diff --git a/firmware/esp32-csi-node/release_bins/bootloader.bin b/firmware/esp32-csi-node/release_bins/bootloader.bin
index 97bd8823..c3841d86 100644
Binary files a/firmware/esp32-csi-node/release_bins/bootloader.bin and b/firmware/esp32-csi-node/release_bins/bootloader.bin differ
diff --git a/firmware/esp32-csi-node/release_bins/esp32-csi-node-4mb.bin b/firmware/esp32-csi-node/release_bins/esp32-csi-node-4mb.bin
index 48b8b141..1d2cee73 100644
Binary files a/firmware/esp32-csi-node/release_bins/esp32-csi-node-4mb.bin and b/firmware/esp32-csi-node/release_bins/esp32-csi-node-4mb.bin differ
diff --git a/firmware/esp32-csi-node/release_bins/esp32-csi-node.bin b/firmware/esp32-csi-node/release_bins/esp32-csi-node.bin
index 9ff70d51..82424362 100644
Binary files a/firmware/esp32-csi-node/release_bins/esp32-csi-node.bin and b/firmware/esp32-csi-node/release_bins/esp32-csi-node.bin differ
diff --git a/firmware/esp32-csi-node/sdkconfig.defaults.4mb b/firmware/esp32-csi-node/sdkconfig.defaults.4mb
index 0ef6d26a..01c0f664 100644
--- a/firmware/esp32-csi-node/sdkconfig.defaults.4mb
+++ b/firmware/esp32-csi-node/sdkconfig.defaults.4mb
@@ -29,5 +29,7 @@ CONFIG_LWIP_SO_RCVBUF=y
 CONFIG_ESP_MAIN_TASK_STACK_SIZE=8192
 
 # ADR-081: adaptive_controller runs emit_feature_state + stream_sender
-# network I/O inside Timer Svc callbacks, exceeding the 2 KiB default.
-CONFIG_FREERTOS_TIMER_TASK_STACK_DEPTH=8192
+# network I/O inside Timer Svc callbacks. 8 KiB was insufficient under
+# lwIP sendto + state-transition rv_mesh anomaly emit (issue #505 4MB
+# reset loop on Tmr Svc); 16 KiB absorbs the worst-case path.
+CONFIG_FREERTOS_TIMER_TASK_STACK_DEPTH=16384
diff --git a/firmware/esp32-csi-node/sdkconfig.defaults.template b/firmware/esp32-csi-node/sdkconfig.defaults.template
index a7732c19..3a78c715 100644
--- a/firmware/esp32-csi-node/sdkconfig.defaults.template
+++ b/firmware/esp32-csi-node/sdkconfig.defaults.template
@@ -33,5 +33,7 @@ CONFIG_LWIP_SO_RCVBUF=y
 CONFIG_ESP_MAIN_TASK_STACK_SIZE=8192
 
 # ADR-081: adaptive_controller runs emit_feature_state + stream_sender
-# network I/O inside Timer Svc callbacks, exceeding the 2 KiB default.
-CONFIG_FREERTOS_TIMER_TASK_STACK_DEPTH=8192
+# network I/O inside Timer Svc callbacks. 8 KiB was insufficient under
+# lwIP sendto + state-transition rv_mesh anomaly emit (issue #505 4MB
+# reset loop on Tmr Svc); 16 KiB absorbs the worst-case path.
+CONFIG_FREERTOS_TIMER_TASK_STACK_DEPTH=16384
diff --git a/firmware/esp32-csi-node/version.txt b/firmware/esp32-csi-node/version.txt
index b6160487..d2b13eb6 100644
--- a/firmware/esp32-csi-node/version.txt
+++ b/firmware/esp32-csi-node/version.txt
@@ -1 +1 @@
-0.6.2
+0.6.4