Wifi works on the ThinkPad X1 (Intel AC 9560), packaged as Nix

Wifi runs on real hardware: the ThinkPad X1's Intel Wireless-AC 9560 (8086:a370) attaches, loads firmware, scans, and completes a full WPA2/CCMP association under solnix — the OpenBSD in-kernel 4-way handshake runs with no wpad, the pairwise key installs, and encrypted data flows both directions (verified by learning IPv6 neighbors over the air). It is a port of the OpenBSD iwm driver (BSD-licensed; the firmware is Intel's redistributable 9000-series ucode behind the usual Nix unfree opt-in), and it coexists with the Intel GPU driver in one kernel. Five hardware-root-caused bugs stood between 'firmware loads' and 'a working encrypted link' — a double-free on the attach error path, non-contiguous DMA buffers, an MSI interrupt that needed ddi_intr_block_enable, an all-zero source MAC in the auth frame, and a no-op mbuf-prepend — each fixed from the hardware, not guessed. The whole stack is pure Nix derivations (kernel module built from source with a symbol gate, firmware, and the wpa-pmk helper) behind a declarative hardware.wirelessIwm option; the passphrase stays in a 0600 file, never in the Nix store. Honest limits: association picks the strongest matching WPA2 AP by ESSID (no BSSID pin by default), IPv4 DHCP over wifi has not been exercised on this network yet (IPv6 is the verified path), and throughput/power tuning are not characterized.