Repository navigation
End Device Initiator flag remains set when forwarding remote group commands #65
Description
One caveat at the beginning: this whole investigation was done using an AI agent, I am not that knowledgeable in the zigbee stack.
Ziggurat currently forwards group commands (e.g. from a remote) with the NWK End Device Initiator flag still set. A bound light does not respond, although Ziggurat receives and retransmits the commands successfully.
Zigbee specification 05-3474-23, §3.3.1.1.8, requires the parent to clear this flag when relaying a message from an end-device child. Under §3.6.2.2, other routers must reject an initiator-marked message if the source is not an end device in their neighbor table.
Details
- Tested revision:
392d4c7fe5c497d553977492bc02cb305573b7fc. - Remote: IKEA
TRADFRI remote control. - Light: IKEA
TRADFRI bulb E27 WW 806lm. - The remote’s On/Off and Level Control bindings point to group 3; the bulb’s queried membership includes group 3.
The raw capture shows the remote sending a MAC unicast to the coordinator with NWK destination 0xFFFD. Ziggurat broadcasts three copies, all with successful radio TX results. The NWK frame control remains 0x2248, retaining End Device Initiator. The source and sequence are preserved, and the radius decreases from 12 to 11.
In crates/ziggurat-driver/src/zigbee_stack/nwk.rs, maybe_relay_broadcast() clones the frame without clearing end_device_initiator. The unicast relay path also retains it.
I applied a local fix that clears the flag before forwarding, including broadcast retries and indirect copies. After deployment, toggle and brightness controls worked.
Activity
TheJulianJES commentedon Oct 14, 2026
@zigpy-review-bot Investigate. Possibly also open PR(s). Do up to 6 review rounds for both code and PR description.
zigpy-review-bot commentedon Oct 14, 2026
Thanks for the detailed analysis, it checks out. The Zigbee R23.2 spec (§3.3.1.1.8) requires a router parent to clear the End Device Initiator bit when relaying a frame from one of its end device children, and ziggurat never did, so routers that don't have the remote as their own child drop the relayed group command (§3.6.2.2).
Fix: #66. It clears the bit for frames whose NWK source is one of our end device children, in both the broadcast relay (the relayed copy, its retransmits, and the copies queued for sleepy children) and the unicast relay (sender retries and the indirect queue). That matches the paths your local fix covered.
Details
crates/ziggurat-driver/src/zigbee_stack/nwk.rs,maybe_relay_broadcast, the sleepy-child fan-out andrelay_unicast_nwk_frameall forwarded the frame with the bit unchanged.