargs)" \
+		DRACUT_ADD_DRIVERS="$(echo ${dracut_drivers_pre} | xargs)" \
+		KVER="${KERN_ARCH}-${MACARONI_KVER}" \
+		KTYPE="${MACARONI_KTYPE}" \
+		KSUFFIX="${MACARONI_KSUFFIX}" \
+		KMODDIR="/lib/modules/$MOD_DIR_NAME" \
+		whip h initramfs.generate_with_dracut || ewarn "whip initramfs generation failed (non-fatal)"
+	fi
+
+	if use binary && [[ -h /usr/src/linux ]]; then
+		rm /usr/src/linux || die
+	fi
+
+	if use binary && [[ ! -e /usr/src/linux ]]; then
+		ewarn "With binary use flag enabled /usr/src/linux"
+		ewarn "symlink automatically set to debian kernel"
+		ewarn "If you have external modules, don't forget to rebuild them with:"
+		ewarn ""
+		ewarn "  emerge @module-rebuild"
+		ewarn ""
+		ln -sf "${LINUX_SRCDIR}" /usr/src/linux || die
+	fi
+
+	if [ -e /lib/modules ]; then
+		depmod -a $MOD_DIR_NAME || die
+	fi
+
+	# Update bootloader and unmount /boot
+	ego_pkg_postinst
+}
+
+
+# vim: filetype=ebuild