Quentin Kaiser disclosed at Hexacon (Oct 16) an overflow in the EAP fragment reassembly of Broadcom's proprietary WPS code (the old 'WPS Monitor' stack), present in Broadcom's SDK since at least 2010. Anyone in Wi-Fi range can trigger it without the network key or a completed WPS enrollment, getting an information leak and code execution; his demos pull the PSK from NVRAM and open a reverse shell over 802.11 frames, so no internet C2 is needed. Broadcom told him it has known about the bug since 2018, shipped a replacement based on hostapd, and refused to register a CVE (Broadcom is its own CNA, so CERT/CC closed his case). Kaiser calls it a permanent 'forever day' on eCos chips (BCM3380, BCM3383, BCM33834) and a likely one on Linux chips (BCM3390, BCM65xx, BCM68xx) unless vendors migrate. He confirmed it on gateways from three of four Belgian ISPs (Proximus BBOX 3V+, VOO/Orange Netgear CG3100/CG3700, Technicolor 7210/CGA4233, Orange ASKEY TCG3000), estimates roughly 1.5 million affected devices in Belgium (his own medium-confidence estimate), and said none were patched as of Oct 15. His device list also names ARRIS, Arcadyan (KPN), Comtrend and MitraStar (Movistar), ZTE F680, SFR NB6 and several Cisco small-business RV/WAP models. He says frontier AI models cut the research from months to under a week. No in-the-wild exploitation has been reported.