@@ -8,10 +8,10 @@ extern "C" {
 
 #define RPC_PROTO_MAJOR_VERSION    8
 #define RPC_PROTO_MINOR_VERSION    0
-#define RPC_PROTO_PATCH_VERSION    0
+#define RPC_PROTO_PATCH_VERSION    1
 
 #ifdef  __cplusplus
-static_assert(GGML_OP_COUNT == 101, "GGML_OP_COUNT has changed - update RPC_PROTO_PATCH_VERSION");
+static_assert(GGML_OP_COUNT == 103, "GGML_OP_COUNT has changed - update RPC_PROTO_PATCH_VERSION");
 #endif
 
 #define GGML_RPC_MAX_SERVERS       16
 
@@ -0,0 +1,36 @@
+#pragma once
+
+// RC link parameter helpers for the RDMA transport: carry the local path MTU
+// in the free top byte of the 24-bit PSN field, and negotiate the common MTU.
+// Pure logic, no verbs types, so it is unit-testable with no NIC.
+
+#include <cstdint>
+
+// PSN is 24 bits (qp_num & 0xffffff), so the top byte is free. ibv_mtu is 1..5,
+// which fits in 3 bits. 0 in those bits means "peer advertised no MTU" (old peer).
+static constexpr uint32_t RDMA_PSN_MASK = 0x00ffffffu;
+static constexpr int      RDMA_PSN_MTU_SHIFT = 24;
+static constexpr uint32_t RDMA_PSN_MTU_BITS  = 0x7u;
+
+// Pack a 24-bit PSN and an MTU enum (1..5) into one wire word.
+inline uint32_t rdma_psn_pack(uint32_t psn24, int mtu) {
+    return (psn24 & RDMA_PSN_MASK) | ((uint32_t)(mtu & RDMA_PSN_MTU_BITS) << RDMA_PSN_MTU_SHIFT);
+}
+
+// Recover the real 24-bit PSN for use as rq_psn.
+inline uint32_t rdma_psn_base(uint32_t psn) {
+    return psn & RDMA_PSN_MASK;
+}
+
+// Recover the peer MTU enum (0 if the peer advertised none).
+inline int rdma_psn_mtu(uint32_t psn) {
+    return (int)((psn >> RDMA_PSN_MTU_SHIFT) & RDMA_PSN_MTU_BITS);
+}
+
+// Common MTU: the smaller of the two, but a remote 0 means "unknown" so keep local.
+inline int rdma_mtu_min(int local_mtu, int remote_mtu) {
+    if (remote_mtu == 0) {
+        return local_mtu;
+    }
+    return remote_mtu < local_mtu ? remote_mtu : local_mtu;
+}
@@ -0,0 +1,62 @@
+#pragma once
+
+// Turns completed fixed-size RECV frames into exact-size reads for the RDMA
+// transport. A frame longer than the pending read is kept; its tail serves the
+// next read. This bounds the copy that rdma_recv used to do unchecked.
+// Pure logic, no verbs types, so it is unit-testable with a plain buffer.
+
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+
+// A posted RECV buffer is RDMA_CHUNK bytes, so a frame can never be longer.
+// Kept as its own constant to decouple the header from transport.cpp internals.
+#ifndef RX_REASSEMBLER_CHUNK
+#define RX_REASSEMBLER_CHUNK (256 * 1024)
+#endif
+
+struct rx_reassembler {
+    bool has_pending() const { return slot >= 0; }
+
+    // Start a new frame. Returns false on a bad length (peer protocol error):
+    // empty frame, or longer than a posted RECV buffer.
+    bool set_frame(int frame_slot, size_t byte_len) {
+        if (byte_len == 0 || byte_len > cap) {
+            return false;
+        }
+        slot = frame_slot;
+        off  = 0;
+        len  = byte_len;
+        return true;
+    }
+
+    // Copy up to want bytes of the pending frame into dst. src is the pending
+    // frame's RECV buffer. Returns the number of bytes copied (never > want,
+    // never past the frame).
+    size_t drain(const uint8_t * src, uint8_t * dst, size_t want) {
+        size_t avail = len - off;
+        size_t n = want < avail ? want : avail;
+        memcpy(dst, src + off, n);
+        off += n;
+        return n;
+    }
+
+    bool frame_done() const { return off == len; }
+
+    // Hand back the fully drained slot so the caller can repost it, clear state.
+    int take_slot() {
+        int s = slot;
+        slot = -1;
+        off = 0;
+        len = 0;
+        return s;
+    }
+
+    int    pending_slot() const { return slot; }
+
+private:
+    int    slot = -1;                        // -1 = no pending frame
+    size_t off  = 0;                         // bytes of the frame already served
+    size_t len  = 0;                         // frame length
+    size_t cap  = RX_REASSEMBLER_CHUNK;      // max valid frame length
+};
@@ -55,6 +55,10 @@ using rdma_gid_t = std::array<uint8_t, RDMA_GID_SIZE>;
 
 #if defined(GGML_RPC_RDMA) && !defined(GGML_RPC_RDMA_APPLE)
 static constexpr size_t RDMA_CHUNK    = 256 * 1024;   // 256 KiB per send/recv (fits default 8 MiB memlock)
+#define RX_REASSEMBLER_CHUNK (256 * 1024)
+#include "rdma_reassembler.h"
+#include "rdma_link_params.h"
+static_assert(RX_REASSEMBLER_CHUNK == RDMA_CHUNK, "reassembler cap must match RDMA_CHUNK");
 static constexpr int    RDMA_RX_DEPTH = 24;            // pre-posted recv ring: 24 × 256 KiB = 6 MiB
 // keep polling the CQ for this long after the last activity, then sleep until the next completion
 static constexpr auto   RDMA_SPIN_TIME = std::chrono::milliseconds(100);
@@ -75,6 +79,7 @@ struct rdma_conn {
     void          * rx_buf = nullptr; // RDMA_RX_DEPTH × RDMA_CHUNK contiguous
     struct ibv_mr * rx_mr  = nullptr;
     int             rx_head = 0;
+    rx_reassembler  reasm;          // bounds frame copies to the requested size
 
     uint32_t        max_inline = 0;
 
@@ -350,6 +355,15 @@ bool socket_t::impl::rdma_probe() {
 // Phase 2: Given remote QPN/PSN/GID, transition QP: RESET->INIT->pre-post->RTR->RTS.
 // On success, the connection is live and ready for rdma_send/rdma_recv.
 bool socket_t::impl::rdma_activate(uint32_t remote_qpn, uint32_t remote_psn, const uint8_t * remote_gid) {
+    // the remote MTU rides in the top byte of the PSN field; 0 = old peer
+    enum ibv_mtu mtu = (enum ibv_mtu)rdma_mtu_min(rdma_local.path_mtu, rdma_psn_mtu(remote_psn));
+    uint32_t rq_psn  = rdma_psn_base(remote_psn);
+
+    const char * hl_env = std::getenv("GGML_RDMA_HL");
+    const char * tc_env = std::getenv("GGML_RDMA_TC");
+    uint8_t hop_limit    = hl_env ? (uint8_t)atoi(hl_env) : 64;
+    uint8_t traffic_class = tc_env ? (uint8_t)atoi(tc_env) : 0;
+
     // RESET -> INIT
     {
         struct ibv_qp_attr a = {};
@@ -371,14 +385,15 @@ bool socket_t::impl::rdma_activate(uint32_t remote_qpn, uint32_t remote_psn, con
     {
         struct ibv_qp_attr a = {};
         a.qp_state           = IBV_QPS_RTR;
-        a.path_mtu           = rdma_local.path_mtu;
+        a.path_mtu           = mtu;
         a.dest_qp_num        = remote_qpn;
-        a.rq_psn             = remote_psn;
+        a.rq_psn             = rq_psn;
         a.max_dest_rd_atomic = 1;
         a.min_rnr_timer      = 1;
         a.ah_attr.is_global  = 1;
         memcpy(&a.ah_attr.grh.dgid, remote_gid, RDMA_GID_SIZE);
-        a.ah_attr.grh.hop_limit  = 1;
+        a.ah_attr.grh.hop_limit     = hop_limit;
+        a.ah_attr.grh.traffic_class = traffic_class;
         a.ah_attr.grh.sgid_index = rdma_local.gid_idx;
         a.ah_attr.dlid       = 0;
         a.ah_attr.port_num   = rdma_local.ib_port;
@@ -407,8 +422,8 @@ bool socket_t::impl::rdma_activate(uint32_t remote_qpn, uint32_t remote_psn, con
 
     rdma->last_active = std::chrono::steady_clock::now();
 
-    GGML_LOG_INFO("RDMA activated: qpn=%u->%u mtu=%d rx_depth=%d\n",
-                  rdma_local.qpn, remote_qpn, 128 << rdma_local.path_mtu, RDMA_RX_DEPTH);
+    GGML_LOG_INFO("RDMA activated: qpn=%u->%u mtu=%d hop=%u tc=%u rx_depth=%d\n",
+                  rdma_local.qpn, remote_qpn, 128 << mtu, hop_limit, traffic_class, RDMA_RX_DEPTH);
     return true;
 }
 
@@ -517,17 +532,21 @@ bool socket_t::impl::rdma_recv(void * data, size_t size) {
     uint8_t * dst = (uint8_t *)data;
     size_t rem = size;
     while (rem > 0) {
-        struct ibv_wc wc;
-        if (!rdma_poll(c->rcq, &wc)) return false;
-
-        int slot = (int)wc.wr_id;
-        size_t got = wc.byte_len;
-        memcpy(dst, c->rx_slot(slot), got);
-
-        if (!c->post_rx(slot)) return false;
-
-        dst += got;
-        rem -= got;
+        if (!c->reasm.has_pending()) {
+            struct ibv_wc wc;
+            if (!rdma_poll(c->rcq, &wc)) return false;
+            if (!c->reasm.set_frame((int)wc.wr_id, wc.byte_len)) {
+                GGML_LOG_ERROR("RDMA recv: bad frame len %u\n", wc.byte_len);
+                return false;
+            }
+        }
+        int slot = c->reasm.pending_slot();
+        size_t n = c->reasm.drain(c->rx_slot(slot), dst, rem);
+        dst += n;
+        rem -= n;
+        if (c->reasm.frame_done() && !c->post_rx(c->reasm.take_slot())) {
+            return false;
+        }
     }
     return true;
 }
@@ -604,7 +623,7 @@ void socket_t::impl::get_caps(uint8_t * local_caps) {
     if (rdma_probe()) {
         rdma_caps rc = {};
         rc.qpn = rdma_local.qpn;
-        rc.psn = rdma_local.psn;
+        rc.psn = rdma_psn_pack(rdma_local.psn, rdma_local.path_mtu);
         memcpy(rc.gid, rdma_local.gid, RDMA_GID_SIZE);
         memcpy(local_caps, &rc, sizeof(rc));
     } else {
 
@@ -0,0 +1,45 @@
+// Unit test for rdma_link_params.h: PSN/MTU packing and MTU negotiation.
+// Pure logic, no NIC. Guards item 02.
+
+#include "ggml-rpc/rdma_link_params.h"
+
+#include <cstdint>
+#include <cstdio>
+
+static int g_fail = 0;
+#define CHECK(cond) do { \
+    if (!(cond)) { printf("FAIL %s:%d: %s\n", __FILE__, __LINE__, #cond); g_fail++; } \
+} while (0)
+
+int main() {
+    // 1. pack/unpack round-trip for every valid ibv_mtu enum (1..5).
+    for (int mtu = 1; mtu <= 5; mtu++) {
+        uint32_t psn = 0x00abcdef;
+        uint32_t packed = rdma_psn_pack(psn, mtu);
+        CHECK(rdma_psn_mtu(packed) == mtu);
+        CHECK(rdma_psn_base(packed) == psn);
+    }
+
+    // 2. old peer advertises top byte 0 -> no MTU.
+    CHECK(rdma_psn_mtu(0x00abcdef) == 0);
+
+    // 3. MTU negotiation: remote 0 -> local, else the smaller.
+    CHECK(rdma_mtu_min(3, 0) == 3);
+    CHECK(rdma_mtu_min(3, 4) == 3);
+    CHECK(rdma_mtu_min(4, 3) == 3);
+    CHECK(rdma_mtu_min(5, 5) == 5);
+
+    // 4. base preserves the low 24 bits regardless of the carried byte.
+    CHECK(rdma_psn_base(rdma_psn_pack(0x00ffffff, 5)) == 0x00ffffff);
+    CHECK(rdma_psn_base(rdma_psn_pack(0x00000000, 1)) == 0x00000000);
+
+    // 5. a 24-bit base is never changed by packing then stripping.
+    CHECK(rdma_psn_base(rdma_psn_pack(0x00123456, 2)) == 0x00123456);
+
+    if (g_fail == 0) {
+        printf("test-rpc-link-params: all checks passed\n");
+        return 0;
+    }
+    printf("test-rpc-link-params: %d checks failed\n", g_fail);
+    return 1;
+}