diff --git a/rtl837x_port.c b/rtl837x_port.c
index 6874685f..41b7e984 100644
--- a/rtl837x_port.c
+++ b/rtl837x_port.c
@@ -271,7 +271,7 @@ void vlan_setup(void) __banked
 	wait_table_ready();
 
 	// Set PVID 1 for every port. TODO: Skip unused ports!
-	for (uint8_t i = MACHINE_MIN_PORT; i <= MACHINE_MAX_PORT + 1; i++) {  // Do this also for the CPU port (+1)
+	for (uint8_t i = MACHINE_MIN_PORT; i <= CPU_PORT; i++) { // CPU MAC is independent of the last user port
 		uint16_t reg = RTL837x_PVID_BASE_REG + ((i >> 1) << 2);
 #ifdef DEBUG
 		print_byte(i); write_char(':'); write_char(' '); print_short(reg); write_char('=');
@@ -307,7 +307,7 @@ void vlan_setup(void) __banked
 	REG_SET(RTL837X_VLAN_L2_LRN_DIS_0, 0);
 	REG_SET(RTL837X_VLAN_L2_LRN_DIS_1, 0);
 
-	// Enable VLAN 1: Ports 0-9, i.e. including the CPU port are untagged members
+	// Enable VLAN 1: user ports untagged, CPU MAC9 tagged (untag bit 19 clear)
 	REG_SET(RTL837x_TBL_DATA_IN_A, machine_detected.isRTL8373? 0x0207ffff : 0x0207e3f8);	// 02: Entry valid, 7...: membership
 
 	REG_SET(RTL837X_TBL_CTRL, 0x00010303);	// Write VLAN 1
diff --git a/test/Makefile b/test/Makefile
index 5e4dd292..6b145fb1 100644
--- a/test/Makefile
+++ b/test/Makefile
@@ -29,6 +29,9 @@ TESTS = $(BUILDDIR)/test_cmd_editor \
         $(BUILDDIR)/test_page_json \
         $(BUILDDIR)/test_httpd_tx \
         $(BUILDDIR)/test_tick_gate \
+        $(BUILDDIR)/test_cpu_vlan_full \
+        $(BUILDDIR)/test_cpu_vlan_restricted \
+        $(BUILDDIR)/test_cpu_vlan_8372 \
         $(BUILDDIR)/test_nic_rx \
         $(BUILDDIR)/test_lacp
 
@@ -70,6 +73,12 @@ $(BUILDDIR)/test_lacp: test_lacp.c $(SRCROOT)/rtl837x_lacp.c | $(BUILDDIR)
 $(BUILDDIR)/test_httpd_tx: test_httpd_tx.c $(SRCROOT)/httpd/httpd.c $(SRCROOT)/uip/uip.c | $(BUILDDIR)
 	$(CC) $(CFLAGS) $(filter %.c,$^) -o $@ $(LDFLAGS)
 
+# CPU VLAN initialization with full and reduced user-port ranges.
+$(BUILDDIR)/test_cpu_vlan_restricted: CFLAGS += -DMACHINE_MAX_PORT=7
+$(BUILDDIR)/test_cpu_vlan_8372: CFLAGS += -DMACHINE_MAX_PORT=7 -DMACHINE_MIN_PORT=3 -DRTLP_TEST_IS8373=0
+$(BUILDDIR)/test_cpu_vlan_full $(BUILDDIR)/test_cpu_vlan_restricted $(BUILDDIR)/test_cpu_vlan_8372: test_cpu_vlan.c $(TABLE_ENV) | $(BUILDDIR)
+	$(CC) $(CFLAGS) $(filter %.c,$^) -o $@ $(LDFLAGS)
+
 run: $(TESTS)
 	@fail=0; for t in $(TESTS); do \
 		echo "=== $$t ==="; \
diff --git a/test/env_tables.c b/test/env_tables.c
index e4d23c37..494499ff 100644
--- a/test/env_tables.c
+++ b/test/env_tables.c
@@ -57,13 +57,16 @@ const uint8_t hex_chars[] = "0123456789abcdef";
 uint8_t *hex = (uint8_t *)hex_chars;
 
 /* ---- a 9-port RTL8373 whose logical ports map to themselves ---- */
+#ifndef RTLP_TEST_IS8373
+#define RTLP_TEST_IS8373 1
+#endif
 const struct machine machine = {
 	.machine_name = "HOSTTEST",
 	.n_sfp = 0,
 	.log_to_phys_port = { 1, 2, 3, 4, 5, 6, 7, 8, 9 },
 	.phys_to_log_port = { 0, 1, 2, 3, 4, 5, 6, 7, 8 },
 };
-struct machine_runtime machine_detected = { .isRTL8373 = 1 };
+struct machine_runtime machine_detected = { .isRTL8373 = RTLP_TEST_IS8373 };
 
 /* ---- firmware state the modules read or write ---- */
 uint8_t  outbuf[TCP_OUTBUF_SIZE];
diff --git a/test/test_cpu_vlan.c b/test/test_cpu_vlan.c
new file mode 100644
index 00000000..4bb133db
--- /dev/null
+++ b/test/test_cpu_vlan.c
@@ -0,0 +1,24 @@
+#include <stdint.h>
+#include <stdio.h>
+#include "rtl837x_common.h"
+#include "rtl837x_port.h"
+#include "machine.h"
+#include "support.h"
+#include "hw_mock.h"
+extern const struct machine machine;
+extern struct machine_runtime machine_detected;
+int main(void) {
+ hw_reset();out_reset();
+ hw_reg_set(RTL837X_VLAN_PORT_EGR_TAG,0xa50fffff);
+ hw_reg_set(RTL837x_PVID_BASE_REG+16,0x5a123456);
+ vlan_setup();
+ uint32_t untouched=(1u<<(MACHINE_MIN_PORT*2))-1;
+ CHECK(hw_reg_get(RTL837X_VLAN_PORT_EGR_TAG)==(0xa5000000|untouched),"CPU egress set, unrelated bits preserved");
+ CHECK(hw_reg_get(RTL837x_PVID_BASE_REG+16)==0x5a001001,"CPU PVID initialized explicitly");
+ uint16_t active=((1u<<(MACHINE_MAX_PORT+1))-1)&~((1u<<MACHINE_MIN_PORT)-1);
+ CHECK(hw_reg_get(RTL837X_VLAN_PORT_IGR_FLTR)==(active|PMASK_CPU),"CPU ingress included, excluded user ports rejected");
+ CHECK(hw_vlan_word(1)==(machine_detected.isRTL8373?0x0207ffff:0x0207e3f8),"existing family VLAN membership preserved");
+ CHECK(hw_vlan_word(2)==0,"no unrelated VLAN changed");
+ printf("CPU VLAN min=%u max=%u RTL8373=%u: %d checks, %d failed\n",MACHINE_MIN_PORT,MACHINE_MAX_PORT,machine_detected.isRTL8373,tests_run,tests_failed);
+ return tests_failed?1:0;
+}