Cherry picking one example very recently, we discovered a certain router model shipping in calibration mode such that only 1-2 STAs could transmit at any given time. Essentially rendering an AC router into the performance class of a mixed-mode a/b/g router from 2004. Working with the upstream vendors to fix this took several weeks.

Sometimes though its not even phy or mac layer bugs we find, its more banal nonsense like a poorly configured firewall that eats up all the NPU clock cycles when it sees a 30 pps rate of unsolicited UDP ingress. Or my personal favorite was the erase block management on flash that would remount the data partition as read-only whenever a single ECC cycle would fail on a given sector and permabrick the unit until reboot.