I wrote the attached little util program to try out the basic approach and thought that you might find it useful as well as providing some simple testing. It isn't a final solution so the interface is rough. The program must be run as root on an Intel based machine. The key point is that the IO address needs to be entered - I grab it from the dmesg output: eth0: 3Com 3c905B Cyclone 100baseTx at 0xe400, 00:10:4b:d2:5e:0d, IRQ 11 or "cat /proc/pci" to find the "I/O at XXXXXX" for your 3Com Card. Some example commands are: romutil 0xe400 erase - erases the ROM contents romutil 0xe400 protect - enables the Software Data Protection on the ROM [3c905B only] romutil 0xe400 unprotect - disables the Software Data Protection on the ROM [3c905B only] romutil 0xe400 id - displays the manufacturer and device IDs romutil 0xe400 read >file - writes the contents of the ROM to stdout romutil 0xe400 prog <file - writes the contents of the stdin into the ROM (<64k) I tried reading and writing the ROM while doing large ftp transfers and experienced no problems. I didn't spend much time worrying about the possible race conditions. My system has lots of resources (450MHx P2, 128MB RAM) so it might not provide the best test candidate. Let me know what results you get if you try it out. Thanks John